{"type":"bundle","id":"bundle--2ed03a67-c931-e804-3c87-0000ba27e390","objects":[{"type":"marking-definition","spec_version":"2.1","id":"marking-definition--550e8400-e29b-41d4-a716-446655440000","created":"2026-08-06T17:30:48-04:00","definition_type":"tlp","name":"TLP:AMBER","definition":{"tlp":"amber"}},{"type":"indicator","spec_version":"2.1","id":"indicator--4f6dd2b0-43ac-e00c-1c6f-000029fbe100","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 223.235.98.95","pattern":"[ipv4-addr:value = '223.235.98.95']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--050a80d1-8030-3b8d-aa26-0000d078c159","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 223.150.173.25","pattern":"[ipv4-addr:value = '223.150.173.25']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e88170d6-41db-fa29-853d-000022844809","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 219.70.147.19","pattern":"[ipv4-addr:value = '219.70.147.19']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdc7e651-6185-dd5e-cd50-00004f2a65b2","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 217.216.119.56","pattern":"[ipv4-addr:value = '217.216.119.56']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7b83b60-573d-aca2-265b-00007115c616","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 217.216.118.82","pattern":"[ipv4-addr:value = '217.216.118.82']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--920a3573-0d6f-b137-697e-0000f742cf31","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 217.60.161.214","pattern":"[ipv4-addr:value = '217.60.161.214']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e281e89-a441-dd05-acc7-0000b5ada364","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 217.60.161.113","pattern":"[ipv4-addr:value = '217.60.161.113']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e9f5cf0-3779-ae28-b02e-0000d38251d0","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 216.245.152.51","pattern":"[ipv4-addr:value = '216.245.152.51']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e64bd3a-db89-95a6-f4cd-0000359abc01","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 216.131.109.14","pattern":"[ipv4-addr:value = '216.131.109.14']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbe5e0d0-a0cc-b79d-9c4b-000084d15faf","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 216.49.128.86","pattern":"[ipv4-addr:value = '216.49.128.86']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04139d13-fdc8-a310-031b-00004ab21955","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 213.57.90.115","pattern":"[ipv4-addr:value = '213.57.90.115']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b77d778-388a-8e05-e88f-00005ab24cd3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 212.32.84.30","pattern":"[ipv4-addr:value = '212.32.84.30']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e1c88a4-0b4b-b0a7-a3ad-00008cebafce","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 212.32.82.30","pattern":"[ipv4-addr:value = '212.32.82.30']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60d08a58-11e7-5b8e-eaf8-0000daec6e9f","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 209.216.103.192","pattern":"[ipv4-addr:value = '209.216.103.192']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a111488c-618c-a4b8-33e8-00004ad20cd9","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 209.173.194.137","pattern":"[ipv4-addr:value = '209.173.194.137']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b73edb8-756b-1b19-a78f-00005744522b","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 209.87.167.145","pattern":"[ipv4-addr:value = '209.87.167.145']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b913bd6-b078-4538-ae26-0000c38a4301","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 209.85.221.175","pattern":"[ipv4-addr:value = '209.85.221.175']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d80c34ed-baa6-1363-2d3b-00006f871235","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 209.46.39.47","pattern":"[ipv4-addr:value = '209.46.39.47']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bf41585-35d4-1e08-d2dc-00008ecaa03c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 208.125.100.218","pattern":"[ipv4-addr:value = '208.125.100.218']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d695105-e997-b1bb-4e66-0000c4f84b63","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 207.81.65.78","pattern":"[ipv4-addr:value = '207.81.65.78']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd05b6c6-5996-0ab5-1a8f-00001a412859","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 205.164.131.252","pattern":"[ipv4-addr:value = '205.164.131.252']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ed216e2-5f89-bc76-b3b8-00003d7fb9c0","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 205.164.131.59","pattern":"[ipv4-addr:value = '205.164.131.59']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30745e57-72af-df25-0aaf-0000dcca3439","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 203.215.167.35","pattern":"[ipv4-addr:value = '203.215.167.35']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55a58630-0b0a-ce8e-1054-00007e7ef66e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 203.17.87.10","pattern":"[ipv4-addr:value = '203.17.87.10']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d16004ea-eee6-0dbd-49a9-0000061fbd32","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 202.163.87.193","pattern":"[ipv4-addr:value = '202.163.87.193']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7666cf06-906c-0b98-1c4a-0000f862bdec","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 202.47.32.146","pattern":"[ipv4-addr:value = '202.47.32.146']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed90c3bb-c617-e9c9-b284-0000a0bfbac4","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 199.96.167.195","pattern":"[ipv4-addr:value = '199.96.167.195']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16ef2dbf-b771-218a-81e8-000083614bc0","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 198.72.181.224","pattern":"[ipv4-addr:value = '198.72.181.224']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f380b31-7ac1-8558-3412-0000f46c622f","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 198.44.157.217","pattern":"[ipv4-addr:value = '198.44.157.217']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44da0dbe-84f2-88cf-cb4a-0000a114087c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 196.243.16.2","pattern":"[ipv4-addr:value = '196.243.16.2']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7d711f8-ec17-fa89-62da-000013361fbd","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 194.5.53.118","pattern":"[ipv4-addr:value = '194.5.53.118']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--006f3cff-109a-2757-6f5d-000019a832b7","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 194.5.53.116","pattern":"[ipv4-addr:value = '194.5.53.116']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--719278ff-d598-5122-d118-00006819c6c3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 193.160.100.153","pattern":"[ipv4-addr:value = '193.160.100.153']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b95f67bb-e003-3b7f-cbc9-0000710489fa","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 193.142.37.167","pattern":"[ipv4-addr:value = '193.142.37.167']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2be0b4dc-d2af-b58a-3429-00004462654b","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 193.9.35.34","pattern":"[ipv4-addr:value = '193.9.35.34']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfdbcd86-3669-9baf-64b0-00002defed36","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 193.9.34.19","pattern":"[ipv4-addr:value = '193.9.34.19']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e8beb00-2fc4-9380-88fb-0000923b8656","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 193.9.33.34","pattern":"[ipv4-addr:value = '193.9.33.34']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5cd2eaf-bfa7-d16c-55a4-000050aacb09","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 192.210.132.15","pattern":"[ipv4-addr:value = '192.210.132.15']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb5e966e-4e9a-320d-d84f-000047f1382b","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 192.140.148.214","pattern":"[ipv4-addr:value = '192.140.148.214']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0dac72c-978e-c824-dce8-000099d27f4a","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 187.40.251.179","pattern":"[ipv4-addr:value = '187.40.251.179']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6cc5aaf-02c5-ce27-3f61-000007c26d2d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 187.13.251.3","pattern":"[ipv4-addr:value = '187.13.251.3']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--170c7685-5ff7-5bd9-b557-00005a711c26","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 187.13.210.199","pattern":"[ipv4-addr:value = '187.13.210.199']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50bf1c2f-dbea-614a-0584-0000a3fe87b0","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.255.130.47","pattern":"[ipv4-addr:value = '185.255.130.47']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d6a240d-2700-5ec8-224d-00002c4e44db","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.239.149.34","pattern":"[ipv4-addr:value = '185.239.149.34']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe810037-d4ad-1818-8d2f-000035e4ed98","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.227.133.19","pattern":"[ipv4-addr:value = '185.227.133.19']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94b39074-1d4e-e53e-e72f-00001ebf0828","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.225.28.208","pattern":"[ipv4-addr:value = '185.225.28.208']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70c0e6c3-cd5c-bc0b-e5b8-00000c5d002d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.214.96.167","pattern":"[ipv4-addr:value = '185.214.96.167']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdf04e7a-b1ef-ba93-0da8-0000e1578336","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.212.111.188","pattern":"[ipv4-addr:value = '185.212.111.188']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64a587d4-7e4a-4e04-0629-0000336bc110","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.212.111.35","pattern":"[ipv4-addr:value = '185.212.111.35']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd36e52b-b32d-3066-83e0-000003f3e585","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.203.122.246","pattern":"[ipv4-addr:value = '185.203.122.246']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e0e2b3f-c678-9364-cc76-00005181ee5f","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.197.248.230","pattern":"[ipv4-addr:value = '185.197.248.230']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c3ddf49-1110-0bb5-3307-000092348419","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.182.52.87","pattern":"[ipv4-addr:value = '185.182.52.87']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7fd2051-5ba3-855a-d6cb-00003d2d480d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 185.181.245.13","pattern":"[ipv4-addr:value = '185.181.245.13']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42eb5969-c09c-bd8a-3969-0000036bc878","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 184.151.246.102","pattern":"[ipv4-addr:value = '184.151.246.102']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec069400-3e99-660f-9aaf-000052810876","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 184.147.183.139","pattern":"[ipv4-addr:value = '184.147.183.139']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7ca2dea-72fb-6e27-780c-000044ad13f4","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 184.98.10.239","pattern":"[ipv4-addr:value = '184.98.10.239']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af5ee182-7836-61ed-bb56-00007b5b3454","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 184.22.1.25","pattern":"[ipv4-addr:value = '184.22.1.25']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc2398ce-807d-3e4f-e0d4-00000e4eeeb8","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.186.31.76","pattern":"[ipv4-addr:value = '182.186.31.76']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be18f22b-d6bb-021f-7c1e-00008020636c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.182.212.82","pattern":"[ipv4-addr:value = '182.182.212.82']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49cca6f5-3b97-16e2-caa6-0000f39de9c4","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.182.206.44","pattern":"[ipv4-addr:value = '182.182.206.44']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54a014f3-99ac-132b-00a4-000080a8818e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.77.76.88","pattern":"[ipv4-addr:value = '182.77.76.88']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d58dd2e-8add-b20f-6dcc-000056869930","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.77.66.164","pattern":"[ipv4-addr:value = '182.77.66.164']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39a5bc66-f96c-96e8-5074-00005493b90e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.69.183.196","pattern":"[ipv4-addr:value = '182.69.183.196']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ca93563-2c8d-089e-17f9-0000bd8033c3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.69.181.104","pattern":"[ipv4-addr:value = '182.69.181.104']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5b00a2f-9185-16c6-a101-0000572ad7ee","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.69.177.233","pattern":"[ipv4-addr:value = '182.69.177.233']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2dab09d-92d1-c86d-756a-0000aa6d462c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 182.1.234.92","pattern":"[ipv4-addr:value = '182.1.234.92']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--641b0f40-b3cd-3dd0-04af-0000c52585a2","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 181.214.206.85","pattern":"[ipv4-addr:value = '181.214.206.85']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cfe75b4-c803-19f7-06ab-0000052501dc","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 181.41.206.113","pattern":"[ipv4-addr:value = '181.41.206.113']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ea49de2-e069-e39d-41e2-00004715831e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 179.209.140.15","pattern":"[ipv4-addr:value = '179.209.140.15']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48004bab-4940-83db-e282-0000091e0617","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 178.212.32.126","pattern":"[ipv4-addr:value = '178.212.32.126']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02348c2c-353c-957e-3ba0-000078dc15bc","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 178.176.79.244","pattern":"[ipv4-addr:value = '178.176.79.244']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eaad27ca-27df-df2e-96f4-000031fcd32f","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 178.175.141.239","pattern":"[ipv4-addr:value = '178.175.141.239']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eaf183d4-069b-02bd-c3a3-000034068b5d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 176.67.87.45","pattern":"[ipv4-addr:value = '176.67.87.45']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91afe03c-e143-8fad-541a-0000761ab905","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 176.32.32.192","pattern":"[ipv4-addr:value = '176.32.32.192']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85c40a9b-1c21-3480-91bb-0000d7838c26","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 175.107.247.151","pattern":"[ipv4-addr:value = '175.107.247.151']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49c6b685-7957-9fd4-1c2a-0000c115805c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 175.29.64.38","pattern":"[ipv4-addr:value = '175.29.64.38']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c9a0914-e3ef-cba0-ca96-0000f291a046","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 174.61.85.70","pattern":"[ipv4-addr:value = '174.61.85.70']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1c76c5a-3cd1-8b82-00c8-0000a1b39a47","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 173.234.100.30","pattern":"[ipv4-addr:value = '173.234.100.30']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36d234a7-00b9-17f9-dc73-000065115b64","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 173.77.236.192","pattern":"[ipv4-addr:value = '173.77.236.192']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b3d7f38-1c20-879a-9fc6-000072c6e846","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 173.52.86.162","pattern":"[ipv4-addr:value = '173.52.86.162']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7aed18fe-9963-bbe0-757f-00003cb09da5","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 172.245.232.62","pattern":"[ipv4-addr:value = '172.245.232.62']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ec6e86e-cd8a-e982-880b-0000f04cd188","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 172.216.250.5","pattern":"[ipv4-addr:value = '172.216.250.5']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e515f7f-edff-fdc2-3ae1-0000f690e420","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 172.216.58.36","pattern":"[ipv4-addr:value = '172.216.58.36']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--694b956f-1b62-6e09-1468-0000c7e3cac5","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 172.94.51.137","pattern":"[ipv4-addr:value = '172.94.51.137']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7159a820-f207-a70b-0614-0000e86acd0c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 170.203.218.77","pattern":"[ipv4-addr:value = '170.203.218.77']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9aa49ea-6f5c-b442-0c64-00000e72b8d5","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 168.232.224.218","pattern":"[ipv4-addr:value = '168.232.224.218']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b323ed4d-2834-7249-d680-00003e8faf83","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 167.71.222.230","pattern":"[ipv4-addr:value = '167.71.222.230']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ce8efff-25bf-5a92-f28d-00000672bd5e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 166.88.155.21","pattern":"[ipv4-addr:value = '166.88.155.21']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05718cb5-d3e6-cbaf-97f4-0000d85f23aa","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 165.245.212.45","pattern":"[ipv4-addr:value = '165.245.212.45']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09bbe557-d3ea-4dd9-20a5-0000807967f2","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 163.227.71.8","pattern":"[ipv4-addr:value = '163.227.71.8']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e0a266b-5659-bf8a-1a95-0000f1e70ab6","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 162.252.55.141","pattern":"[ipv4-addr:value = '162.252.55.141']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4221da03-e071-dc40-a2c5-0000e8c89905","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 162.84.149.215","pattern":"[ipv4-addr:value = '162.84.149.215']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5c2abc2-360e-ae04-5d51-00001d2ba943","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 161.123.151.130","pattern":"[ipv4-addr:value = '161.123.151.130']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bef77706-71ed-c638-ff05-00003dd84ec3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 158.173.166.115","pattern":"[ipv4-addr:value = '158.173.166.115']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ae9e649-948c-9550-7294-0000cd318ac5","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 158.173.89.220","pattern":"[ipv4-addr:value = '158.173.89.220']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f34564a2-3fcf-ef4c-fedb-0000730d3b42","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 158.173.74.225","pattern":"[ipv4-addr:value = '158.173.74.225']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9e801c0-0dcf-b6dc-2bc9-0000191e8d1d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 158.173.74.148","pattern":"[ipv4-addr:value = '158.173.74.148']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80807f0a-6df8-e948-8e93-00009fb6b78a","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 158.173.67.13","pattern":"[ipv4-addr:value = '158.173.67.13']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2fcb044-70a4-439e-abc5-0000fa97585c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 158.173.24.24","pattern":"[ipv4-addr:value = '158.173.24.24']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10ad2efc-9a46-884c-adce-0000c13c00fe","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 157.51.4.21","pattern":"[ipv4-addr:value = '157.51.4.21']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb0ad3c8-4fce-6814-bca3-0000b91a860f","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 157.38.133.227","pattern":"[ipv4-addr:value = '157.38.133.227']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a31c7858-983e-0812-eb12-0000895f3e63","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 156.230.199.24","pattern":"[ipv4-addr:value = '156.230.199.24']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bc79d11-624e-d148-55ba-000078841403","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 156.206.160.247","pattern":"[ipv4-addr:value = '156.206.160.247']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a9fecaa-ca24-405e-3292-000058b73382","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 154.192.204.21","pattern":"[ipv4-addr:value = '154.192.204.21']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be0ad131-5478-240f-17aa-0000926ae8d7","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 154.192.169.54","pattern":"[ipv4-addr:value = '154.192.169.54']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecdca761-ed8a-1b59-b6a3-000091b7335c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 153.67.53.179","pattern":"[ipv4-addr:value = '153.67.53.179']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fd363df-9eed-0c7e-2102-000077f835cc","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 153.66.75.72","pattern":"[ipv4-addr:value = '153.66.75.72']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71f2773e-6970-1bed-22d9-00002a473d3d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 149.88.97.5","pattern":"[ipv4-addr:value = '149.88.97.5']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aef9697-98e6-4ef7-e87c-0000828fc36e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 149.40.247.123","pattern":"[ipv4-addr:value = '149.40.247.123']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08408d88-1416-e0a1-35d2-0000c5b056b3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 149.40.210.70","pattern":"[ipv4-addr:value = '149.40.210.70']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e7c2760-8298-0bba-877a-00006514139d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 148.113.167.2","pattern":"[ipv4-addr:value = '148.113.167.2']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7e9653a-a24a-f0d0-8404-0000bd925f6a","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 147.219.149.3","pattern":"[ipv4-addr:value = '147.219.149.3']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee94c799-87dc-bd2b-5bd1-000000603bf9","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 147.53.121.193","pattern":"[ipv4-addr:value = '147.53.121.193']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65e35a9f-906f-652b-dbc0-0000d884f8f1","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 146.70.72.171","pattern":"[ipv4-addr:value = '146.70.72.171']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5685b5d-8076-b854-223e-0000564fbd20","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 143.198.217.217","pattern":"[ipv4-addr:value = '143.198.217.217']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cd78f29-96cd-4853-4122-00009ca2dea0","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 141.11.22.43","pattern":"[ipv4-addr:value = '141.11.22.43']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b1c2aba-6344-a091-8341-0000607247d5","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 140.228.24.181","pattern":"[ipv4-addr:value = '140.228.24.181']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa0f1815-130d-719f-f1ce-0000813a3760","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 140.141.229.104","pattern":"[ipv4-addr:value = '140.141.229.104']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eae70228-0ee6-1c93-37a9-000016b0964c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 139.135.41.237","pattern":"[ipv4-addr:value = '139.135.41.237']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa367332-fe27-8fb9-d8fc-0000819f6dec","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 138.199.47.186","pattern":"[ipv4-addr:value = '138.199.47.186']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--687c5bad-c16d-589e-e7b5-000042f39189","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 138.199.40.183","pattern":"[ipv4-addr:value = '138.199.40.183']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efe44762-0131-f1c5-331c-00001a9081df","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 138.199.40.173","pattern":"[ipv4-addr:value = '138.199.40.173']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--057a59db-b23c-b663-276f-0000d59843d3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 136.60.41.147","pattern":"[ipv4-addr:value = '136.60.41.147']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19a47dd1-e571-b19e-417f-000013745356","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 135.136.3.9","pattern":"[ipv4-addr:value = '135.136.3.9']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb1d1dda-e76c-e973-a30b-0000bd32397c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 135.0.149.245","pattern":"[ipv4-addr:value = '135.0.149.245']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--497c9627-ac80-bdc0-98a6-0000664a7e45","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 131.106.16.221","pattern":"[ipv4-addr:value = '131.106.16.221']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a13b51e-582d-35ad-f790-0000caa9b1e2","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 129.227.39.115","pattern":"[ipv4-addr:value = '129.227.39.115']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f064f927-6813-a5c8-a5e7-0000bb47bb94","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 129.222.107.214","pattern":"[ipv4-addr:value = '129.222.107.214']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b581ae9e-44ae-d91e-0e80-00007b4f2fd7","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 129.0.60.37","pattern":"[ipv4-addr:value = '129.0.60.37']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72f47ce2-5ebe-d421-b057-000090186da0","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 128.1.227.233","pattern":"[ipv4-addr:value = '128.1.227.233']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--820807c6-a483-d667-1f27-0000a627d44e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 122.173.30.78","pattern":"[ipv4-addr:value = '122.173.30.78']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efd9259c-b326-f520-ddca-000033134da5","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 122.167.158.90","pattern":"[ipv4-addr:value = '122.167.158.90']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92dc9b4c-7581-2221-fde5-00009ef26b34","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 122.167.10.41","pattern":"[ipv4-addr:value = '122.167.10.41']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e105e1f-b3cd-f29a-e683-0000e46a8f50","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 122.96.28.168","pattern":"[ipv4-addr:value = '122.96.28.168']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d13f2740-30f3-7a8d-190e-0000f090987c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 119.252.192.41","pattern":"[ipv4-addr:value = '119.252.192.41']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--192b03a6-2ee3-66ed-7486-0000c4b7e0d3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 119.159.180.234","pattern":"[ipv4-addr:value = '119.159.180.234']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c3a3f40-aaf2-59d5-9eb0-0000e3fc4d2f","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 119.157.21.96","pattern":"[ipv4-addr:value = '119.157.21.96']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2df8783a-958d-7c86-fd24-0000de94b9a2","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 119.156.117.17","pattern":"[ipv4-addr:value = '119.156.117.17']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36dba676-baf7-9b5b-402f-0000e3335d5b","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 119.156.104.8","pattern":"[ipv4-addr:value = '119.156.104.8']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96671eb4-4214-db9c-516a-0000df457395","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 119.155.186.167","pattern":"[ipv4-addr:value = '119.155.186.167']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e785ef4-55e3-11a7-a5f8-000059e0c51f","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 117.219.171.99","pattern":"[ipv4-addr:value = '117.219.171.99']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d8005b3-93bc-0d2d-3a0c-00001a613759","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 117.5.147.241","pattern":"[ipv4-addr:value = '117.5.147.241']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--498dbef5-52b5-b573-fb68-0000e0f171d3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 116.206.159.174","pattern":"[ipv4-addr:value = '116.206.159.174']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--447f0941-7fe4-ecf6-730b-0000355d31b2","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 115.241.43.155","pattern":"[ipv4-addr:value = '115.241.43.155']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92efb4ce-f279-78d9-785b-00003c96ac97","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 115.186.50.239","pattern":"[ipv4-addr:value = '115.186.50.239']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76763b49-c779-1010-b71f-00003553d833","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 114.130.156.156","pattern":"[ipv4-addr:value = '114.130.156.156']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--860c1430-44f8-ac5f-6803-0000607fd7af","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 113.190.204.97","pattern":"[ipv4-addr:value = '113.190.204.97']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dac62396-8fe2-eedb-1ff4-0000209f3505","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 112.80.123.197","pattern":"[ipv4-addr:value = '112.80.123.197']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3d9b7ce-1dd0-5a44-abc0-0000a59fdc1b","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 110.226.115.95","pattern":"[ipv4-addr:value = '110.226.115.95']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dd2f363-a90c-88df-4035-0000cf87653d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 110.225.255.138","pattern":"[ipv4-addr:value = '110.225.255.138']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18c4fc25-94dd-dac4-00af-0000f91bc539","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 110.39.95.3","pattern":"[ipv4-addr:value = '110.39.95.3']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f16bac57-d636-094b-1e93-00008f796616","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 109.248.143.151","pattern":"[ipv4-addr:value = '109.248.143.151']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a8e5e8a-2e60-0218-edc9-0000e85c2591","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 108.216.208.170","pattern":"[ipv4-addr:value = '108.216.208.170']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f9ca85c-f1d3-46f3-ba6c-00006be0c533","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 108.168.10.242","pattern":"[ipv4-addr:value = '108.168.10.242']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fcdacb7-81f9-0063-2f5e-0000d1077b5c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 108.24.128.113","pattern":"[ipv4-addr:value = '108.24.128.113']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4fd0961-d107-2ecd-87b5-0000a0d9e592","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 107.173.217.177","pattern":"[ipv4-addr:value = '107.173.217.177']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c497fdee-d2b1-2a32-bb67-0000a6122779","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 107.173.217.172","pattern":"[ipv4-addr:value = '107.173.217.172']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bef06a09-1dc9-bc52-4682-0000d9463ed2","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 107.173.185.237","pattern":"[ipv4-addr:value = '107.173.185.237']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d74018e5-0eb4-26aa-58dd-00009586fb92","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 107.173.4.207","pattern":"[ipv4-addr:value = '107.173.4.207']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbcd4ac6-645d-c9f7-5334-0000ae4aa0a6","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 106.219.123.15","pattern":"[ipv4-addr:value = '106.219.123.15']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3f1b167-e579-d6f3-eac3-000033390ea6","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 106.219.120.250","pattern":"[ipv4-addr:value = '106.219.120.250']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9eb813b-ffdc-e515-d68b-000003ee5648","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 106.219.120.204","pattern":"[ipv4-addr:value = '106.219.120.204']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57c0756d-581f-e7b5-57fd-000055df74b4","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 106.219.68.118","pattern":"[ipv4-addr:value = '106.219.68.118']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0d94c90-0597-23cb-7410-0000abc8c455","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 106.51.26.71","pattern":"[ipv4-addr:value = '106.51.26.71']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--432661b8-db36-1f25-b016-0000b34a8575","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 105.119.15.154","pattern":"[ipv4-addr:value = '105.119.15.154']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38e1dc63-ac60-43af-5757-000064562d57","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 104.224.48.209","pattern":"[ipv4-addr:value = '104.224.48.209']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d289c398-14f1-780a-90a0-00001e16f2bc","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 104.207.131.9","pattern":"[ipv4-addr:value = '104.207.131.9']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d76e8187-add8-3d9f-41b8-00004b9ed979","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 104.190.138.173","pattern":"[ipv4-addr:value = '104.190.138.173']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--992b5b6b-b6e2-4489-b208-0000df531016","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.240.235.225","pattern":"[ipv4-addr:value = '103.240.235.225']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b21d78d-5640-b302-1907-00003379697d","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.237.39.212","pattern":"[ipv4-addr:value = '103.237.39.212']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f6ea291-d077-d656-272e-0000f561a5dc","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.203.45.3","pattern":"[ipv4-addr:value = '103.203.45.3']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bed2041-159f-ca14-e8cd-000077ef764c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.187.94.138","pattern":"[ipv4-addr:value = '103.187.94.138']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61c8771e-ef46-494f-08b8-0000bfc309a5","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.164.147.97","pattern":"[ipv4-addr:value = '103.164.147.97']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41a7f75a-6e51-c788-ab0a-0000c66e20eb","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.157.94.22","pattern":"[ipv4-addr:value = '103.157.94.22']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f09442a4-87a0-7f38-dba4-0000f75a1ae8","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.154.49.201","pattern":"[ipv4-addr:value = '103.154.49.201']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0621840a-b8cb-a648-396f-0000b5d91abf","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.120.44.203","pattern":"[ipv4-addr:value = '103.120.44.203']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--129958a4-54d5-7cad-e3e4-00000a38019f","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.111.133.149","pattern":"[ipv4-addr:value = '103.111.133.149']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3fb766e-ef25-cf98-694f-0000e7fbf2f6","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.85.113.97","pattern":"[ipv4-addr:value = '103.85.113.97']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd975d08-a681-1419-5fbd-000078e0d9fb","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.68.31.68","pattern":"[ipv4-addr:value = '103.68.31.68']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--741fdd7d-ee0f-6361-a18f-0000c7106ee0","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 103.39.119.175","pattern":"[ipv4-addr:value = '103.39.119.175']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f821326-2a98-5563-0171-0000e2832e55","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 102.244.44.92","pattern":"[ipv4-addr:value = '102.244.44.92']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e925a855-e9d3-a531-c323-0000ba22d8c3","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 102.88.114.33","pattern":"[ipv4-addr:value = '102.88.114.33']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e173c974-5e41-a484-ff5b-00000c0894b8","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 102.67.1.67","pattern":"[ipv4-addr:value = '102.67.1.67']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1f0d7ec-c822-2809-b33c-00004f9ff94a","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 99.254.186.161","pattern":"[ipv4-addr:value = '99.254.186.161']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9a8a06f-8805-3943-d9b5-00009150ce05","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 99.247.151.64","pattern":"[ipv4-addr:value = '99.247.151.64']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb8a7eae-d5ba-7781-754c-000022dac5fb","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 99.241.187.68","pattern":"[ipv4-addr:value = '99.241.187.68']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69cfb0a3-a0af-ad99-8def-0000eba88644","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 98.242.109.70","pattern":"[ipv4-addr:value = '98.242.109.70']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f02bbe06-6fd5-64bf-f7d8-0000df607a0b","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 98.210.174.219","pattern":"[ipv4-addr:value = '98.210.174.219']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--078c86d3-7036-4782-3624-00000b2d0468","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 98.164.90.6","pattern":"[ipv4-addr:value = '98.164.90.6']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e470204-bced-c36f-fb8e-00002f815942","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 98.35.15.100","pattern":"[ipv4-addr:value = '98.35.15.100']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32c06e15-c33b-375b-9f78-0000385c2ba6","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 96.249.215.64","pattern":"[ipv4-addr:value = '96.249.215.64']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edd7b52f-b857-486f-bfc1-00000cf42194","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 96.231.44.60","pattern":"[ipv4-addr:value = '96.231.44.60']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5246040f-b456-5734-bb49-0000251639bd","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 96.125.193.142","pattern":"[ipv4-addr:value = '96.125.193.142']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06c32b73-f6ff-a056-d656-00000d4d669b","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 95.214.113.19","pattern":"[ipv4-addr:value = '95.214.113.19']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7587f6cb-c2a0-a7f7-177a-0000d9339f06","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 95.214.112.23","pattern":"[ipv4-addr:value = '95.214.112.23']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa899ce7-7205-0933-509b-00004d65a3e0","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 95.24.13.21","pattern":"[ipv4-addr:value = '95.24.13.21']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15534381-c5bc-e783-2e65-000068ae1f5e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 94.249.154.64","pattern":"[ipv4-addr:value = '94.249.154.64']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0e02b1a-773c-dd5c-f424-0000b9720056","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 94.202.231.210","pattern":"[ipv4-addr:value = '94.202.231.210']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b34282a-4617-7e39-b3e2-0000ff3d4ccb","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 94.154.127.229","pattern":"[ipv4-addr:value = '94.154.127.229']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d758cd39-2743-e08f-10b0-00004eb257c2","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 93.145.149.106","pattern":"[ipv4-addr:value = '93.145.149.106']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4cedc70-86f4-4bbf-75b8-000005b9a0ea","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 91.205.230.210","pattern":"[ipv4-addr:value = '91.205.230.210']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69f9644e-66fa-8fbe-c54c-000081c61d1e","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 91.151.136.81","pattern":"[ipv4-addr:value = '91.151.136.81']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15f464ef-0a54-ce1e-2cfe-000036daecbb","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 91.124.17.47","pattern":"[ipv4-addr:value = '91.124.17.47']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b4fa80d-07b0-f6c9-ea20-0000c840ddf5","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 88.203.42.195","pattern":"[ipv4-addr:value = '88.203.42.195']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5671383-64f6-c865-9643-000031f3dc1c","created":"2026-08-06T14:29:22-04:00","modified":"2026-08-06T14:29:22-04:00","name":"ip: 88.23.40.61","pattern":"[ipv4-addr:value = '88.23.40.61']","pattern_type":"stix","valid_from":"2026-08-06T14:29:22-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d74f7f7-6853-442c-93ff-0000ddc72e9c","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 87.120.102.121","pattern":"[ipv4-addr:value = '87.120.102.121']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3ba1016-b091-abbe-4e69-0000a4ccd524","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 87.101.94.189","pattern":"[ipv4-addr:value = '87.101.94.189']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c2891ab-7038-65a9-9883-00006f1819f5","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 86.48.10.122","pattern":"[ipv4-addr:value = '86.48.10.122']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad4f71a0-1a59-1cb6-5931-00002ce6e321","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 85.203.15.129","pattern":"[ipv4-addr:value = '85.203.15.129']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07e239ba-87ac-2a4d-33d3-0000e4cc7af5","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 84.39.151.186","pattern":"[ipv4-addr:value = '84.39.151.186']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41e28b9f-05da-25d1-a1ba-000029503eb2","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 83.40.248.25","pattern":"[ipv4-addr:value = '83.40.248.25']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ca72e00-4555-5cf6-05a5-000079358245","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 82.197.76.42","pattern":"[ipv4-addr:value = '82.197.76.42']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4213276f-9310-4df9-e971-0000e28c333d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 82.149.83.42","pattern":"[ipv4-addr:value = '82.149.83.42']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba03a54c-a8f1-497f-cc07-00005f935e40","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 82.149.80.19","pattern":"[ipv4-addr:value = '82.149.80.19']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5eff0913-1c91-c74a-59a0-0000bdd014e4","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 82.18.102.152","pattern":"[ipv4-addr:value = '82.18.102.152']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--485a883b-f038-08ab-42c1-00007a321f5d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 81.17.123.46","pattern":"[ipv4-addr:value = '81.17.123.46']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3479d6d3-9e66-1e6f-d6b3-000060466669","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 79.127.181.87","pattern":"[ipv4-addr:value = '79.127.181.87']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9dd0a79a-a7b8-cc73-e0fc-000066ff7a26","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 78.157.213.61","pattern":"[ipv4-addr:value = '78.157.213.61']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a29ecc15-6195-929c-5b83-00000084793c","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 77.238.225.70","pattern":"[ipv4-addr:value = '77.238.225.70']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcb88399-15e1-1319-cace-000071d18c5c","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 77.83.26.78","pattern":"[ipv4-addr:value = '77.83.26.78']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c845364-aa11-d910-e585-000056107144","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 77.83.25.57","pattern":"[ipv4-addr:value = '77.83.25.57']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f84810a-f199-c301-2b4a-0000c5b36795","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 76.95.2.77","pattern":"[ipv4-addr:value = '76.95.2.77']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69125e94-c2a4-2780-4adf-00003c1de9d2","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 76.39.128.156","pattern":"[ipv4-addr:value = '76.39.128.156']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5996760-da6f-b113-f567-000013c8f9e8","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 76.38.100.125","pattern":"[ipv4-addr:value = '76.38.100.125']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4bcb723-1d61-9045-3a63-00004e4f06df","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 76.33.58.3","pattern":"[ipv4-addr:value = '76.33.58.3']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa514a61-29ea-8ec4-44a8-00004f0cbb14","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 76.30.107.140","pattern":"[ipv4-addr:value = '76.30.107.140']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bc58d54-7771-a5a0-f8a8-0000e83dbf25","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 74.215.162.191","pattern":"[ipv4-addr:value = '74.215.162.191']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ba97a08-81c0-e3b4-dbe8-0000ddeabaae","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 74.196.89.127","pattern":"[ipv4-addr:value = '74.196.89.127']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ef0bfd8-fdd5-9212-ed8f-0000b7dc4cd7","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.198.133.162","pattern":"[ipv4-addr:value = '73.198.133.162']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bcc7526-33a2-6a16-c29b-00004652de76","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.178.26.21","pattern":"[ipv4-addr:value = '73.178.26.21']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--197dbec3-d320-ff25-b915-000069edb056","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.165.166.238","pattern":"[ipv4-addr:value = '73.165.166.238']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c9cda71-a55c-112a-6da7-0000f5c1accc","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.162.170.205","pattern":"[ipv4-addr:value = '73.162.170.205']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6738deb1-a886-398b-282c-00003956b43f","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.152.56.49","pattern":"[ipv4-addr:value = '73.152.56.49']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba8d5497-b37e-17b3-edcf-0000f7e58090","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.145.54.44","pattern":"[ipv4-addr:value = '73.145.54.44']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb9130fc-03b7-c3d5-7b61-00003b33d6a1","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.67.1.129","pattern":"[ipv4-addr:value = '73.67.1.129']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e60689f8-58b6-02ae-d42a-0000ede2051a","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.66.106.193","pattern":"[ipv4-addr:value = '73.66.106.193']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8afcb8d-979f-607b-9cd3-00002778f6bc","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 73.50.67.119","pattern":"[ipv4-addr:value = '73.50.67.119']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03150833-a607-f02f-5b9b-00005f535d3a","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 72.77.57.162","pattern":"[ipv4-addr:value = '72.77.57.162']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--946a71dc-8e40-58b7-07b9-0000af6cecfe","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 72.56.147.30","pattern":"[ipv4-addr:value = '72.56.147.30']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8e4ff63-31fe-dc70-0a7a-0000c6319c20","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 71.196.36.175","pattern":"[ipv4-addr:value = '71.196.36.175']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5531663-418b-5dd2-0de4-00001fe7eb4b","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 71.187.114.122","pattern":"[ipv4-addr:value = '71.187.114.122']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81dc76b6-da6a-a4ea-5eb7-0000ae1aefc6","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 71.164.79.136","pattern":"[ipv4-addr:value = '71.164.79.136']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c62e6dd2-f4b6-c4b5-da56-000025eecf7b","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 71.125.238.170","pattern":"[ipv4-addr:value = '71.125.238.170']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b0f9a9f-ed9a-74f7-8c4d-000043e014ad","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 70.180.194.118","pattern":"[ipv4-addr:value = '70.180.194.118']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1daf1c5-9402-ff62-74cb-0000d9d4f376","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 70.107.105.63","pattern":"[ipv4-addr:value = '70.107.105.63']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84638cfb-7a3a-fbbe-a3f0-0000b6a5c033","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 69.242.46.97","pattern":"[ipv4-addr:value = '69.242.46.97']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f944bdc-88cc-35b5-c6b4-00006960feb2","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 69.119.15.1","pattern":"[ipv4-addr:value = '69.119.15.1']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2b3782e-c97d-2575-ce46-0000f03aa1bc","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 69.14.53.106","pattern":"[ipv4-addr:value = '69.14.53.106']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53e062b9-e206-1625-3aeb-00003358f548","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 68.252.238.28","pattern":"[ipv4-addr:value = '68.252.238.28']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32800b1d-b1e5-e8b9-ebff-0000cd5d3439","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 68.187.40.86","pattern":"[ipv4-addr:value = '68.187.40.86']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4c53753-f9cb-7be1-7d4b-00008cc8fc70","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 68.145.234.181","pattern":"[ipv4-addr:value = '68.145.234.181']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--180f7479-a07b-a88f-f129-00000c76dcb8","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 68.114.121.113","pattern":"[ipv4-addr:value = '68.114.121.113']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8be9b1e2-68fd-26c8-2112-000075cd2ab0","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 68.84.164.218","pattern":"[ipv4-addr:value = '68.84.164.218']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d522e75-4aa0-da55-58b0-00002b7d0e03","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 67.167.235.160","pattern":"[ipv4-addr:value = '67.167.235.160']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d9b7b50-76d3-49c0-254d-0000d88f3b56","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 67.115.34.93","pattern":"[ipv4-addr:value = '67.115.34.93']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f12a2f1c-6311-1ac8-09bc-0000e8452203","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 67.20.1.180","pattern":"[ipv4-addr:value = '67.20.1.180']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84c6a5ea-1cc4-c7dd-ab09-0000a7ce7bea","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 66.179.156.137","pattern":"[ipv4-addr:value = '66.179.156.137']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa302035-73c1-e413-72c0-00003cbcab63","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 66.63.160.200","pattern":"[ipv4-addr:value = '66.63.160.200']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ff7fe22-bf53-15f0-b381-0000585455e1","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 65.181.8.191","pattern":"[ipv4-addr:value = '65.181.8.191']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5d5a36b-c21f-ef02-2813-00006c3526c6","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 65.25.84.169","pattern":"[ipv4-addr:value = '65.25.84.169']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee59006e-a0ab-7b47-b6ce-00005e9d1b5d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 64.180.247.138","pattern":"[ipv4-addr:value = '64.180.247.138']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfad6800-ff3e-b409-8f4c-0000e68a85ea","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 64.137.79.72","pattern":"[ipv4-addr:value = '64.137.79.72']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acce1d08-8ec4-f3db-c7cd-00000e3cf932","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 64.64.127.212","pattern":"[ipv4-addr:value = '64.64.127.212']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--509e41b8-66bb-e451-8d19-00008824b605","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 64.64.108.3","pattern":"[ipv4-addr:value = '64.64.108.3']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38c8f245-b42e-564f-ab4f-00007b5ea395","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 62.93.167.67","pattern":"[ipv4-addr:value = '62.93.167.67']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--695a73fd-ae88-c656-081b-0000cdfd6501","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 57.138.49.74","pattern":"[ipv4-addr:value = '57.138.49.74']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e754e486-22ad-066c-5d8e-00006f5d4dd5","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 54.196.174.13","pattern":"[ipv4-addr:value = '54.196.174.13']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0a0345b-1005-51d1-d8f6-0000dd1873a7","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 54.178.124.36","pattern":"[ipv4-addr:value = '54.178.124.36']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fce77af-c4c5-395a-6d6c-0000421d785a","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 54.145.250.53","pattern":"[ipv4-addr:value = '54.145.250.53']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8be86820-63a4-c18d-e98a-0000730ef50d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 50.107.59.88","pattern":"[ipv4-addr:value = '50.107.59.88']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb29fb22-efc8-0d36-b42f-0000283e65b0","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 49.156.93.39","pattern":"[ipv4-addr:value = '49.156.93.39']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f6197a3-267e-181d-cc1f-00004ea2d581","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 49.156.79.208","pattern":"[ipv4-addr:value = '49.156.79.208']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca7a192c-89fa-9a9a-d13b-0000f8b9ba39","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 49.43.242.63","pattern":"[ipv4-addr:value = '49.43.242.63']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29678adb-f519-d33f-0d09-0000ca42eca0","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 49.43.180.32","pattern":"[ipv4-addr:value = '49.43.180.32']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a574fa8-5318-a73a-6784-0000255ee39a","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 49.36.177.204","pattern":"[ipv4-addr:value = '49.36.177.204']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24f6abd7-9f9b-f183-2c55-00002a9ebe63","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 49.36.139.175","pattern":"[ipv4-addr:value = '49.36.139.175']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1b7b701-71ea-2d9b-fede-0000e9fd65f4","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.230.49.158","pattern":"[ipv4-addr:value = '47.230.49.158']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--835ca55f-cea3-04f3-280a-00003e7c268d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.218.30.46","pattern":"[ipv4-addr:value = '47.218.30.46']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fa0b83d-4057-368e-97d4-00000ab1df8d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.197.155.22","pattern":"[ipv4-addr:value = '47.197.155.22']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--995dfbe7-f1af-aece-9677-00009eb364cf","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.195.210.31","pattern":"[ipv4-addr:value = '47.195.210.31']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1491309-77ad-3f57-20ff-0000f09f88f3","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.150.114.217","pattern":"[ipv4-addr:value = '47.150.114.217']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22d3d230-1645-8cd5-d628-0000127814f5","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.148.96.20","pattern":"[ipv4-addr:value = '47.148.96.20']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19db2dc0-65c1-e62b-5a1b-00002bc621cd","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.18.35.69","pattern":"[ipv4-addr:value = '47.18.35.69']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15890fa8-b9cf-7e38-76e1-000053828dd4","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.11.100.52","pattern":"[ipv4-addr:value = '47.11.100.52']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b223f4ea-8aba-fa6a-8dd7-0000bba22c6d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 47.11.99.205","pattern":"[ipv4-addr:value = '47.11.99.205']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc9372ca-6669-9b3e-56da-00002afd206a","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.251.50.203","pattern":"[ipv4-addr:value = '45.251.50.203']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf670cc3-9463-4a5f-22b6-00004c82c4ec","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.145.129.225","pattern":"[ipv4-addr:value = '45.145.129.225']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcb642eb-2648-b2b6-fa58-000080bb4500","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.134.188.36","pattern":"[ipv4-addr:value = '45.134.188.36']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b169e7e3-cc69-894b-34a0-0000eeded5b0","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.129.32.31","pattern":"[ipv4-addr:value = '45.129.32.31']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2318451e-1337-4b7d-10b1-000077141af5","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.117.62.242","pattern":"[ipv4-addr:value = '45.117.62.242']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c7f5603-1b20-9b88-1ecf-00000cc64850","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.95.242.40","pattern":"[ipv4-addr:value = '45.95.242.40']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f671d04b-f5a5-375f-9c73-000030bd0146","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.95.162.20","pattern":"[ipv4-addr:value = '45.95.162.20']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c7818c0-525b-dd27-18d8-00007d75a04d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.95.160.20","pattern":"[ipv4-addr:value = '45.95.160.20']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--517ae878-653d-87db-e0d3-0000ecd47be3","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.85.251.235","pattern":"[ipv4-addr:value = '45.85.251.235']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--858a4159-bb4c-ced7-57c4-0000cf41a1bc","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.82.66.73","pattern":"[ipv4-addr:value = '45.82.66.73']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71b67d20-e504-35d7-96ec-00001ed3ebb8","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 45.11.20.22","pattern":"[ipv4-addr:value = '45.11.20.22']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0edbc4f4-d30b-bede-fc71-0000493a9fe6","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 42.104.157.220","pattern":"[ipv4-addr:value = '42.104.157.220']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67f7623c-fe07-c79a-1484-000075acad51","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 41.210.159.105","pattern":"[ipv4-addr:value = '41.210.159.105']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b720482b-27de-83ce-4d2b-0000ab9430c6","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 39.46.102.43","pattern":"[ipv4-addr:value = '39.46.102.43']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b218d38f-0fe7-31cb-3fae-0000062206df","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 39.44.31.232","pattern":"[ipv4-addr:value = '39.44.31.232']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf151aa5-a366-6480-833e-00008bf1cdee","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 39.43.189.215","pattern":"[ipv4-addr:value = '39.43.189.215']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9243b384-eece-7e11-7f95-0000a8649e17","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 38.34.102.92","pattern":"[ipv4-addr:value = '38.34.102.92']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c83fb259-aa88-4845-b1d0-0000ebf54faf","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 38.7.180.87","pattern":"[ipv4-addr:value = '38.7.180.87']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01147f20-a36d-abd8-b2a9-0000f0ddfa36","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 37.114.130.20","pattern":"[ipv4-addr:value = '37.114.130.20']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ef54603-43c9-4030-ef28-000011711abe","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 37.114.50.160","pattern":"[ipv4-addr:value = '37.114.50.160']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7be2f6e7-2ecb-ee24-d291-0000e002facd","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 37.72.141.146","pattern":"[ipv4-addr:value = '37.72.141.146']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7d53167-fe73-f60e-6dad-0000de81a9a2","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 34.38.252.221","pattern":"[ipv4-addr:value = '34.38.252.221']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfe2bb95-3909-dc2a-053c-0000f5667894","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 31.134.12.61","pattern":"[ipv4-addr:value = '31.134.12.61']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba2dc82a-fe1e-896d-5023-00005f378faa","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 31.58.50.222","pattern":"[ipv4-addr:value = '31.58.50.222']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a2681c2-c812-53fb-389d-0000c690af71","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 27.63.43.35","pattern":"[ipv4-addr:value = '27.63.43.35']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70142b79-8dd8-b00d-715c-0000f7a2f8c6","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 27.59.79.206","pattern":"[ipv4-addr:value = '27.59.79.206']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0950bfa0-3fa0-8283-be50-0000503aa889","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 27.4.127.146","pattern":"[ipv4-addr:value = '27.4.127.146']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dd90a0a-d1b4-bdab-682a-0000bfd9cf60","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 24.200.100.26","pattern":"[ipv4-addr:value = '24.200.100.26']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30b39eb6-d708-a357-039f-000000cb34e3","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 24.141.197.219","pattern":"[ipv4-addr:value = '24.141.197.219']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--403e86d1-eec3-9383-2902-0000391b2158","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 24.141.161.23","pattern":"[ipv4-addr:value = '24.141.161.23']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28a6b0e0-548d-6ae5-287b-000030fcdbeb","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 24.79.91.85","pattern":"[ipv4-addr:value = '24.79.91.85']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47dd8c90-80ee-0bda-61cf-000030acb1e1","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 24.79.59.165","pattern":"[ipv4-addr:value = '24.79.59.165']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ba06bf1-5fce-5174-a228-00007224b0a1","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 24.69.248.240","pattern":"[ipv4-addr:value = '24.69.248.240']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4592ff8c-2d17-dcb2-204d-00001fd7ce75","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 24.57.242.161","pattern":"[ipv4-addr:value = '24.57.242.161']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--411a5eb5-d48b-d8be-3827-0000b082d439","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 24.47.156.132","pattern":"[ipv4-addr:value = '24.47.156.132']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7acb81b6-e5d9-a05e-28d2-00008dc3736e","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 23.242.125.47","pattern":"[ipv4-addr:value = '23.242.125.47']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31c29c8d-8d82-1429-d6e4-0000d277bb86","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 23.234.118.91","pattern":"[ipv4-addr:value = '23.234.118.91']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c8928ef-b879-0087-9b66-000049b0887d","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 23.83.218.24","pattern":"[ipv4-addr:value = '23.83.218.24']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72792e76-2251-283c-780c-0000005012eb","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 14.163.81.136","pattern":"[ipv4-addr:value = '14.163.81.136']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42c94a0d-5081-037d-6f1b-000086442727","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 14.102.191.21","pattern":"[ipv4-addr:value = '14.102.191.21']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e1a1cc2-1b14-ed57-3390-0000482e04b4","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 14.102.33.178","pattern":"[ipv4-addr:value = '14.102.33.178']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97bb1e1b-ea70-972a-d0d0-0000f6dad26f","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 9.195.164.251","pattern":"[ipv4-addr:value = '9.195.164.251']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a534c051-53a4-816f-10c6-00009d27b8bc","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 5.255.107.133","pattern":"[ipv4-addr:value = '5.255.107.133']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7102d5df-d501-9cea-103d-000055fa3da4","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 5.180.61.21","pattern":"[ipv4-addr:value = '5.180.61.21']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8c62d94-8561-010e-e621-0000f5115880","created":"2026-08-06T14:29:21-04:00","modified":"2026-08-06T14:29:21-04:00","name":"ip: 2.123.153.192","pattern":"[ipv4-addr:value = '2.123.153.192']","pattern_type":"stix","valid_from":"2026-08-06T14:29:21-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4df65318-8fe6-dc17-aa53-0000d59a66cc","created":"2026-08-06T14:00:20-04:00","modified":"2026-08-06T14:00:20-04:00","name":"ip: 83.217.209.218","pattern":"[ipv4-addr:value = '83.217.209.218']","pattern_type":"stix","valid_from":"2026-08-06T14:00:20-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43b3604a-05cb-1d11-8260-0000e2c73649","created":"2026-08-06T13:57:31-04:00","modified":"2026-08-06T13:57:31-04:00","name":"ip: 2606:4700:3033::ac43:bc20","pattern":"[ipv4-addr:value = '2606:4700:3033::ac43:bc20']","pattern_type":"stix","valid_from":"2026-08-06T13:57:31-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39b288e8-64e9-e4bf-ecb2-0000d027f869","created":"2026-08-06T13:18:42-04:00","modified":"2026-08-06T13:18:43-04:00","name":"ip: 204.8.99.144","pattern":"[ipv4-addr:value = '204.8.99.144']","pattern_type":"stix","valid_from":"2026-08-06T13:18:42-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f361ed5d-ef48-d1f5-0835-0000744dfd90","created":"2026-08-06T13:18:42-04:00","modified":"2026-08-06T13:18:43-04:00","name":"ip: 116.202.120.166","pattern":"[ipv4-addr:value = '116.202.120.166']","pattern_type":"stix","valid_from":"2026-08-06T13:18:42-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--544f8f0d-f034-33a7-d29e-00006d4a079e","created":"2026-08-06T13:18:42-04:00","modified":"2026-08-06T13:18:43-04:00","name":"ip: 95.216.163.36","pattern":"[ipv4-addr:value = '95.216.163.36']","pattern_type":"stix","valid_from":"2026-08-06T13:18:42-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7bce9c4-a971-c0b4-bd37-0000d3a32c07","created":"2026-08-06T13:18:42-04:00","modified":"2026-08-06T13:18:43-04:00","name":"ip: 204.8.99.146","pattern":"[ipv4-addr:value = '204.8.99.146']","pattern_type":"stix","valid_from":"2026-08-06T13:18:42-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a68bce7-a812-4ba4-88b9-0000760b43c9","created":"2026-08-06T13:18:42-04:00","modified":"2026-08-06T13:18:43-04:00","name":"ip: 116.202.120.165","pattern":"[ipv4-addr:value = '116.202.120.165']","pattern_type":"stix","valid_from":"2026-08-06T13:18:42-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9668477-6f7a-4e11-7c11-00002f48b243","created":"2026-08-06T13:18:41-04:00","modified":"2026-08-06T13:18:41-04:00","name":"ip: 172.67.213.164","pattern":"[ipv4-addr:value = '172.67.213.164']","pattern_type":"stix","valid_from":"2026-08-06T13:18:41-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1c2b5c9-103d-7668-fd94-000004d079eb","created":"2026-08-06T13:18:41-04:00","modified":"2026-08-06T13:18:41-04:00","name":"ip: 104.21.23.208","pattern":"[ipv4-addr:value = '104.21.23.208']","pattern_type":"stix","valid_from":"2026-08-06T13:18:41-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07464f05-bdb1-0324-37bd-00003ef71c2f","created":"2026-08-06T13:18:41-04:00","modified":"2026-08-06T13:18:41-04:00","name":"ip: 104.21.18.210","pattern":"[ipv4-addr:value = '104.21.18.210']","pattern_type":"stix","valid_from":"2026-08-06T13:18:41-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6773aa6-0fee-3824-23c0-00009bb29787","created":"2026-08-06T13:18:41-04:00","modified":"2026-08-06T13:18:41-04:00","name":"ip: 172.67.183.93","pattern":"[ipv4-addr:value = '172.67.183.93']","pattern_type":"stix","valid_from":"2026-08-06T13:18:41-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e4ca72a-231d-bfca-652b-0000823a0702","created":"2026-08-06T13:18:40-04:00","modified":"2026-08-06T13:18:40-04:00","name":"ip: 172.67.179.55","pattern":"[ipv4-addr:value = '172.67.179.55']","pattern_type":"stix","valid_from":"2026-08-06T13:18:40-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3fda277-8bca-6f4b-a26d-0000fd456d25","created":"2026-08-06T13:18:40-04:00","modified":"2026-08-06T13:18:40-04:00","name":"ip: 104.21.83.166","pattern":"[ipv4-addr:value = '104.21.83.166']","pattern_type":"stix","valid_from":"2026-08-06T13:18:40-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a32abd4-2723-b583-bd45-000001b34364","created":"2026-08-06T13:18:40-04:00","modified":"2026-08-06T13:18:40-04:00","name":"ip: 172.67.147.11","pattern":"[ipv4-addr:value = '172.67.147.11']","pattern_type":"stix","valid_from":"2026-08-06T13:18:40-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f917437-e18c-6d01-e5cc-0000628ce9ad","created":"2026-08-06T13:18:40-04:00","modified":"2026-08-06T13:18:40-04:00","name":"ip: 104.21.79.185","pattern":"[ipv4-addr:value = '104.21.79.185']","pattern_type":"stix","valid_from":"2026-08-06T13:18:40-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7482771-5a91-4477-4d7c-000036cde9b9","created":"2026-08-06T13:18:39-04:00","modified":"2026-08-06T13:18:39-04:00","name":"ip: 104.21.92.149","pattern":"[ipv4-addr:value = '104.21.92.149']","pattern_type":"stix","valid_from":"2026-08-06T13:18:39-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9f630fe-2b96-781a-c9f5-00000905b644","created":"2026-08-06T13:18:39-04:00","modified":"2026-08-06T13:18:39-04:00","name":"ip: 172.67.195.70","pattern":"[ipv4-addr:value = '172.67.195.70']","pattern_type":"stix","valid_from":"2026-08-06T13:18:39-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6ea540b-6f54-273e-f6ae-00002a1159e1","created":"2026-08-06T13:18:38-04:00","modified":"2026-08-06T13:18:38-04:00","name":"ip: 216.24.57.7","pattern":"[ipv4-addr:value = '216.24.57.7']","pattern_type":"stix","valid_from":"2026-08-06T13:18:38-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--459fbff4-7963-31ab-781d-00008eed7c16","created":"2026-08-06T13:18:38-04:00","modified":"2026-08-06T13:18:38-04:00","name":"ip: 216.24.57.15","pattern":"[ipv4-addr:value = '216.24.57.15']","pattern_type":"stix","valid_from":"2026-08-06T13:18:38-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6823f4e0-d09f-c894-4013-0000414d1ee7","created":"2026-08-06T13:18:38-04:00","modified":"2026-08-06T13:18:39-04:00","name":"ip: 15.197.225.128","pattern":"[ipv4-addr:value = '15.197.225.128']","pattern_type":"stix","valid_from":"2026-08-06T13:18:38-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--875cfe10-07ec-1309-8599-0000b524f93b","created":"2026-08-06T13:18:38-04:00","modified":"2026-08-06T13:18:39-04:00","name":"ip: 3.33.251.168","pattern":"[ipv4-addr:value = '3.33.251.168']","pattern_type":"stix","valid_from":"2026-08-06T13:18:38-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdc5011e-e3aa-59b8-51f3-000006a541a1","created":"2026-08-06T13:18:37-04:00","modified":"2026-08-06T13:18:37-04:00","name":"ip: 172.66.137.203","pattern":"[ipv4-addr:value = '172.66.137.203']","pattern_type":"stix","valid_from":"2026-08-06T13:18:37-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a9d56b9-83f7-8db8-68fc-000012ec6880","created":"2026-08-06T13:18:37-04:00","modified":"2026-08-06T13:18:37-04:00","name":"ip: 172.66.135.182","pattern":"[ipv4-addr:value = '172.66.135.182']","pattern_type":"stix","valid_from":"2026-08-06T13:18:37-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0f79c5a-4769-471f-566f-00001c0e396b","created":"2026-08-06T13:18:37-04:00","modified":"2026-08-06T13:18:37-04:00","name":"ip: 209.124.55.40","pattern":"[ipv4-addr:value = '209.124.55.40']","pattern_type":"stix","valid_from":"2026-08-06T13:18:37-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dc80246-329a-5141-c847-0000edce174a","created":"2026-08-06T13:18:37-04:00","modified":"2026-08-06T13:18:37-04:00","name":"ip: 104.20.34.201","pattern":"[ipv4-addr:value = '104.20.34.201']","pattern_type":"stix","valid_from":"2026-08-06T13:18:37-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1f76de3-8284-103b-e120-0000e3b3af10","created":"2026-08-06T13:18:37-04:00","modified":"2026-08-06T13:18:37-04:00","name":"ip: 172.66.151.107","pattern":"[ipv4-addr:value = '172.66.151.107']","pattern_type":"stix","valid_from":"2026-08-06T13:18:37-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c345c40-fced-f293-61a3-00003747bdc3","created":"2026-08-06T13:18:36-04:00","modified":"2026-08-06T13:18:37-04:00","name":"ip: 172.67.70.195","pattern":"[ipv4-addr:value = '172.67.70.195']","pattern_type":"stix","valid_from":"2026-08-06T13:18:36-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a63c7828-881d-a8b3-e158-0000a66042b5","created":"2026-08-06T13:18:36-04:00","modified":"2026-08-06T13:18:37-04:00","name":"ip: 104.26.3.15","pattern":"[ipv4-addr:value = '104.26.3.15']","pattern_type":"stix","valid_from":"2026-08-06T13:18:36-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e801f4d-b3d5-37d5-50de-00006d3c9110","created":"2026-08-06T13:18:36-04:00","modified":"2026-08-06T13:18:37-04:00","name":"ip: 104.26.2.15","pattern":"[ipv4-addr:value = '104.26.2.15']","pattern_type":"stix","valid_from":"2026-08-06T13:18:36-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42a01c96-84d0-7ea6-9c6e-000096f9805e","created":"2026-08-06T13:18:36-04:00","modified":"2026-08-06T13:18:36-04:00","name":"ip: 104.21.13.230","pattern":"[ipv4-addr:value = '104.21.13.230']","pattern_type":"stix","valid_from":"2026-08-06T13:18:36-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--831c9867-5ddc-20d8-22c9-0000718bd627","created":"2026-08-06T13:18:36-04:00","modified":"2026-08-06T13:18:36-04:00","name":"ip: 172.67.133.104","pattern":"[ipv4-addr:value = '172.67.133.104']","pattern_type":"stix","valid_from":"2026-08-06T13:18:36-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36f9c55b-77fa-9ac5-3e6c-000017a23774","created":"2026-08-06T13:18:36-04:00","modified":"2026-08-06T13:18:36-04:00","name":"ip: 172.67.65.180","pattern":"[ipv4-addr:value = '172.67.65.180']","pattern_type":"stix","valid_from":"2026-08-06T13:18:36-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bcc046b-1745-69e4-0f44-000024879e94","created":"2026-08-06T13:18:36-04:00","modified":"2026-08-06T13:18:36-04:00","name":"ip: 104.25.214.19","pattern":"[ipv4-addr:value = '104.25.214.19']","pattern_type":"stix","valid_from":"2026-08-06T13:18:36-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e370630e-feba-d101-7634-0000efdb4d31","created":"2026-08-06T13:18:36-04:00","modified":"2026-08-06T13:18:36-04:00","name":"ip: 104.25.215.19","pattern":"[ipv4-addr:value = '104.25.215.19']","pattern_type":"stix","valid_from":"2026-08-06T13:18:36-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16ce342b-bb79-bab1-f7e3-0000f227ac3f","created":"2026-08-06T13:18:35-04:00","modified":"2026-08-06T13:18:35-04:00","name":"ip: 135.148.242.107","pattern":"[ipv4-addr:value = '135.148.242.107']","pattern_type":"stix","valid_from":"2026-08-06T13:18:35-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b770ae0-9e7e-28d1-f106-00001b48c2a8","created":"2026-08-06T13:18:35-04:00","modified":"2026-08-06T13:18:35-04:00","name":"ip: 172.67.149.185","pattern":"[ipv4-addr:value = '172.67.149.185']","pattern_type":"stix","valid_from":"2026-08-06T13:18:35-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0647d4c5-7723-4be5-990e-000092d080ac","created":"2026-08-06T13:18:35-04:00","modified":"2026-08-06T13:18:35-04:00","name":"ip: 104.21.29.195","pattern":"[ipv4-addr:value = '104.21.29.195']","pattern_type":"stix","valid_from":"2026-08-06T13:18:35-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b50bdb01-4a4e-1ccc-081c-000000aaea70","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cert.br/docs/ransomware/en/","pattern":"[url:value = 'https://cert.br/docs/ransomware/en/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af8ed1b2-3a91-075f-7d4e-0000a08f3506","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cert.br/docs/ransomware/","pattern":"[url:value = 'https://cert.br/docs/ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3eabff4-24a1-66e1-10b8-000065392710","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursos.cert.br/criterio-aceite/","pattern":"[url:value = 'https://cursos.cert.br/criterio-aceite/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aced8605-090f-2ba6-48bf-000041df26e1","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursos.cert.br/","pattern":"[url:value = 'https://cursos.cert.br/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de5006d0-4822-f834-bb50-000044ce8632","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cert.br/docs/ransomware/#divulgacao","pattern":"[url:value = 'https://cert.br/docs/ransomware/#divulgacao']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--648464f3-9fc4-5bff-9da3-0000a8b061d9","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursos.cert.br/atih/","pattern":"[url:value = 'https://cursos.cert.br/atih/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e55b5abd-7276-a73f-9816-0000851d15aa","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursos.cert.br/fim/","pattern":"[url:value = 'https://cursos.cert.br/fim/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6eda451-c7ee-81ff-340f-00008dd8e6f7","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursos.cert.br/overview/","pattern":"[url:value = 'https://cursos.cert.br/overview/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--521aece7-e9fd-6d8a-eea7-00005772c643","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursos.cert.br/inscricao/","pattern":"[url:value = 'https://cursos.cert.br/inscricao/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ca0bb54-3610-c3eb-fe96-00004e2417d5","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://forum.cert.br/#cfp-misp","pattern":"[url:value = 'https://forum.cert.br/#cfp-misp']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3853781-c4b0-9d9d-d731-00001954e321","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://forum.cert.br/#cfp-forum","pattern":"[url:value = 'https://forum.cert.br/#cfp-forum']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10b79761-2b57-c573-40bf-0000d666de5b","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cartilha.cert.br/fasciculos/#golpes-evite-fraudes","pattern":"[url:value = 'https://cartilha.cert.br/fasciculos/#golpes-evite-fraudes']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d9016c5-ce71-8a69-beda-00008f8537eb","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cartilha.cert.br/fasciculos/#golpes","pattern":"[url:value = 'https://cartilha.cert.br/fasciculos/#golpes']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d1d0345-2533-e2e5-569e-0000ca0c35e2","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cartilha.cert.br/","pattern":"[url:value = 'https://cartilha.cert.br/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60ba5a0e-123a-ab8a-0509-000095088788","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://forum.cert.br/#misp","pattern":"[url:value = 'https://forum.cert.br/#misp']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4f8e06f-b305-42fc-6db9-00005ae540b5","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://forum.cert.br/#agenda","pattern":"[url:value = 'https://forum.cert.br/#agenda']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f940a613-1f33-0f8a-90ce-000064970281","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://forum.cert.br/","pattern":"[url:value = 'https://forum.cert.br/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0aa2c549-a2a3-0071-4a22-000005681224","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursoseventos.nic.br/evento/inscrever/misp2026/","pattern":"[url:value = 'https://cursoseventos.nic.br/evento/inscrever/misp2026/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f12d4c9-3e2d-0e47-e5c2-00007ce5991d","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursoseventos.nic.br/evento/inscrever/csirts2026/","pattern":"[url:value = 'https://cursoseventos.nic.br/evento/inscrever/csirts2026/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83c1758b-98bf-02b5-988c-0000cf6eb915","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"domain: NIC.br","pattern":"[domain-name:value = 'NIC.br']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2eb77b5-67df-95ef-b29e-00006045ad26","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cursoseventos.nic.br/","pattern":"[url:value = 'https://cursoseventos.nic.br/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cbbc68b-f28e-1c8a-5bb1-0000d805ab8f","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://forum.cert.br/#inscricao","pattern":"[url:value = 'https://forum.cert.br/#inscricao']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--504d63e7-37f8-346b-2432-00001e668692","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cert.br/rss/certbr-rss.xml","pattern":"[url:value = 'https://cert.br/rss/certbr-rss.xml']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69c53c8a-8a67-c037-65d3-000080299451","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"url: https://cert.br/","pattern":"[url:value = 'https://cert.br/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ab55dc4-fd54-d2e8-87ea-000082bfb98d","created":"2026-08-06T13:14:13-04:00","modified":"2026-08-06T13:14:13-04:00","name":"domain: CERT.br","pattern":"[domain-name:value = 'CERT.br']","pattern_type":"stix","valid_from":"2026-08-06T13:14:13-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3e1e60f-8615-b991-baf5-0000200384a4","created":"2026-08-06T13:14:07-04:00","modified":"2026-08-06T13:14:07-04:00","name":"url: https://www.cert-in.org.in","pattern":"[url:value = 'https://www.cert-in.org.in']","pattern_type":"stix","valid_from":"2026-08-06T13:14:07-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3d2a3d1-5b75-e4d6-81cd-000095ca46b8","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#15","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#15']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4d59347-ba3b-986a-f686-00002d7621dd","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#14","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#14']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ab106e4-f7e6-2649-b355-0000b0a11964","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#13","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#13']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5db63672-a049-e8df-0bb7-0000081d7e01","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#12","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#12']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4bf67c8-af57-3d00-6991-00001aa8d1ef","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#11","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#11']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3b8575e-2f35-8926-3788-0000a214b68a","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#10","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#10']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df9c88dc-81e6-feb4-beaa-00007a064409","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#9","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#9']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a89bb84a-9bc2-ad05-33c6-0000c2ba236c","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#8","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#8']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3824a5db-6ec6-3fc5-8b25-00009ad9333a","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#7","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#7']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f23954d-9c9a-3e93-017f-00002265545f","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#6","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#6']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d62ac4f7-433c-da9a-c873-000030d0fbb1","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#5","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#5']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a12df461-b5d9-c495-84e0-0000886c9cd4","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#4","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#4']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f4961c2-d3b9-882d-cea5-000015bba46d","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#3","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#3']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--484e5154-5bc1-a174-551f-0000ad07c308","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#2","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#2']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d14700ee-367b-5ddb-78dd-0000bfb26ce6","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/wr/2026/wr260805.html#1","pattern":"[url:value = 'https://www.jpcert.or.jp/wr/2026/wr260805.html#1']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a57bfa0-39a4-7909-5096-0000bb5c6e64","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/at/2026/at260016.html","pattern":"[url:value = 'https://www.jpcert.or.jp/at/2026/at260016.html']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--410b6c05-28ad-c268-17d1-0000ac277a27","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/at/2026/at260017.html","pattern":"[url:value = 'https://www.jpcert.or.jp/at/2026/at260017.html']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b05dded0-722f-fd48-c205-0000739eb5f6","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/at/2026/at260018.html","pattern":"[url:value = 'https://www.jpcert.or.jp/at/2026/at260018.html']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b010d75-db08-9976-fce8-000064e5a1b5","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/at/2026/at260019.html","pattern":"[url:value = 'https://www.jpcert.or.jp/at/2026/at260019.html']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6de64620-475b-177d-2efc-00002371aced","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/at/2026/at260020.html","pattern":"[url:value = 'https://www.jpcert.or.jp/at/2026/at260020.html']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6ba9585-4b36-a43d-d772-0000340ab8ae","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/at/2026/at260021.html","pattern":"[url:value = 'https://www.jpcert.or.jp/at/2026/at260021.html']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87d27c8e-8312-da35-2bfa-0000d7161a7a","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"domain: jpcert.or.jp","pattern":"[domain-name:value = 'jpcert.or.jp']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c62d281-9d42-c565-b821-0000043393ac","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/","pattern":"[url:value = 'https://www.jpcert.or.jp/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3d555f3-e9fe-a157-dec1-0000728107de","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: https://www.jpcert.or.jp/rss/jpcert.rdf","pattern":"[url:value = 'https://www.jpcert.or.jp/rss/jpcert.rdf']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cab1f5e-075b-0e17-2aa1-00001e0a32b6","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: http://purl.org/dc/terms/","pattern":"[url:value = 'http://purl.org/dc/terms/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97337514-0d85-e8ce-5769-000002c1a230","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: http://www.w3.org/1999/02/22-rdf-syntax-ns#","pattern":"[url:value = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b29bc961-b502-4f08-9eb3-0000c086c2c0","created":"2026-08-06T13:14:06-04:00","modified":"2026-08-06T13:14:06-04:00","name":"url: http://purl.org/rss/1.0/","pattern":"[url:value = 'http://purl.org/rss/1.0/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:06-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e63bd22-1bf3-8c74-f2eb-00004a6f3709","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://www.cyber.gov.au/about-us/view-all-content/Reported-widespread-credential-exposure-affecting-Fortinet-Firewalls-and-VPN-Gateways","pattern":"[url:value = 'https://www.cyber.gov.au/about-us/view-all-content/Reported-widespread-credential-exposure-affecting-Fortinet-Firewalls-and-VPN-Gateways']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32691909-1e31-88fc-d6cf-000054c90ef7","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms","pattern":"[url:value = 'https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16075ff8-d430-6dfa-7c3b-0000ece6b3e8","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://www.cyber.gov.au/","pattern":"[url:value = 'https://www.cyber.gov.au/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70ae0f69-5dd5-c4b7-cf2b-0000f347d12e","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"domain: J.F.Gmelin","pattern":"[domain-name:value = 'J.F.Gmelin']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--940b9e80-f031-7552-e6ce-0000cc1e68d8","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"hash_sha256: 74a0810781ce8bb669bd0f33785ed69f2a1828874e1b190fc739a453132e6d36","pattern":"[file:hashes.'SHA-256' = '74a0810781ce8bb669bd0f33785ed69f2a1828874e1b190fc739a453132e6d36']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ee556e0-006d-77f6-a977-000061157945","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/omitFromScheduledCrawl","pattern":"[url:value = 'http://unknown.org/omitFromScheduledCrawl']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3849ccdc-bb3e-45a9-7203-000022d4641a","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"domain: dyntaxa.se","pattern":"[domain-name:value = 'dyntaxa.se']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--496d68e1-bd8a-7bb2-c5e8-000065f47331","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"domain: swedishlifewatch.se","pattern":"[domain-name:value = 'swedishlifewatch.se']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6c9399e-4764-e7ea-bad3-0000b293f8b1","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"domain: artportalen.se","pattern":"[domain-name:value = 'artportalen.se']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a545f3ba-36bb-9d8e-1d90-0000059839ac","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.73566","pattern":"[url:value = 'http://tun.fi/MX.73566']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4aada57-02dc-09b7-253f-0000d0511a5c","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#115","pattern":"[url:value = 'http://tun.fi/JX.1794650#115']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0226582-d490-d4c2-33f6-0000db2d54b6","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.200535","pattern":"[url:value = 'http://tun.fi/MX.200535']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07d83602-ef37-5a38-01b6-0000f6e65a54","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#49","pattern":"[url:value = 'http://tun.fi/JX.1794650#49']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d13fc9f-cf9e-b5c1-4bad-00003e8e5531","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.48089","pattern":"[url:value = 'http://tun.fi/MX.48089']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec868889-be78-3c02-302c-0000ed13511b","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#161","pattern":"[url:value = 'http://tun.fi/JX.1794650#161']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbaf6bec-032c-29d0-371e-000094ee60c4","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.37122","pattern":"[url:value = 'http://tun.fi/MX.37122']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53bf8a3a-5dc3-ba1d-3e1b-00004738fb67","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#107","pattern":"[url:value = 'http://tun.fi/JX.1794650#107']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69279557-c556-d428-c761-000034b9b6c6","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.36589","pattern":"[url:value = 'http://tun.fi/MX.36589']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66e42ca1-ef8a-754b-0dd6-0000b29a3f50","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#123","pattern":"[url:value = 'http://tun.fi/JX.1794650#123']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01ee06ae-1196-d0b4-d281-000036785d3c","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.30443","pattern":"[url:value = 'http://tun.fi/MX.30443']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b35dcb2-a700-7bbf-29ce-0000499221db","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#61","pattern":"[url:value = 'http://tun.fi/JX.1794650#61']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edf5cc6a-5f01-81ef-88b9-00001bae9564","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.37142","pattern":"[url:value = 'http://tun.fi/MX.37142']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3c71e4e-f75c-0710-2e37-00005f338d0b","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#111","pattern":"[url:value = 'http://tun.fi/JX.1794650#111']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba155d55-1f44-8ac7-e229-0000fcc96ebd","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.34567","pattern":"[url:value = 'http://tun.fi/MX.34567']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbc00464-c950-66da-6140-000044a0215d","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#95","pattern":"[url:value = 'http://tun.fi/JX.1794650#95']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfb6098e-65dc-f309-923b-0000ec1dde6b","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/samplingEvent","pattern":"[url:value = 'http://unknown.org/samplingEvent']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a073dae-2418-a368-e649-0000d31ce8e3","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/MX.34574","pattern":"[url:value = 'http://tun.fi/MX.34574']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8acbe9eb-3027-c8b4-938c-0000d2cb29f8","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650","pattern":"[url:value = 'http://tun.fi/JX.1794650']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53fbce2e-d9e9-ca1c-f9e0-0000b9b3ff43","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#2","pattern":"[url:value = 'http://tun.fi/JX.1794650#2']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52a3a151-531c-5991-f7c5-000061cb7e81","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://tun.fi/JX.1794650#93","pattern":"[url:value = 'http://tun.fi/JX.1794650#93']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a365130-b553-58f2-d260-0000bc075938","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://specieslink.net/col/16","pattern":"[url:value = 'https://specieslink.net/col/16']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d551fa5-7d6b-07e0-4928-0000fd9e71bd","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://specieslink.net/guid/16/35381","pattern":"[url:value = 'https://specieslink.net/guid/16/35381']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bd0ff9b-2ea8-33eb-3d15-000010c73d52","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://creativecommons.org/licenses/by-nc-sa/3.0/","pattern":"[url:value = 'http://creativecommons.org/licenses/by-nc-sa/3.0/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0b63653-03e7-9002-4e4b-00003192523b","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://rs.tdwg.org/ac/terms/resourceCreationTechnique","pattern":"[url:value = 'http://rs.tdwg.org/ac/terms/resourceCreationTechnique']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--497a796e-7e7b-d5db-5a75-0000f812f950","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://rs.tdwg.org/ac/terms/physicalSetting","pattern":"[url:value = 'http://rs.tdwg.org/ac/terms/physicalSetting']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de186edc-e36f-3a7b-1f38-000098f7575b","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://xeno-canto.org/sounds/uploaded/PCTXEPPOZD/XC165501-Common%20Woodshrike.mp3","pattern":"[url:value = 'https://xeno-canto.org/sounds/uploaded/PCTXEPPOZD/XC165501-Common%20Woodshrike.mp3']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c8476c1-c1c0-bb6c-84c6-0000f7ab20ec","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://ns.adobe.com/xap/1.0/Rating","pattern":"[url:value = 'http://ns.adobe.com/xap/1.0/Rating']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5f196d9-c8ed-cca2-9777-00009b8fa4f2","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/description","pattern":"[url:value = 'http://purl.org/dc/terms/description']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7528b65d-2d25-5f1c-8272-0000173859fc","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://rs.tdwg.org/ac/terms/variantLiteral","pattern":"[url:value = 'http://rs.tdwg.org/ac/terms/variantLiteral']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a98f107-f6c8-fd68-8b4e-0000024a988b","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/rights","pattern":"[url:value = 'http://purl.org/dc/terms/rights']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--275c8e6c-615d-6c2c-9340-00007266dfd7","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/elements/1.1/type","pattern":"[url:value = 'http://purl.org/dc/elements/1.1/type']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac5d7ff8-0643-7cd5-602b-0000f2dc2f1a","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://data.biodiversitydata.nl/xeno-canto/observation/XC165501","pattern":"[url:value = 'https://data.biodiversitydata.nl/xeno-canto/observation/XC165501']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d3cfd12-0ba1-051f-96cd-000065a9d1ba","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://rs.tdwg.org/ac/terms/associatedObservationReference","pattern":"[url:value = 'http://rs.tdwg.org/ac/terms/associatedObservationReference']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbe7fe12-88fa-78a9-913e-00005f8589e3","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://xeno-canto.org/sounds/spectrograms/PCTXEPPOZD/165501/colour.png","pattern":"[url:value = 'https://xeno-canto.org/sounds/spectrograms/PCTXEPPOZD/165501/colour.png']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--621c6ff8-1c59-b642-9b27-0000b9c54c83","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://rs.tdwg.org/ac/terms/accessURI","pattern":"[url:value = 'http://rs.tdwg.org/ac/terms/accessURI']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--991b39b9-c1f8-1dad-cbe1-0000ba18c4fe","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/elements/1.1/creator","pattern":"[url:value = 'http://purl.org/dc/elements/1.1/creator']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bb7c128-ac7c-2359-7c24-000045cc92cd","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://ns.adobe.com/xap/1.0/rights/Owner","pattern":"[url:value = 'http://ns.adobe.com/xap/1.0/rights/Owner']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25a62356-ce45-1482-30b4-00001d5b6635","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://rs.tdwg.org/ac/terms/caption","pattern":"[url:value = 'http://rs.tdwg.org/ac/terms/caption']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f155c84e-2d64-1bb4-1462-000096501da8","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://rs.tdwg.org/ac/terms/Multimedia","pattern":"[url:value = 'http://rs.tdwg.org/ac/terms/Multimedia']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38125349-50a8-82e6-af94-0000e9128c06","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://specieslink.net/col/25","pattern":"[url:value = 'https://specieslink.net/col/25']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aae88b2-c09b-e483-3e66-0000f098f326","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://specieslink.net/guid/25/22942","pattern":"[url:value = 'https://specieslink.net/guid/25/22942']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--386f2450-3d48-6e1b-4711-0000b42ff649","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://svampe.databasen.org)","pattern":"[url:value = 'https://svampe.databasen.org)']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d84a3f9c-330a-846a-aba3-0000994f3bb5","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"domain: indexfungorum.org","pattern":"[domain-name:value = 'indexfungorum.org']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--661a35a9-2d30-378f-4fb0-00007d8c18eb","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://creativecommons.org/licenses/by-nc/4.0/legalcode","pattern":"[url:value = 'http://creativecommons.org/licenses/by-nc/4.0/legalcode']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c38e3c6f-8ff2-ef0d-e58e-0000ce0e1ea8","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://svampe.databasen.org/observations/571704","pattern":"[url:value = 'https://svampe.databasen.org/observations/571704']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0f3a375-1d4b-83ab-6c40-000007d2a339","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://svampe.databasen.org/uploads/2026-571704_B19xMXlSWx.JPG","pattern":"[url:value = 'https://svampe.databasen.org/uploads/2026-571704_B19xMXlSWx.JPG']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb40d65a-d26a-53e3-4fa1-000034e3cd7a","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/creator","pattern":"[url:value = 'http://purl.org/dc/terms/creator']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c4af5dc-1aa5-3e4e-9ad1-00008f273490","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://creativecommons.org/licenses/by/4.0/","pattern":"[url:value = 'http://creativecommons.org/licenses/by/4.0/']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--502ec820-e2cc-c4e6-43ae-000013ce5397","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/license","pattern":"[url:value = 'http://purl.org/dc/terms/license']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f58b308-41b6-3315-ebf5-0000503d3034","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/type","pattern":"[url:value = 'http://purl.org/dc/terms/type']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b57b8b81-cad9-d216-5b8c-00000b21dd98","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/created","pattern":"[url:value = 'http://purl.org/dc/terms/created']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cee14c9-3799-6e87-b327-00000314f027","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: https://data.nhm.ac.uk/media/36d1592b-d6a7-4ffc-a00a-aed4e040e2ed","pattern":"[url:value = 'https://data.nhm.ac.uk/media/36d1592b-d6a7-4ffc-a00a-aed4e040e2ed']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0d8c028-ed9d-efaa-de92-000081dadfee","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/identifier","pattern":"[url:value = 'http://purl.org/dc/terms/identifier']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f47b2ea3-8f4a-f07b-beb1-0000e39807fb","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/rightsHolder","pattern":"[url:value = 'http://purl.org/dc/terms/rightsHolder']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--674ceed1-11db-3083-5f6b-0000c7aac917","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/title","pattern":"[url:value = 'http://purl.org/dc/terms/title']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f54252db-0894-f250-490a-000065f580e0","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://purl.org/dc/terms/format","pattern":"[url:value = 'http://purl.org/dc/terms/format']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c1f60be-af20-12a5-f913-0000d343f0ca","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://rs.gbif.org/terms/1.0/Multimedia","pattern":"[url:value = 'http://rs.gbif.org/terms/1.0/Multimedia']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bc1e73a-fadb-4923-f913-000020d6b29e","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/code","pattern":"[url:value = 'http://unknown.org/code']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a9b2632-e469-23c3-abfd-0000779abde2","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/maxSearchResponseRecords","pattern":"[url:value = 'http://unknown.org/maxSearchResponseRecords']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a000f4de-7d00-da9f-098e-000003b1798d","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://bnhm.berkeley.edu/DwC/bnhm_dc2_schema.xsd","pattern":"[url:value = 'http://bnhm.berkeley.edu/DwC/bnhm_dc2_schema.xsd']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--496e1a1f-3fa2-b342-cf41-0000f92b172e","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/conceptualSchema","pattern":"[url:value = 'http://unknown.org/conceptualSchema']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ad4cc99-b554-f367-efd5-0000e0454804","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://creativecommons.org/publicdomain/zero/1.0/legalcode","pattern":"[url:value = 'http://creativecommons.org/publicdomain/zero/1.0/legalcode']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50e1abde-dc72-2e48-608b-0000e99fea08","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/griddedDataset","pattern":"[url:value = 'http://unknown.org/griddedDataset']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff86f0d4-27fe-277b-b329-00006e911f15","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/status","pattern":"[url:value = 'http://unknown.org/status']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e426e04-281d-4b9c-f5a1-000090d38bd9","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://dsimap.mnhn.fr/biocase/pywrapper.cgi?dsa=cbnbp","pattern":"[url:value = 'http://dsimap.mnhn.fr/biocase/pywrapper.cgi?dsa=cbnbp']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75a91eec-fe64-1b0e-c5ef-00002fc5488c","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/orphanEndpoint","pattern":"[url:value = 'http://unknown.org/orphanEndpoint']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ace644e0-1197-9247-e6e6-000080e858ee","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/crawl_attempt","pattern":"[url:value = 'http://unknown.org/crawl_attempt']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb5c3c7b-e972-1f20-863b-0000bdfca6c4","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://unknown.org/download","pattern":"[url:value = 'http://unknown.org/download']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92a85349-ee17-953c-40c5-0000c2a6d63e","created":"2026-08-06T13:14:05-04:00","modified":"2026-08-06T13:14:05-04:00","name":"url: http://creativecommons.org/licenses/by/4.0/legalcode","pattern":"[url:value = 'http://creativecommons.org/licenses/by/4.0/legalcode']","pattern_type":"stix","valid_from":"2026-08-06T13:14:05-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3fc6f00-ab65-5d13-b160-0000a2188c42","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/citation-lookup/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/citation-lookup/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cce09b1-0e60-8930-60d6-00009df4855b","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/memberships/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/memberships/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eadb8825-349f-be09-c85d-000028abd850","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/docket-alerts/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/docket-alerts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36677f1c-adcb-0e5b-3b60-00009a3b8e4e","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/alerts/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/alerts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0523c9ae-29b9-b686-234b-00009fcf28b4","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/spouse-incomes/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/spouse-incomes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--819276bd-a689-8a6a-87a9-00005e940474","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/reimbursements/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/reimbursements/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84225729-8bdd-f1c6-b3f2-0000e370b232","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/disclosure-positions/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/disclosure-positions/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2c5cec7-d1d0-567f-182c-0000dee10936","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/non-investment-incomes/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/non-investment-incomes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--355098f5-d1b0-4bd1-6db1-0000958aa546","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/investments/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/investments/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e42ae8a-0a33-fce5-cfee-0000b0826a6d","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/gifts/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/gifts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--691a457b-3b43-35e2-7326-0000dcbe804c","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/financial-disclosures/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/financial-disclosures/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8244a672-204d-d2eb-e0a6-00002aef67f4","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/debts/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/debts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0aeb7f7b-36dd-74e8-5500-000033ad9cdc","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/agreements/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/agreements/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6abf092b-e34f-b5eb-7313-00004a72f991","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/visualizations/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/visualizations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5070b71-94d7-6cf8-6f31-0000dcd50b44","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/visualizations/json/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/visualizations/json/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16047a45-7dd6-754a-684e-0000509a5ff6","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/increment-event/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/increment-event/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f93c0450-65cf-2ff5-9cf8-0000d3c9d264","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/prayers/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/prayers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd3b5668-765d-11e5-94bf-0000ef58cc0d","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/docket-tags/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/docket-tags/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87ed8a79-d27e-a399-e3c7-0000b081f8f2","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/tags/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/tags/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3633b67-084d-75ef-3732-000051e74772","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/scrapers/scotus-email/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/scrapers/scotus-email/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f919342d-684e-286e-0324-00001ba2cbd3","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/fjc-integrated-database/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/fjc-integrated-database/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2c5a03f-16cb-7bc0-470d-00009e486d27","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/recap-query/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/recap-query/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a6edf33-dfb4-8c19-a698-00007ef18bc2","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/recap-fetch/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/recap-fetch/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92b60123-0332-5fab-a920-0000f5649a7d","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/recap-email/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/recap-email/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deb712c9-5516-ab3a-2383-000047f9be43","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/recap/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/recap/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e6f72e4-db99-d6ec-1256-00009a995a11","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/attorneys/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/attorneys/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81673cca-e04f-252b-cf7e-0000c86bdbbd","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/parties/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/parties/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f7b57ce-be2a-cbe3-3e6e-00005d6a9d5c","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/aba-ratings/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/aba-ratings/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a22f6508-a2bc-96ea-8bdd-0000493eb60f","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/sources/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/sources/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37f2c49f-e02c-9d49-3c7e-0000fe1c3b2e","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/political-affiliations/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/political-affiliations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07b0c93d-848b-6b04-7dac-0000099cece1","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/schools/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/schools/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f600836-9a71-c0dd-6f7d-000051fb3793","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/educations/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/educations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e72f8812-b7a0-d35d-961d-0000b35f1d4d","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/retention-events/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/retention-events/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e32e1221-5a17-1fa2-b8cc-000069db1486","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/positions/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/positions/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ed52e9b-fa5f-1874-9f91-0000f88e3df6","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/people/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/people/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--889ec647-7d90-1ee7-a4b0-00000bb410e8","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/tag/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/tag/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5af5714a-ec7a-e8ef-accd-0000728803c6","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/opinions-cited/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/opinions-cited/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b520985-2fe8-49a1-fad5-0000472f173f","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/opinions/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/opinions/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bb5d049-7f16-660a-92af-0000b10e71a6","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/clusters/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/clusters/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--658b92e1-a7bb-f8b9-4791-0000654b4d6c","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/audio/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/audio/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--478c8b19-4878-51ca-5261-0000dbf8539d","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/courts/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/courts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e32d384f-9805-23b5-cbc9-0000ddf06f3e","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/recap-documents/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/recap-documents/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45b4512e-0760-81cd-71c7-0000a9093581","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/docket-entries/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/docket-entries/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--799a55b2-f324-17e4-1633-0000e5babce2","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/originating-court-information/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/originating-court-information/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f28bfde9-8eea-28e0-4b18-0000893d6b2b","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/bankruptcy-information/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/bankruptcy-information/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54a1dfd4-6aca-d04c-5281-0000d98792b8","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/dockets/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/dockets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4f67b9c-0f38-392f-23ac-0000986af38a","created":"2026-08-06T13:13:25-04:00","modified":"2026-08-06T13:13:25-04:00","name":"url: https://www.courtlistener.com/api/rest/v4/search/","pattern":"[url:value = 'https://www.courtlistener.com/api/rest/v4/search/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:25-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4808bf43-4f23-1abc-8815-0000eb2c4c3a","created":"2026-08-06T13:13:17-04:00","modified":"2026-08-06T13:13:17-04:00","name":"url: http://data.gdeltproject.org/gdeltv2/20260806201500.gkg.csv.zip","pattern":"[url:value = 'http://data.gdeltproject.org/gdeltv2/20260806201500.gkg.csv.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:17-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3678594b-253e-9ceb-3271-0000e0f0fd87","created":"2026-08-06T13:13:17-04:00","modified":"2026-08-06T13:13:17-04:00","name":"hash_md5: de29efad5df4dd29bb0ea323c385c30f","pattern":"[file:hashes.'MD5' = 'de29efad5df4dd29bb0ea323c385c30f']","pattern_type":"stix","valid_from":"2026-08-06T13:13:17-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a65488a7-92e2-b32c-59a8-0000b71d8943","created":"2026-08-06T13:13:17-04:00","modified":"2026-08-06T13:13:17-04:00","name":"url: http://data.gdeltproject.org/gdeltv2/20260806201500.mentions.CSV.zip","pattern":"[url:value = 'http://data.gdeltproject.org/gdeltv2/20260806201500.mentions.CSV.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:17-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91afc75a-4a9c-85a2-9327-0000222aae42","created":"2026-08-06T13:13:17-04:00","modified":"2026-08-06T13:13:17-04:00","name":"hash_md5: 2aefb774e5aade61eb01a3c2278d99f3","pattern":"[file:hashes.'MD5' = '2aefb774e5aade61eb01a3c2278d99f3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:17-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--320d1146-03bd-d430-aaa6-0000ad09eb43","created":"2026-08-06T13:13:17-04:00","modified":"2026-08-06T13:13:17-04:00","name":"url: http://data.gdeltproject.org/gdeltv2/20260806201500.export.CSV.zip","pattern":"[url:value = 'http://data.gdeltproject.org/gdeltv2/20260806201500.export.CSV.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:17-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e12cf1b-3a13-670f-a029-000001f0923c","created":"2026-08-06T13:13:17-04:00","modified":"2026-08-06T13:13:17-04:00","name":"hash_md5: 87ccd6b54ea9b8b4750c953fdb34c75c","pattern":"[file:hashes.'MD5' = '87ccd6b54ea9b8b4750c953fdb34c75c']","pattern_type":"stix","valid_from":"2026-08-06T13:13:17-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a482fae9-a6c2-cdc2-d733-00000d4797b1","created":"2026-08-06T13:13:16-04:00","modified":"2026-08-06T13:13:16-04:00","name":"domain: api.w.org","pattern":"[domain-name:value = 'api.w.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:16-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69ab1956-abfa-4608-f715-0000cde26eb9","created":"2026-08-06T13:13:16-04:00","modified":"2026-08-06T13:13:16-04:00","name":"domain: developer.wordpress.org","pattern":"[domain-name:value = 'developer.wordpress.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:16-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5721807-8abb-21d1-31a3-0000842388ac","created":"2026-08-06T13:13:16-04:00","modified":"2026-08-06T13:13:16-04:00","name":"domain: theme.json","pattern":"[domain-name:value = 'theme.json']","pattern_type":"stix","valid_from":"2026-08-06T13:13:16-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64d59425-effe-946a-f751-00008a1a2109","created":"2026-08-06T13:13:16-04:00","modified":"2026-08-06T13:13:16-04:00","name":"domain: akismet.com","pattern":"[domain-name:value = 'akismet.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:16-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a6e107c-cbbc-0638-e893-000025108af5","created":"2026-08-06T13:13:16-04:00","modified":"2026-08-06T13:13:16-04:00","name":"domain: eurepoc.eu","pattern":"[domain-name:value = 'eurepoc.eu']","pattern_type":"stix","valid_from":"2026-08-06T13:13:16-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc6aeada-f935-a53f-3cad-00007d9e6694","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://attack.mitre.org/resources/terms-of-use/)","pattern":"[url:value = 'https://attack.mitre.org/resources/terms-of-use/)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e991faf-19f2-d64c-7c36-000062db7ad3","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: http://www.apache.org/licenses/LICENSE-2.0","pattern":"[url:value = 'http://www.apache.org/licenses/LICENSE-2.0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8653bf2a-9df7-6c5c-1535-0000af0960e0","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"domain: mitre-engenuity.org","pattern":"[domain-name:value = 'mitre-engenuity.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43b0a6ef-a901-2beb-9ced-000065f47a93","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://car.mitre.org/)","pattern":"[url:value = 'https://car.mitre.org/)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f4a1a97-5fe9-70b9-6d0d-00002a0eb991","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://ctid.mitre-engenuity.org/our-work/nist-800-53-control-mappings/)","pattern":"[url:value = 'https://ctid.mitre-engenuity.org/our-work/nist-800-53-control-mappings/)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7106867a-6d1e-00a2-cea7-000029aa32a1","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://attack.mitre.org/techniques/T1499/004)","pattern":"[url:value = 'https://attack.mitre.org/techniques/T1499/004)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ae04c38-177b-8080-db72-000022c8136d","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://attack.mitre.org/resources/updates/updates-april-2023/index.html)._","pattern":"[url:value = 'https://attack.mitre.org/resources/updates/updates-april-2023/index.html)._']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffb90133-4cae-e037-70a8-000079fd24f1","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://attack.mitre.org/resources/updates/updates-april-2021/index.html)","pattern":"[url:value = 'https://attack.mitre.org/resources/updates/updates-april-2021/index.html)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51294472-5ad3-4106-a9af-000075a4ebac","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://github.com/CVEProject/cve-schema/pull/6)","pattern":"[url:value = 'https://github.com/CVEProject/cve-schema/pull/6)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48fab15f-a8af-1af6-6b9f-00003320a890","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://github.com/center-for-threat-informed-defense/mappings-explorer/)","pattern":"[url:value = 'https://github.com/center-for-threat-informed-defense/mappings-explorer/)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc9610c4-3298-2654-ce88-0000317e5fde","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://attack.mitre.org/)","pattern":"[url:value = 'https://attack.mitre.org/)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc7063a1-e8f8-8c54-b6fd-000032193b5d","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://center-for-threat-informed-defense.github.io/mappings-explorer/external/cve/)","pattern":"[url:value = 'https://center-for-threat-informed-defense.github.io/mappings-explorer/external/cve/)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f9403af-d4c2-e3f2-72ab-0000d3a2edbe","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"hash_sha1: adc5c8c1ddc9c8dec6edc8d9c9cc83c2df83d9c5","pattern":"[file:hashes.'SHA-1' = 'adc5c8c1ddc9c8dec6edc8d9c9cc83c2df83d9c5']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2366ec43-b5ca-71b1-feac-0000d6df4631","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"hash_sha1: 8ce4e9e0fce8e9ffe7cce9f8e8eda2e3fea2f8e4","pattern":"[file:hashes.'SHA-1' = '8ce4e9e0fce8e9ffe7cce9f8e8eda2e3fea2f8e4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ed37148-5301-20ce-c7b7-0000a3015201","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://twitter.com/etda_thailand","pattern":"[url:value = 'https://twitter.com/etda_thailand']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eff97418-420c-24e1-7304-0000697141c3","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://facebook.com/ETDA.Thailand","pattern":"[url:value = 'https://facebook.com/ETDA.Thailand']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12344c85-8e24-2383-25ab-00006ef0686b","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://creativecommons.org/licenses/by-nc-sa/4.0/","pattern":"[url:value = 'https://creativecommons.org/licenses/by-nc-sa/4.0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7edf943-3fd8-7e82-3878-00009d6fb2a1","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://otx.alienvault.com/","pattern":"[url:value = 'https://otx.alienvault.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fd55aa8-abd3-0d43-3b0e-000095f0da7c","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5aad63f-b4ad-956b-5460-00003a20cfd9","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://attack.mitre.org/groups/","pattern":"[url:value = 'https://attack.mitre.org/groups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--950d21bb-a9c6-45c6-6f95-0000cf533d94","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://attack.mitre.org/","pattern":"[url:value = 'https://attack.mitre.org/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bcde54e-89bd-102a-d250-000048ae5ccb","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://github.com/MISP/misp-galaxy/blob/master/clusters/threat-actor.json","pattern":"[url:value = 'https://github.com/MISP/misp-galaxy/blob/master/clusters/threat-actor.json']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c39d0ef5-cd33-eae3-604a-0000810539a0","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"domain: tgc-tools.json","pattern":"[domain-name:value = 'tgc-tools.json']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ab9f653-f8e6-5df9-8cdc-0000f7b0c8a9","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"domain: tgc-actors.json","pattern":"[domain-name:value = 'tgc-actors.json']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bde3c5ae-0cb2-cb84-66f5-0000ac068aab","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"domain: getmisp.cgi","pattern":"[domain-name:value = 'getmisp.cgi']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62a99981-5339-3ad2-cc16-00001b081e64","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://www.circl.lu/doc/misp/galaxy/","pattern":"[url:value = 'https://www.circl.lu/doc/misp/galaxy/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f38ea12-db0f-29b9-bd57-0000917b1006","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"domain: aptstats.cgi","pattern":"[domain-name:value = 'aptstats.cgi']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e910b61b-8917-e489-e30c-0000a715ad57","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"domain: aptsearch.cgi","pattern":"[domain-name:value = 'aptsearch.cgi']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba34a2ba-ca9b-012c-0ad6-0000a19ff6de","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"domain: listtools.cgi","pattern":"[domain-name:value = 'listtools.cgi']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18d162f7-0046-328d-c974-0000c0113fb3","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"domain: listgroups.cgi","pattern":"[domain-name:value = 'listgroups.cgi']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f215ccc-51f6-edad-eeb3-000036a42883","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: https://www.etda.or.th","pattern":"[url:value = 'https://www.etda.or.th']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c85166ae-12de-d850-0e0e-0000085b984f","created":"2026-08-06T13:13:12-04:00","modified":"2026-08-06T13:13:12-04:00","name":"url: http://www.w3.org/1999/xhtml","pattern":"[url:value = 'http://www.w3.org/1999/xhtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:12-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2871d827-73e7-a194-e320-0000a7971b5e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.silent_run_loader","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.silent_run_loader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7107102-428f-f8d9-5c5c-0000dc61c9e4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.romulus_loader","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.romulus_loader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c9cbef1-3422-8b1b-5eb8-0000c38f000c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://rsf.org/en/exclusive-rsf-uncovers-new-spyware-belarus","pattern":"[url:value = 'https://rsf.org/en/exclusive-rsf-uncovers-new-spyware-belarus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73b6d2f8-2311-4018-c12b-0000deadd691","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://rsf.org/sites/default/files/medias/file/2025/12/report1.pdf","pattern":"[url:value = 'https://rsf.org/sites/default/files/medias/file/2025/12/report1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--332e9de3-3242-9ffc-da23-000047ebd2fc","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://censys.com/blog/residentbat-belarusian-kgb-android-spyware/","pattern":"[url:value = 'https://censys.com/blog/residentbat-belarusian-kgb-android-spyware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a23b16a-5c65-a6c1-52fc-0000ee8fe5f9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://rsf.org/sites/default/files/medias/file/2025/12/report_0.pdf","pattern":"[url:value = 'https://rsf.org/sites/default/files/medias/file/2025/12/report_0.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a9c851b-31ac-38ee-ef3b-00005b48ba74","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/elf.spry_socks","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/elf.spry_socks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e29a2c57-2ae5-1b06-2ebb-0000b46e6c8d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.funnyswitch","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.funnyswitch']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51dcecf6-7c04-1197-1720-000038916882","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--760bffd3-43ad-b089-2992-00007f4fea4b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://bishopfox.com/tools/sliver","pattern":"[url:value = 'https://bishopfox.com/tools/sliver']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--106e949b-935f-1a22-33db-0000ba1711ee","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/BishopFox/sliver","pattern":"[url:value = 'https://github.com/BishopFox/sliver']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbf377d9-de23-db4e-43c5-000032e4077d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://gost.run/en/","pattern":"[url:value = 'https://gost.run/en/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f81e8f4b-f3cc-4582-1c8e-0000cead9e90","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://v2.gost.run/en/","pattern":"[url:value = 'https://v2.gost.run/en/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87530f94-8cc3-da9b-43f9-00007b964984","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/ginuerzh/gost/blob/master/README_en.md","pattern":"[url:value = 'https://github.com/ginuerzh/gost/blob/master/README_en.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--378edfe4-3bac-17b8-6f80-00000d7b9d0a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: setcookie.thtml.ttc","pattern":"[domain-name:value = 'setcookie.thtml.ttc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbd41915-b41f-46b3-3903-0000f97f47ef","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: cav-0.1-py3.6.egg","pattern":"[domain-name:value = 'cav-0.1-py3.6.egg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06dce5d0-4933-508f-0472-0000d593e9ce","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.malwarebytes.com/blog/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique","pattern":"[url:value = 'https://www.malwarebytes.com/blog/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8574056b-2b21-c577-c615-00009aeb208a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/monoxgas/sRDI/blob/master/shellcodeRDI/shellcodeRDI.c))","pattern":"[url:value = 'https://github.com/monoxgas/sRDI/blob/master/shellcodeRDI/shellcodeRDI.c))']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c28d9b43-f95a-bcf1-287b-00008716dab9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://decoded.avast.io/janrubin/complex-obfuscation-meh/","pattern":"[url:value = 'https://decoded.avast.io/janrubin/complex-obfuscation-meh/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f45236a-d614-ce39-be3f-00000929c929","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://decoded.avast.io/janrubin/meh-2-2/","pattern":"[url:value = 'https://decoded.avast.io/janrubin/meh-2-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ed91b29-02ac-2fcb-57fc-000095d39935","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.zerofox.com/blog/the-underground-economist-volume-3-issue-12/","pattern":"[url:value = 'https://www.zerofox.com/blog/the-underground-economist-volume-3-issue-12/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5491217-4c4e-4517-3618-00009aeb7949","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/","pattern":"[url:value = 'https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--752c36bd-9e77-9b22-def3-00008234d50e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.aon.com/cyber-solutions/aon_cyber_labs/darkgate-keylogger-analysis-masterofnone/","pattern":"[url:value = 'https://www.aon.com/cyber-solutions/aon_cyber_labs/darkgate-keylogger-analysis-masterofnone/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5f2bc57-8bf5-fd2e-bc71-000086460ffa","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/","pattern":"[url:value = 'https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a05b98d6-f431-9f91-8fa7-000047cc582b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: PENCILDOWN.ANDROID","pattern":"[domain-name:value = 'PENCILDOWN.ANDROID']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf17a016-167f-332d-7d6a-000001cdb610","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: LANDMARK.NET","pattern":"[domain-name:value = 'LANDMARK.NET']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec4a9736-611c-83fd-569d-000042fd9026","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: GOLDDRAGON.POWERSHELL","pattern":"[domain-name:value = 'GOLDDRAGON.POWERSHELL']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed021776-f009-4fb4-a694-0000a321303d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: COINTOSS.XLM","pattern":"[domain-name:value = 'COINTOSS.XLM']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ef641fb-852c-d72f-0e47-000014fce259","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: TXR.0.regtrans","pattern":"[domain-name:value = 'TXR.0.regtrans']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64c032f5-6d02-0cc9-d27d-0000316d6230","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.gov.pl/attachment/6f51bb1a-3ad2-461c-a16d-408915a56f77","pattern":"[url:value = 'https://www.gov.pl/attachment/6f51bb1a-3ad2-461c-a16d-408915a56f77']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8252e9ae-b2bf-3444-a203-00002d494d3b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.gov.pl/attachment/64193e8d-05e2-4cbf-bb4c-5f58da21fefb","pattern":"[url:value = 'https://www.gov.pl/attachment/64193e8d-05e2-4cbf-bb4c-5f58da21fefb']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34939909-ccd9-a99c-ccf1-000032228db8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d","pattern":"[url:value = 'https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e998694-b0fa-1ab7-4692-0000ea6641e1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.gov.pl/attachment/6e085a2c-ac05-4b62-9423-5d6e9ef730bf","pattern":"[url:value = 'https://www.gov.pl/attachment/6e085a2c-ac05-4b62-9423-5d6e9ef730bf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba83df13-4768-e468-964b-000098075377","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services","pattern":"[url:value = 'https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--308c4ffd-e440-1efe-1369-0000da8539dc","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/en_us/research/19/d/potential-targeted-attack-uses-autohotkey-and-malicious-script-embedded-in-excel-file-to-avoid-detection.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/19/d/potential-targeted-attack-uses-autohotkey-and-malicious-script-embedded-in-excel-file-to-avoid-detection.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--defe74bd-764f-9f17-d612-000028a64bda","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://research.checkpoint.com/2019/finteam-trojanized-teamviewer-against-government-targets/","pattern":"[url:value = 'https://research.checkpoint.com/2019/finteam-trojanized-teamviewer-against-government-targets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0533b48-e74b-d37b-bb27-0000442f7670","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blogs.blackberry.com/en/2022/03/threat-thursday-sunseed-malware","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/03/threat-thursday-sunseed-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e7f3aa0-f4b6-4c49-8fce-0000c81daa54","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fffd68c6-2419-97e1-081b-00000f7cc0ad","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/b/tgtoxic-malware-targets-southeast-asia-android-users.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/b/tgtoxic-malware-targets-southeast-asia-android-users.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dff65ab8-984a-7368-c4ef-00002bb1082e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.malwarebytes.com/blog/news/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms","pattern":"[url:value = 'https://www.malwarebytes.com/blog/news/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42c945a6-44d1-e85d-8d57-000080a4c3e3","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: FlawedAmmyy.downloader","pattern":"[domain-name:value = 'FlawedAmmyy.downloader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9d76672-9546-e731-51cc-00008813721f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/antonioCoco/SharPyShell","pattern":"[url:value = 'https://github.com/antonioCoco/SharPyShell']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27e6d0ef-9181-2aed-1505-00009e995046","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/jpillora/chisel","pattern":"[url:value = 'https://github.com/jpillora/chisel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40f36574-1570-2642-c906-00009bb0b926","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/i/buzzing-in-the-background-bumblebee-a-new-modular-backdoor-evolv.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/i/buzzing-in-the-background-bumblebee-a-new-modular-backdoor-evolv.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b7c2579-3694-b79b-b2ba-00001e16fb0a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blogs.blackberry.com/en/2022/07/gootloader-from-seo-poisoning-to-multi-stage-downloader","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/07/gootloader-from-seo-poisoning-to-multi-stage-downloader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eec23e21-1f7c-3e3b-fcb2-0000f956d176","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.cyber.nj.gov/alerts-advisories/gootloader-malware-platform-uses-sophisticated-techniques-to-deliver-malware","pattern":"[url:value = 'https://www.cyber.nj.gov/alerts-advisories/gootloader-malware-platform-uses-sophisticated-techniques-to-deliver-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bba33214-6969-0e18-5197-00004df6e89a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.mandiant.com/resources/blog/melting-unc2198-icedid-to-ransomware-operations","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/melting-unc2198-icedid-to-ransomware-operations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05335e5f-3806-3a01-8c14-0000087e3dea","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/esile","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/esile']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e289f263-012c-48cf-5ffc-00000c09888e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/vinfo/de/security/news/cyber-attacks/esile-targeted-attack-campaign-hits-apac-governments","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/de/security/news/cyber-attacks/esile-targeted-attack-campaign-hits-apac-governments']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b15af4b2-9b62-ef34-331d-0000c9c2f332","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.group-ib.com/colunmtk_apt41","pattern":"[url:value = 'https://blog.group-ib.com/colunmtk_apt41']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6567dff8-ef2c-30ef-0a20-00009ad74a88","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://thehackernews.com/2021/06/chinese-hackers-believed-to-be-behind.html","pattern":"[url:value = 'https://thehackernews.com/2021/06/chinese-hackers-believed-to-be-behind.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07560580-080c-e5e6-7703-0000ea3c5ead","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/BeichenDream/BadPotato","pattern":"[url:value = 'https://github.com/BeichenDream/BadPotato']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e95b757-0a61-c4cd-dfea-0000b6642221","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/eset/malware-ioc/tree/master/especter","pattern":"[url:value = 'https://github.com/eset/malware-ioc/tree/master/especter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba5fb274-672f-b58f-54c1-00008aa905c7","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/","pattern":"[url:value = 'https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c980546-4b4a-0341-808f-0000b73cc5e5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: loglog.txt","pattern":"[domain-name:value = 'loglog.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0161eeee-2edb-fc71-e636-0000ad4237a9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://us-cert.cisa.gov/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity","pattern":"[url:value = 'https://us-cert.cisa.gov/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88ce0161-1208-1378-3e81-0000d8a43ac7","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.clearskysec.com/cedar/","pattern":"[url:value = 'https://www.clearskysec.com/cedar/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41123bb3-3166-4870-bca9-0000fc659bd6","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/BedTheGod/ConfuserEx-Mod-By-Bed","pattern":"[url:value = 'https://github.com/BedTheGod/ConfuserEx-Mod-By-Bed']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17b5ef38-d5bb-767c-e4a7-0000bce359b1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.talosintelligence.com/2017/12/recam-redux-deconfusing-confuserex.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2017/12/recam-redux-deconfusing-confuserex.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a369a1d-81b5-fa6e-7d54-0000a49c82be","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://yck1509.github.io/ConfuserEx/","pattern":"[url:value = 'https://yck1509.github.io/ConfuserEx/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7db18a9-fb97-35aa-4ec0-0000b1c5b0f3","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.tripwire.com/state-of-security/featured/ransomware-characteristics-attack-chains-recent-campaigns/","pattern":"[url:value = 'https://www.tripwire.com/state-of-security/featured/ransomware-characteristics-attack-chains-recent-campaigns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94b83f53-e900-558d-46f5-000007e8c451","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/exposing-modular-adware-how-dealply-iserik-and-managex-persist-in-systems/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/exposing-modular-adware-how-dealply-iserik-and-managex-persist-in-systems/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7c7fa0d-0e0d-6d94-05eb-000017fd883e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf","pattern":"[url:value = 'https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92926439-a1b9-a2ab-6313-0000c05cc7e8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.botconf.eu/wp-content/uploads/2018/12/2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf","pattern":"[url:value = 'https://www.botconf.eu/wp-content/uploads/2018/12/2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42c5bd52-b041-34ef-7e36-0000212b59f8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html","pattern":"[url:value = 'https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--282f7638-49b7-636e-8487-00000cba1287","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.lac.co.jp/lacwatch/pdf/20180614_cecreport_vol3.pdf","pattern":"[url:value = 'https://www.lac.co.jp/lacwatch/pdf/20180614_cecreport_vol3.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--363cfedf-b8a2-37c8-2a3c-0000d7f38721","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf","pattern":"[url:value = 'https://bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17e9d93e-ade9-e955-d98f-000053afa9a9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/byt3bl33d3r/CrackMapExec","pattern":"[url:value = 'https://github.com/byt3bl33d3r/CrackMapExec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4715ac22-0737-ee05-94b0-0000a0d0c069","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.metasploit.com","pattern":"[url:value = 'https://www.metasploit.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9cec17b-17b4-5114-9370-000002efcb7e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.cobaltstrike.com","pattern":"[url:value = 'https://www.cobaltstrike.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3a29c46-55ed-ceeb-6122-0000654db3ad","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/cobbr/Covenant/","pattern":"[url:value = 'https://github.com/cobbr/Covenant/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f74dabe1-479d-c9da-4cbc-000019c8a7c1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2016/10/20/new-eset-research-paper-puts-sednit-under-the-microscope/","pattern":"[url:value = 'https://www.welivesecurity.com/2016/10/20/new-eset-research-paper-puts-sednit-under-the-microscope/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d55cd03-7bc5-e4b3-ed87-00009365f7f2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/","pattern":"[url:value = 'https://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b08f6878-8cfd-04fc-e509-00007eb703e8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef068943-4835-9592-10b0-00008588f0ef","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://baijiahao.baidu.com/s?id=1661498030941117519","pattern":"[url:value = 'http://baijiahao.baidu.com/s?id=1661498030941117519']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0939fa1-a979-424b-519d-0000b3132632","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/","pattern":"[url:value = 'https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6dd33f1-6841-5bb5-045f-00004c7997a6","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/","pattern":"[url:value = 'https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afe17c61-5a3d-0b71-8cd7-0000e9e40002","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/","pattern":"[url:value = 'https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ef7cac9-7473-92b8-4d8c-000078c4b074","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://repnz.github.io/posts/autochk-rootkit-analysis/","pattern":"[url:value = 'https://repnz.github.io/posts/autochk-rootkit-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df89e728-0554-1a8b-fdd0-0000c0260923","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: autochk.sys","pattern":"[domain-name:value = 'autochk.sys']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfcdb9ee-89a4-eb58-d8d0-000087d81337","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://mobile.twitter.com/IntezerLabs/status/1215252764080644098","pattern":"[url:value = 'https://mobile.twitter.com/IntezerLabs/status/1215252764080644098']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60dec9df-2f80-9fe8-3e1e-000009f0a417","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.ibm.com/downloads/cas/OAJ4VZNJ","pattern":"[url:value = 'https://www.ibm.com/downloads/cas/OAJ4VZNJ']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a252122d-67db-18f9-c4cc-00003972d0b4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://research.checkpoint.com/vbetaly/","pattern":"[url:value = 'https://research.checkpoint.com/vbetaly/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bf1c4dc-33ab-0eef-4f2e-0000b8be7a37","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: SCANSIONE.vbe","pattern":"[domain-name:value = 'SCANSIONE.vbe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd253e69-dab3-85ea-7d1f-0000b9b17a86","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/a-mining-multitool/86950/","pattern":"[url:value = 'https://securelist.com/a-mining-multitool/86950/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88a9f3f4-d968-48af-f6a6-0000d6203718","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.privateinternetaccess.com/","pattern":"[url:value = 'https://www.privateinternetaccess.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9980ed1f-3a4d-0186-f01d-0000e564affb","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/","pattern":"[url:value = 'https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bfa221b-4b16-975e-97ec-00001edf5406","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/deprimon-malware-registers-itself-as-a-windows-print-monitor/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/deprimon-malware-registers-itself-as-a-windows-print-monitor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04880473-f692-e850-0985-000025ce5db5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Winnti.pdf","pattern":"[url:value = 'https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Winnti.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e321def-21d1-95a2-bc14-00006173ef91","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.gdatasoftware.com/blog/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence","pattern":"[url:value = 'https://www.gdatasoftware.com/blog/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf2714be-8897-c73b-8c70-0000b012f445","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/compfun-successor-reductor/93633/","pattern":"[url:value = 'https://securelist.com/compfun-successor-reductor/93633/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36e39bd6-ad42-1fc0-8fb7-0000d6c4ec09","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://mobile.twitter.com/SaudiDFIR/status/1177740045186457600","pattern":"[url:value = 'https://mobile.twitter.com/SaudiDFIR/status/1177740045186457600']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea59b77e-ee87-cf30-ebb3-0000132ad131","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2019/08/01/banking-trojans-amavaldo/","pattern":"[url:value = 'https://www.welivesecurity.com/2019/08/01/banking-trojans-amavaldo/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46f05a91-e350-aef0-62a4-0000f54ed0ed","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://unit42.paloaltonetworks.com/attack-campaign-on-the-government-of-thailand-delivers-bookworm-trojan/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/attack-campaign-on-the-government-of-thailand-delivers-bookworm-trojan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aafd9328-41c4-51a2-4d2a-00005b480524","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.cyber.nj.gov/threat-profiles/trojan-variants/sunorcal","pattern":"[url:value = 'https://www.cyber.nj.gov/threat-profiles/trojan-variants/sunorcal']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbcfaf70-fe7d-a802-f221-000082c35242","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://unit42.paloaltonetworks.com/unit42-sunorcal-adds-github-steganography-repertoire-expands-vietnam-myanmar/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/unit42-sunorcal-adds-github-steganography-repertoire-expands-vietnam-myanmar/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--beedd729-f6a5-8dcc-01fc-0000d328f562","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://otx.alienvault.com/pulse/588a7c8fe4166d1d84244b9a","pattern":"[url:value = 'https://otx.alienvault.com/pulse/588a7c8fe4166d1d84244b9a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f86bbac9-9bc5-9983-5471-0000ae42167b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://citizenlab.ca/2013/08/surtr-malware-family-targeting-the-tibetan-community/","pattern":"[url:value = 'https://citizenlab.ca/2013/08/surtr-malware-family-targeting-the-tibetan-community/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c7728f5-59bb-58d1-92fa-0000d445be3c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://threatvector.cylance.com/en_us/home/reaver-mapping-connections-between-disparate-chinese-apt-groups.html","pattern":"[url:value = 'https://threatvector.cylance.com/en_us/home/reaver-mapping-connections-between-disparate-chinese-apt-groups.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbba3cd8-171f-0ecf-f59d-00002fab0280","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://unit42.paloaltonetworks.com/unit42-new-malware-with-ties-to-sunorcal-discovered/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/unit42-new-malware-with-ties-to-sunorcal-discovered/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8acc5616-d5ee-e50f-5394-000092eeeeaf","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://techcrunch.com/2019/04/16/scranos-rootkit-passwords-payments/?guccounter=1&guce_referrer_us=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_cs=MrGSn18TmNoWovpLbekFYA","pattern":"[url:value = 'https://techcrunch.com/2019/04/16/scranos-rootkit-passwords-payments/?guccounter=1&guce_referrer_us=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_cs=MrGSn18TmNoWovpLbekFYA']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c589dfb-e702-9708-9c69-0000ecb8f432","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://labs.bitdefender.com/2019/04/inside-scranos-a-cross-platform-rootkit-enabled-spyware-operation/","pattern":"[url:value = 'https://labs.bitdefender.com/2019/04/inside-scranos-a-cross-platform-rootkit-enabled-spyware-operation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03525764-5b0d-fcd4-bada-0000cb37dd1a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html?m=1","pattern":"[url:value = 'https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html?m=1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7367ded-0a44-a443-b739-0000006794b8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://malware.lu/assets/files/articles/RAP003_KimJongRAT-Stealer_Analysis.1.0.pdf","pattern":"[url:value = 'https://malware.lu/assets/files/articles/RAP003_KimJongRAT-Stealer_Analysis.1.0.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06237c19-ba56-c841-51a0-000009583cf4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Korea.However","pattern":"[domain-name:value = 'Korea.However']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3a7dc13-54e4-c9df-3024-0000656c3ee3","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: too.We","pattern":"[domain-name:value = 'too.We']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ac9a96c-2e2b-a596-0ee6-00008711ed07","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: laoshi135.zhangand","pattern":"[domain-name:value = 'laoshi135.zhangand']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3e8b70b-aaf1-89d5-5e5c-0000fd76f8b9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://contagiodump.blogspot.ca/2010/10/oct-08-cve-2010-2883-pdf-nuclear.html","pattern":"[url:value = 'http://contagiodump.blogspot.ca/2010/10/oct-08-cve-2010-2883-pdf-nuclear.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7ea1acb-46ed-816e-3d93-0000e3b91826","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: analyse.Furthermore","pattern":"[domain-name:value = 'analyse.Furthermore']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--440dba1d-133d-fb86-0965-000080134f46","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.talosintelligence.com/2019/02/combing-through-brushaloader.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2019/02/combing-through-brushaloader.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6843242-45b5-b39e-2c7e-000080cd0f8e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--291db9a7-2278-268d-2f79-00007e40774a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/new-slub-backdoor-uses-github-communicates-via-slack/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/new-slub-backdoor-uses-github-communicates-via-slack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5929edb5-0216-024e-ecdc-00009e816cc1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/stealthworker-malware-uses-windows-linux-bots-to-hack-websites/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/stealthworker-malware-uses-windows-linux-bots-to-hack-websites/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76552d5d-a4db-fa7b-e42b-0000ab3907af","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/chessmaster-adds-updated-tools-to-its-arsenal/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/chessmaster-adds-updated-tools-to-its-arsenal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa4349b9-d10f-7737-0af3-0000f09764fd","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.virusbulletin.com/blog/2019/02/malspam-security-products-miss-banking-and-email-phishing-emotet-and-bushaloader/","pattern":"[url:value = 'https://www.virusbulletin.com/blog/2019/02/malspam-security-products-miss-banking-and-email-phishing-emotet-and-bushaloader/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--676b9e95-5fd1-9ab0-750a-0000258bad2d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: OSX.BadWord","pattern":"[domain-name:value = 'OSX.BadWord']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e396cd2-539f-8540-6107-0000074b46d2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: OSX.LamePyre","pattern":"[domain-name:value = 'OSX.LamePyre']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3aa750f2-72bb-167d-d47a-0000b03f8935","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-lamepyre-macos-malware-sends-screenshots-to-attacker/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-lamepyre-macos-malware-sends-screenshots-to-attacker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67544451-5b4f-b70c-fc53-0000611b1ea2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-kingminer-threat-shows-cryptominer-evolution/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-kingminer-threat-shows-cryptominer-evolution/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2b4c72c-42cb-0781-c9ed-00008d96ccc4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/rotexy-mobile-trojan-launches-70k-attacks-in-three-months/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/rotexy-mobile-trojan-launches-70k-attacks-in-three-months/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9a97737-a239-0eb8-dab8-00001a26421f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.carbonblack.com/2017/08/18/threat-analysis-carbon-black-threat-research-dissects-png-dropper/","pattern":"[url:value = 'https://www.carbonblack.com/2017/08/18/threat-analysis-carbon-black-threat-research-dissects-png-dropper/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85f5e9c6-acad-d995-cb39-0000e1951ccc","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"ip: 9.36.0.0","pattern":"[ipv4-addr:value = '9.36.0.0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56e43724-a6e1-778f-67fd-0000ecb6a160","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"ip: 1.0.32.1","pattern":"[ipv4-addr:value = '1.0.32.1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--038631ce-362d-fcc8-f24d-0000adc1df40","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.alienvault.com/forums/discussion/17301/alienvault-labs-threat-intelligence-update-for-usm-anywhere-march-25-march-31-2018","pattern":"[url:value = 'https://www.alienvault.com/forums/discussion/17301/alienvault-labs-threat-intelligence-update-for-usm-anywhere-march-25-march-31-2018']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49ccfbf3-6c07-ba3b-97c6-0000489bf301","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: sipauth32.tsp","pattern":"[domain-name:value = 'sipauth32.tsp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55ca3c68-92fa-7893-a418-0000baf08d32","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://malware.dontneedcoffee.com/2017/10/coalabot-http-ddos-bot.html","pattern":"[url:value = 'https://malware.dontneedcoffee.com/2017/10/coalabot-http-ddos-bot.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--565507e4-c766-18e4-b005-00000edd0e38","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.ncsc.gov.uk/alerts/indicators-compromise-malware-used-apt28","pattern":"[url:value = 'https://www.ncsc.gov.uk/alerts/indicators-compromise-malware-used-apt28']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--423d22cb-16ee-5204-ea95-00009656367c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/cronix-cryptominer-kills-rivals-to-reign-supreme/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/cronix-cryptominer-kills-rivals-to-reign-supreme/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63c18c03-a4a1-3b95-9e32-00008d65def5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-chainshot-malware-found-by-cracking-512-bit-rsa-key/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-chainshot-malware-found-by-cracking-512-bit-rsa-key/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1005fd19-b267-93f9-ae82-000036f9b63e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lojax-command-and-control-domains-still-active/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lojax-command-and-control-domains-still-active/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c2e666c-209e-728c-a2a3-00005acab648","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.cfr.org/interactive/cyber-operations/notpetya","pattern":"[url:value = 'https://www.cfr.org/interactive/cyber-operations/notpetya']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fb3ab1a-65f5-b4a6-e347-0000fa5ce463","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/magentocore-malware-found-on-7-339-magento-stores/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/magentocore-malware-found-on-7-339-magento-stores/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48d26c92-8652-9671-e482-0000ab74be2b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2Fsirefef","pattern":"[url:value = 'https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2Fsirefef']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b7cdcaa-d0bc-8580-46cd-000054a72a97","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.fortinet.com/blog/threat-research/russian-army-exhibition-decoy-leads-to-new-biskvit-malware.html","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/russian-army-exhibition-decoy-leads-to-new-biskvit-malware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e863d33-8377-f955-35be-0000bc6870b2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://camal.coseinc.com/publish/2013Bisonal.pdf","pattern":"[url:value = 'https://camal.coseinc.com/publish/2013Bisonal.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28afab7e-da67-cfb0-0259-0000a183db87","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/zerosum0x0/koadic","pattern":"[url:value = 'https://github.com/zerosum0x0/koadic']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22758308-355f-99f0-10bd-0000caa45a0f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/malware-that-hit-pyeongchang-olympics-deployed-in-new-attacks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/malware-that-hit-pyeongchang-olympics-deployed-in-new-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e34decc-bdc9-8e6e-31e9-000052cc36f0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.360totalsecurity.com/en/new-cryptominer-hijacks-your-bitcoin-transaction-over-300000-computers-have-been-attacked/","pattern":"[url:value = 'https://blog.360totalsecurity.com/en/new-cryptominer-hijacks-your-bitcoin-transaction-over-300000-computers-have-been-attacked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d52f24e-200f-3a79-25b4-00002d9d560e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/clipboard-hijacker-targeting-bitcoin-and-ethereum-users-infects-over-300-0000-pcs/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/clipboard-hijacker-targeting-bitcoin-and-ethereum-users-infects-over-300-0000-pcs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46bec6bf-d79b-c414-c086-00008b0d1286","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/","pattern":"[url:value = 'https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ee5e251-ed51-28f2-c765-0000fd3b2876","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: www.securelist.com","pattern":"[domain-name:value = 'www.securelist.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b65947d9-8170-bd52-7e95-0000dba17b35","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/invisimole-is-a-complex-spyware-that-can-take-pictures-and-record-audio/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/invisimole-is-a-complex-spyware-that-can-take-pictures-and-record-audio/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3127adc1-962a-d74a-9293-0000dab8ce27","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lol-babayaga-wordpress-malware-updates-your-site/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lol-babayaga-wordpress-malware-updates-your-site/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d32a9d64-a53d-b34b-d3af-0000a4fc1b00","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html","pattern":"[url:value = 'https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58072f0b-8c3a-6409-e5ab-0000745b07d9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.us-cert.gov/ncas/alerts/TA18-149A","pattern":"[url:value = 'https://www.us-cert.gov/ncas/alerts/TA18-149A']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a192b2f7-5baa-3c98-14a7-00008c0f1e08","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.fortinet.com/blog/threat-research/defending-against-the-new-vpnfilter-botnet.html","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/defending-against-the-new-vpnfilter-botnet.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--260a13f7-d4c1-1a38-44d0-0000c5c78851","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/new-vpnfilter-malware-infects-routers/","pattern":"[url:value = 'https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/new-vpnfilter-malware-infects-routers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3591ec2d-818e-033f-c4af-0000b1208f1a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.talosintelligence.com/2018/05/VPNFilter.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2018/05/VPNFilter.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc37df6c-a297-6991-75e0-00000ba60bf9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/stalinlocker-deletes-your-files-unless-you-enter-the-right-code/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/stalinlocker-deletes-your-files-unless-you-enter-the-right-code/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ef67158-7009-0218-230d-0000f4232526","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/facexworm-spreads-via-facebook-messenger-malicious-chrome-extension/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/facexworm-spreads-via-facebook-messenger-malicious-chrome-extension/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27c170a4-6dca-efd4-bae4-0000e95b3be5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/gaming/chinese-police-arrest-15-people-who-hid-malware-inside-pubg-cheat-apps/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/gaming/chinese-police-arrest-15-people-who-hid-malware-inside-pubg-cheat-apps/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36619444-f8b7-4de7-790b-0000ac7d7e54","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/maikspy-spyware-poses-as-adult-game-targets-windows-and-android-users/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/maikspy-spyware-poses-as-adult-game-targets-windows-and-android-users/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fdb869d-f85f-6ce4-9305-00007d655a83","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://cryptovest.com/news/hello-kitty-new-malware-me0ws-its-way-into-mining-monero/","pattern":"[url:value = 'https://cryptovest.com/news/hello-kitty-new-malware-me0ws-its-way-into-mining-monero/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d97b6673-5221-0098-8ff9-000056b1f7eb","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://threatpost.com/kitty-cryptomining-malware-cashes-in-on-drupalgeddon-2-0/131668/","pattern":"[url:value = 'https://threatpost.com/kitty-cryptomining-malware-cashes-in-on-drupalgeddon-2-0/131668/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0df8d33b-8cce-f565-10e5-0000c53ba320","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.zdnet.com/article/hello-kitty-malware-targets-drupal-to-mine-for-cryptocurrency/","pattern":"[url:value = 'https://www.zdnet.com/article/hello-kitty-malware-targets-drupal-to-mine-for-cryptocurrency/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6da753d-8940-1496-3cf3-0000ec8b85d2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.flashpoint-intel.com/blog/rubella-macro-builder/","pattern":"[url:value = 'https://www.flashpoint-intel.com/blog/rubella-macro-builder/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d36a8afd-94ee-240a-c573-000025615d79","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/rovnix-infects-systems-with-password-protected-macros/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/rovnix-infects-systems-with-password-protected-macros/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad0ed406-bd6f-8d35-0f67-0000f21714ad","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/goscanssh-malware-avoids-government-and-military-servers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/goscanssh-malware-avoids-government-and-military-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c51fc36-42e9-ffb5-7277-000070f51363","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.talosintelligence.com/2018/03/goscanssh-analysis.html","pattern":"[url:value = 'http://blog.talosintelligence.com/2018/03/goscanssh-analysis.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c65ebd68-8fcc-1a4c-989c-00006f0a73f6","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-diskwriter-or-uselessdisk-bootlocker-may-be-a-wiper/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-diskwriter-or-uselessdisk-bootlocker-may-be-a-wiper/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6913436-c5ca-bc20-99b1-0000e8b28c6f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf","pattern":"[url:value = 'https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca9f71ef-308a-15c7-3ba2-0000005c149b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/","pattern":"[url:value = 'https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--867f4530-6e5c-8a9f-30ce-0000e5241967","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: RoyalCli.pdb","pattern":"[domain-name:value = 'RoyalCli.pdb']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--026e42b0-3164-80e6-7b50-0000472d5209","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.APT.WINERACK","pattern":"[domain-name:value = 'Backdoor.APT.WINERACK']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9934ff5b-2462-92f4-96a1-0000860fcd3a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.APT.Zumkong","pattern":"[domain-name:value = 'Trojan.APT.Zumkong']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd44cf89-f256-f916-f5f4-00007852ee68","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: APT.Downloader.SLOWDRIFT","pattern":"[domain-name:value = 'APT.Downloader.SLOWDRIFT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8cf39d8-8156-fa3e-dd5a-0000600c8686","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: payloads.Lure","pattern":"[domain-name:value = 'payloads.Lure']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d5ab4ea-69c1-6102-0450-0000118e3f8e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: APT.Backdoor.SHUTTERSPEED","pattern":"[domain-name:value = 'APT.Backdoor.SHUTTERSPEED']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1b0dd17-38d3-9645-1da3-00000dd7ee0d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Exploit.APT.RICECURRY","pattern":"[domain-name:value = 'Exploit.APT.RICECURRY']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deeaeb8d-f725-54d2-3f9c-0000645656a5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.APT.POORAIM","pattern":"[domain-name:value = 'Backdoor.APT.POORAIM']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dad71ab-2497-0121-936c-0000f3e80c82","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.APT.Karae","pattern":"[domain-name:value = 'Backdoor.APT.Karae']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f6ce2af-491b-3bd8-d389-0000866e3d89","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Downloader.APT.HAPPYWORK","pattern":"[domain-name:value = 'Downloader.APT.HAPPYWORK']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--822e8323-3cbe-9b4e-918a-0000728bb432","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: APT.Backdoor.Win.DOGCALL","pattern":"[domain-name:value = 'APT.Backdoor.Win.DOGCALL']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c98218e6-7edd-2f22-b1ed-0000ee0ae9a8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: APT.InfoStealer.Win.CORALDECK","pattern":"[domain-name:value = 'APT.InfoStealer.Win.CORALDECK']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d1f2727-0914-b249-41c5-00009eb9aa56","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/","pattern":"[url:value = 'https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7e3fce1-b48c-6d68-8bb5-0000dd5ce2ad","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/necurs-and-gamut-botnets-account-for-97-percent-of-the-internets-spam-emails/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/necurs-and-gamut-botnets-account-for-97-percent-of-the-internets-spam-emails/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47e8e15e-19fb-dbb6-42b7-00007be0eeb4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.ncsc.gov.uk/content/files/protected_files/article_files/Turla%20group%20using%20Neuron%20and%20Nautilus%20tools%20alongside%20Snake%20malware_0.pdf","pattern":"[url:value = 'https://www.ncsc.gov.uk/content/files/protected_files/article_files/Turla%20group%20using%20Neuron%20and%20Nautilus%20tools%20alongside%20Snake%20malware_0.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb310ead-7d21-ef5a-7208-0000ea8ba6e2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~ShipUp-A/detailed-analysis.aspx","pattern":"[url:value = 'https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~ShipUp-A/detailed-analysis.aspx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e22a633-d171-9eed-21a5-0000ff664462","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~ShipUp-F/detailed-analysis.aspx","pattern":"[url:value = 'https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~ShipUp-F/detailed-analysis.aspx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--714346ce-ac2f-9e10-e54a-000026b1063c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Shipup.A","pattern":"[url:value = 'https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Shipup.A']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e24c3d9a-32d6-e162-f4b3-000011703d6f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FShipup.K","pattern":"[url:value = 'https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FShipup.K']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eee7f143-b436-dbbc-e5ed-0000b563d1fe","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shipup.G","pattern":"[url:value = 'https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shipup.G']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--424324d3-7fe3-955f-fae2-000065843f09","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/vinfo/dk/threat-encyclopedia/archive/malware/pe_ghotex.a-o","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/dk/threat-encyclopedia/archive/malware/pe_ghotex.a-o']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bed0f5f7-3d18-0340-869a-0000abe5e769","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.csoonline.com/article/2132422/malware-cybercrime/cyberespionage-malware--miniflame--discovered.html","pattern":"[url:value = 'https://www.csoonline.com/article/2132422/malware-cybercrime/cyberespionage-malware--miniflame--discovered.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ba9a619-c27b-2752-7746-0000b0d6dd79","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/miniflame-aka-spe-elvis-and-his-friends-5/31730/","pattern":"[url:value = 'https://securelist.com/miniflame-aka-spe-elvis-and-his-friends-5/31730/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70eae826-4e4a-f130-15a5-000083cbbd32","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: KAZY.SM","pattern":"[domain-name:value = 'KAZY.SM']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d241e068-96cd-f8dd-7142-0000c67f8ae5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Spuler","pattern":"[domain-name:value = 'Trojan.Spuler']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fefcb66-c047-a6b1-3a64-00000e3d1365","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Generic","pattern":"[domain-name:value = 'Trojan.Generic']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0aa60c5-7f42-3322-6298-0000f48acf80","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Generic30.ASYL","pattern":"[domain-name:value = 'Generic30.ASYL']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6010e5e3-2d84-36db-59a4-0000616c3cfa","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.solvusoft.com/en/malware/trojans/downloader-fgo/","pattern":"[url:value = 'https://www.solvusoft.com/en/malware/trojans/downloader-fgo/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5705ed09-0df1-9749-065e-0000601d0758","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.peerlyst.com/posts/hack-lu-2016-recap-interesting-malware-no-i-m-not-kidding-by-marion-marschalek-claus-cramon","pattern":"[url:value = 'https://www.peerlyst.com/posts/hack-lu-2016-recap-interesting-malware-no-i-m-not-kidding-by-marion-marschalek-claus-cramon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16434392-6c55-e243-a431-00003e6025ca","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/","pattern":"[url:value = 'https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d7ba089-c175-dd17-178c-0000734271d1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.youtube.com/watch?v=u2Ry9HTBbZI","pattern":"[url:value = 'https://www.youtube.com/watch?v=u2Ry9HTBbZI']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c2575cd-ae46-2679-a04d-0000744d1945","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/connect/blogs/hydraq-attack-mythical-proportions","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/hydraq-attack-mythical-proportions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e74baad-8bff-b16c-6aeb-00006c9478f4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/connect/blogs/hydraq-aurora-attackers-back","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/hydraq-aurora-attackers-back']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf5b21dc-a28c-0cf8-f710-000000c314aa","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/connect/blogs/trojanhydraq-incident-analysis-aurora-0-day-exploit","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/trojanhydraq-incident-analysis-aurora-0-day-exploit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cfc146a-6313-c66a-31ba-00002b936236","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/security_response/writeup.jsp?docid=2011-011117-0057-99","pattern":"[url:value = 'https://www.symantec.com/security_response/writeup.jsp?docid=2011-011117-0057-99']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c146ef70-f8d4-c4df-a66e-0000281db852","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: W32.Rotinom","pattern":"[domain-name:value = 'W32.Rotinom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9efcab3a-f409-fbfc-421d-00002472fe63","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://news.softpedia.com/news/Exforel-Backdoor-Implemented-at-NDIS-Level-to-Be-More-Stealthy-Experts-Say-313567.shtml","pattern":"[url:value = 'http://news.softpedia.com/news/Exforel-Backdoor-Implemented-at-NDIS-Level-to-Be-More-Stealthy-Experts-Say-313567.shtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e0737e3-4982-7cb5-84a4-000051b11e4e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.jpcert.or.jp/.s/2018/03/malware-tscooki-7aa0.html","pattern":"[url:value = 'http://blog.jpcert.or.jp/.s/2018/03/malware-tscooki-7aa0.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45943ccc-fc75-8ec9-875c-0000e852046d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/digmine-cryptocurrency-miner-spreading-via-facebook-messenger/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/digmine-cryptocurrency-miner-spreading-via-facebook-messenger/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af34f238-fd63-d085-5568-0000d93086a3","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/travle-aka-pylot-backdoor-hits-russian-speaking-targets/83455/","pattern":"[url:value = 'https://securelist.com/travle-aka-pylot-backdoor-hits-russian-speaking-targets/83455/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39b8df50-d72e-f51f-0b43-00005bd08949","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://objective-see.com/blog/blog_0x25.html#Proton","pattern":"[url:value = 'https://objective-see.com/blog/blog_0x25.html#Proton']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e00f2d25-9ab5-b967-ac99-00007a65863b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://objective-see.com/blog/blog_0x25.html#Empyre","pattern":"[url:value = 'https://objective-see.com/blog/blog_0x25.html#Empyre']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acedcbf7-7146-b915-00c7-0000b248b017","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://objective-see.com/blog/blog_0x25.html#MacDownloader","pattern":"[url:value = 'https://objective-see.com/blog/blog_0x25.html#MacDownloader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c30d9c1-29b1-b9a3-230d-00001238f71f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://objective-see.com/blog/blog_0x25.html#FruitFly","pattern":"[url:value = 'https://objective-see.com/blog/blog_0x25.html#FruitFly']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5577b58f-7c58-5454-1848-000049cca724","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/","pattern":"[url:value = 'https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d2a630-beb7-7424-d921-0000409d086b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/ratankba-watering-holes-against-enterprises/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/ratankba-watering-holes-against-enterprises/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef2b25e4-54d7-806c-5daa-00001ed2149a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf","pattern":"[url:value = 'https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d7014f1-323a-9186-7534-00003edbfa5d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.fortinet.com/2017/12/12/rise-of-one-more-mirai-worm-variant","pattern":"[url:value = 'https://blog.fortinet.com/2017/12/12/rise-of-one-more-mirai-worm-variant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aef98a7-8846-ba39-ef74-0000a16cf1ea","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/satori-botnet-has-sudden-awakening-with-over-280-000-active-bots/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/satori-botnet-has-sudden-awakening-with-over-280-000-active-bots/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c15fdb03-bc18-40c6-86f9-0000dc1bc16e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: 52869.Effectively","pattern":"[domain-name:value = '52869.Effectively']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf11532b-7f90-665a-2057-0000c727bf62","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: bot.The","pattern":"[domain-name:value = 'bot.The']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--843c5571-ea00-5dcb-7554-0000cbe57491","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: variants.Previous","pattern":"[domain-name:value = 'variants.Previous']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67495dc4-4fdf-2bc7-86f5-000062c5a178","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/dissecting-prilex-cutlet-maker-atm-malware-families/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/dissecting-prilex-cutlet-maker-atm-malware-families/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e43ab0a-2ab5-7266-3fdb-00005bc7b51e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season","pattern":"[url:value = 'https://community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aa39a0a-82fd-a47b-e9b1-00003d9050f0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf","pattern":"[url:value = 'https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ebaba6e-ead0-c0d6-1243-000083a1bf6a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www2.cybereason.com/research-osx-pirrit-mac-adware","pattern":"[url:value = 'https://www2.cybereason.com/research-osx-pirrit-mac-adware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cae4196-da8e-cb6f-c7d7-0000d5e471db","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf","pattern":"[url:value = 'http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ef8fbc3-9295-7649-3ede-000023b12fe1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2013/01/24/linux-sshdoor-a-backdoored-ssh-daemon-that-steals-passwords/","pattern":"[url:value = 'https://www.welivesecurity.com/2013/01/24/linux-sshdoor-a-backdoored-ssh-daemon-that-steals-passwords/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c8bb3ec-8d60-af4a-fd73-0000e10ccbe5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blogs.forcepoint.com/security-labs/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground","pattern":"[url:value = 'https://blogs.forcepoint.com/security-labs/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35b18bfd-b32b-94d6-ff59-00002d7b6782","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/quant-loader-is-now-bundled-with-other-crappy-malware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/quant-loader-is-now-bundled-with-other-crappy-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38598e4a-7a35-497b-77c3-00003ecc1115","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/wp-vcd-wordpress-malware-spreads-via-nulled-wordpress-themes/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/wp-vcd-wordpress-malware-spreads-via-nulled-wordpress-themes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37b885d7-5cda-bbb9-3957-0000fffe319c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/wp-vcd-wordpress-malware-campaign-is-back/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/wp-vcd-wordpress-malware-campaign-is-back/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff7b45d5-4f3d-1d13-9cb9-000035eda17e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2017/12/08/strongpity-like-spyware-replaces-finfisher/","pattern":"[url:value = 'https://www.welivesecurity.com/2017/12/08/strongpity-like-spyware-replaces-finfisher/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81ddbe80-7fdc-ec8f-e57c-0000976773f0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ordinypt-ransomware-intentionally-destroys-files-currently-targeting-germany/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ordinypt-ransomware-intentionally-destroys-files-currently-targeting-germany/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8e5f0a0-8ac9-69ae-8a95-0000e9d2ef6c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/zoho-heavily-used-by-keyloggers-to-transmit-stolen-data/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/zoho-heavily-used-by-keyloggers-to-transmit-stolen-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b52e90b2-6d4d-bc5e-543f-00009f3be8b0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.agenttesla.com/","pattern":"[url:value = 'https://www.agenttesla.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b198e33f-d153-2620-b093-000050c65ceb","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/security_response/writeup.jsp?docid=2010-051118-0604-99","pattern":"[url:value = 'https://www.symantec.com/security_response/writeup.jsp?docid=2010-051118-0604-99']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3080fdc-4ac1-224c-c1f1-0000f9a61de4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securityintelligence.com/gootkit-launches-redirection-attacks-in-the-uk/","pattern":"[url:value = 'https://securityintelligence.com/gootkit-launches-redirection-attacks-in-the-uk/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d041a0c-404a-e95c-5f5b-00004a2c8205","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securityintelligence.com/gootkit-bobbing-and-weaving-to-avoid-prying-eyes/","pattern":"[url:value = 'https://securityintelligence.com/gootkit-bobbing-and-weaving-to-avoid-prying-eyes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--542625c9-8128-98dc-5f56-000050f6bd2f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/inside-the-gootkit-cc-server/76433/","pattern":"[url:value = 'https://securelist.com/inside-the-gootkit-cc-server/76433/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca368ace-0837-fd92-4352-000061911b76","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.proofpoint.com/us/what-old-new-again-nymaim-moves-past-its-ransomware-roots-0","pattern":"[url:value = 'https://www.proofpoint.com/us/what-old-new-again-nymaim-moves-past-its-ransomware-roots-0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72179345-43e4-8dc7-5b49-00005b9856e9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://researchcenter.paloaltonetworks.com/2017/11/unit42-oilrig-deploys-alma-communicator-dns-tunneling-trojan/","pattern":"[url:value = 'https://researchcenter.paloaltonetworks.com/2017/11/unit42-oilrig-deploys-alma-communicator-dns-tunneling-trojan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72adc780-a872-76ec-f06f-0000399fc080","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://researchcenter.paloaltonetworks.com/2017/03/unit42-dimnie-hiding-plain-sight/","pattern":"[url:value = 'https://researchcenter.paloaltonetworks.com/2017/03/unit42-dimnie-hiding-plain-sight/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c1f5cc7-5189-8367-e8cb-0000fb90da9a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/","pattern":"[url:value = 'http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8915146b-5c9c-d29e-362c-0000f3875258","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://cdn.securelist.com/files/2017/08/ShadowPad_technical_description_PDF.pdf","pattern":"[url:value = 'https://cdn.securelist.com/files/2017/08/ShadowPad_technical_description_PDF.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--539c97bb-1a15-e258-3356-0000fac497be","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.cylance.com/en_us/blog/threat-spotlight-is-fireball-adware-or-malware.html","pattern":"[url:value = 'https://www.cylance.com/en_us/blog/threat-spotlight-is-fireball-adware-or-malware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0c4773c-139d-0462-0180-00002570b062","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2017/08/22/gamescom-2017-fun-blackhats/","pattern":"[url:value = 'https://www.welivesecurity.com/2017/08/22/gamescom-2017-fun-blackhats/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--087c1c2e-9d4c-0fe7-b048-000010e54e52","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: gf.ignitgames","pattern":"[domain-name:value = 'gf.ignitgames']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a033b6e-517f-0717-091c-000013841d6c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://isc.sans.edu/diary/22736","pattern":"[url:value = 'https://isc.sans.edu/diary/22736']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e819dda7-da16-6451-9477-000078bc1d31","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/look-js_powmet-completely-fileless-malware/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/look-js_powmet-completely-fileless-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--455e502a-9a32-ed64-e8ad-0000640ec02a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: POWMET.DE","pattern":"[domain-name:value = 'POWMET.DE']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cac0f260-6f2b-5357-1e0d-00007a1d2857","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"hash_md5: 9A26A0E7B88940DAA84FC4D5E6C61AD0","pattern":"[file:hashes.'MD5' = '9A26A0E7B88940DAA84FC4D5E6C61AD0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a1ed558-9c6a-af9c-1f96-000090993685","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/","pattern":"[url:value = 'https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecad2f6d-22ed-690e-1a6a-00004fab5246","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan-Banker.AndroidOS.Svpeng.ae","pattern":"[domain-name:value = 'Trojan-Banker.AndroidOS.Svpeng.ae']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd8556a4-de5a-414d-e164-00005b343d92","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/cowersnail-from-the-creators-of-sambacry/79087/","pattern":"[url:value = 'https://securelist.com/cowersnail-from-the-creators-of-sambacry/79087/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6233e266-d946-9464-b237-00006bb40226","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html","pattern":"[url:value = 'http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f90b1b16-9995-33f5-7014-0000d2398887","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://phishme.com/loki-bot-malware/","pattern":"[url:value = 'https://phishme.com/loki-bot-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ababa236-0f90-3194-8943-000009a5782c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.talosintelligence.com/2017/06/threat-roundup-0602-0609.html","pattern":"[url:value = 'http://blog.talosintelligence.com/2017/06/threat-roundup-0602-0609.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--401a950a-33bd-60a1-85ea-000008b5471d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm%3AWin32%2FFadok.A","pattern":"[url:value = 'https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm%3AWin32%2FFadok.A']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdc04eea-80d6-18a7-63eb-0000188f2bd2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Win.Worm.Fadok","pattern":"[domain-name:value = 'Win.Worm.Fadok']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d8ab7f8-4555-6531-5bd8-0000e94835ba","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.arbornetworks.com/blog/asert/lockpos-joins-flock/","pattern":"[url:value = 'https://www.arbornetworks.com/blog/asert/lockpos-joins-flock/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d8e26cc-4e77-2536-ec49-0000a51d07f4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securingtomorrow.mcafee.com/mcafee-labs/banload-trojan-targets-brazilians-with-malware-downloads/","pattern":"[url:value = 'https://securingtomorrow.mcafee.com/mcafee-labs/banload-trojan-targets-brazilians-with-malware-downloads/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--253f894d-3ad2-f5db-b91a-0000d0135527","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/banload-limits-targets-via-security-plugin/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/banload-limits-targets-via-security-plugin/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f21e11db-585b-faac-87d8-0000dc7c81fe","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/banload","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/banload']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14d4bc4d-49bc-df3b-d6d6-000045faac50","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://researchcenter.paloaltonetworks.com/2016/03/banload-malware-affecting-brazil-exhibits-unusually-complex-infection-process/","pattern":"[url:value = 'https://researchcenter.paloaltonetworks.com/2016/03/banload-malware-affecting-brazil-exhibits-unusually-complex-infection-process/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20c2eee6-d55d-0d0e-b798-0000ec8e9462","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://myonlinesecurity.co.uk/new-guidelines-from-moneygram-malspam-delivers-a-brand-new-java-adwind-version/","pattern":"[url:value = 'https://myonlinesecurity.co.uk/new-guidelines-from-moneygram-malspam-delivers-a-brand-new-java-adwind-version/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--280cb110-f35f-77be-3fdd-00001c383524","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://resources.netskope.com/h/i/352356475-phishing-as-a-service-phishing-revamped","pattern":"[url:value = 'https://resources.netskope.com/h/i/352356475-phishing-as-a-service-phishing-revamped']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e13a1a-e317-a753-edaf-000017636f6a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/trickbot-banking-trojan-gets-screenlocker-component/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/trickbot-banking-trojan-gets-screenlocker-component/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--654d5c4f-c116-2c94-02b1-000091d3a043","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securityintelligence.com/trickbot-is-hand-picking-private-banks-for-targets-with-redirection-attacks-in-tow/","pattern":"[url:value = 'https://securityintelligence.com/trickbot-is-hand-picking-private-banks-for-targets-with-redirection-attacks-in-tow/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62de73a3-fdd4-49ec-eacb-00004a317313","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.fraudwatchinternational.com/malware/trickbot-malware-works","pattern":"[url:value = 'https://blog.fraudwatchinternational.com/malware/trickbot-malware-works']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce5197f6-99d7-d6cc-8cf6-0000675337bd","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87fbbc1d-69e8-6fd7-f6d4-00008297bf2a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--311972bb-7f53-5cd4-ff08-0000441fe7da","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.us-cert.gov/ncas/alerts/TA17-117A","pattern":"[url:value = 'https://www.us-cert.gov/ncas/alerts/TA17-117A']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32bfadc2-512d-5e98-a96a-0000262a6b0b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38a66943-eb28-aecb-11a9-00000d20a03c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2010/10/feodosoff-a-new-botnet-on-the-rise.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2010/10/feodosoff-a-new-botnet-on-the-rise.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8173c780-d126-53a3-674f-000058f43fa0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/misterch0c/shadowbroker","pattern":"[url:value = 'https://github.com/misterch0c/shadowbroker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85fb1961-ba8e-72c0-0862-00000c0c66b0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.f-secure.com/documents/996508/1030745/callisto-group","pattern":"[url:value = 'https://www.f-secure.com/documents/996508/1030745/callisto-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--249c302c-a6f8-d6f3-9e20-0000e3de1392","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d70816b2-656a-d227-df40-000020ef52e2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a17722f4-8ef1-da81-0ec0-00002f683cbc","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://wikileaks.org/hackingteam/emails/emailid/31436","pattern":"[url:value = 'https://wikileaks.org/hackingteam/emails/emailid/31436']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71bdf203-bdad-1e7b-3e42-0000656ab788","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://wikileaks.org/hackingteam/emails/fileid/581640/267803","pattern":"[url:value = 'https://wikileaks.org/hackingteam/emails/fileid/581640/267803']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a89b69ca-a323-2f32-1acb-0000bbacccb2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://surveillance.rsf.org/en/hacking-team/","pattern":"[url:value = 'http://surveillance.rsf.org/en/hacking-team/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10c40f28-9375-f56f-4dde-0000d9b94880","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://researchcenter.paloaltonetworks.com/2017/10/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/","pattern":"[url:value = 'https://researchcenter.paloaltonetworks.com/2017/10/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0048834e-df22-b9c7-9b6d-0000bfa80374","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"ip: 2.0.0.1","pattern":"[ipv4-addr:value = '2.0.0.1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--060e7b49-cfcd-2947-7d1c-0000438fe9db","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"ip: 1.3.4.0","pattern":"[ipv4-addr:value = '1.3.4.0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74512d82-8df2-bbba-7c3e-0000edc9e826","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: www.winsim.com","pattern":"[domain-name:value = 'www.winsim.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31c2927d-19d8-512e-8cf9-0000423edd4e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: www.bo2k.com","pattern":"[domain-name:value = 'www.bo2k.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acfe7ab1-98fc-d706-4a37-00007386e325","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: www.dankrusi.com","pattern":"[domain-name:value = 'www.dankrusi.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7160c0e-36e4-463a-6ea8-0000a689920e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://contagiodump.blogspot.com/2010/06/these-days-i-see-spike-in-number-of.html","pattern":"[url:value = 'http://contagiodump.blogspot.com/2010/06/these-days-i-see-spike-in-number-of.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abc42c68-dc61-e054-6353-00006b3d9ae9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: TROJAN.FOXY","pattern":"[domain-name:value = 'TROJAN.FOXY']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93938326-4ec6-a4b7-63a7-0000128c7100","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"ip: 0.9.9.12","pattern":"[ipv4-addr:value = '0.9.9.12']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcb7e8b4-f150-7e2c-cda0-0000f5834c55","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://camaya.net/gloox/","pattern":"[url:value = 'http://camaya.net/gloox/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6672d846-4419-0c93-3d87-00004a411c67","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: TROJAN.COOKIES","pattern":"[domain-name:value = 'TROJAN.COOKIES']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db84415f-8a6d-92fe-938f-000090211585","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html","pattern":"[url:value = 'http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b571e3e3-0af7-1963-8235-00000d83ca67","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2017/04/06/sathurbot-distributed-wordpress-password-attack/","pattern":"[url:value = 'https://www.welivesecurity.com/2017/04/06/sathurbot-distributed-wordpress-password-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea87566b-97e1-c534-99c7-00002fc98dd4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://virusradar.com/en/Win32_Sathurbot.A/description","pattern":"[url:value = 'http://virusradar.com/en/Win32_Sathurbot.A/description']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7297e82a-4f12-6259-0049-00003960f9e9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://security.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html","pattern":"[url:value = 'https://security.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a95efc6-d89b-11f0-c7fc-000038d7273e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.enigmasoftware.com/trochilusrat-removal/","pattern":"[url:value = 'http://www.enigmasoftware.com/trochilusrat-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9da80f8c-f4fc-57d4-2c1f-000043cc90c2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blogs.forcepoint.com/security-labs/trojanized-adobe-installer-used-install-dragonok%E2%80%99s-new-custom-backdoor","pattern":"[url:value = 'https://blogs.forcepoint.com/security-labs/trojanized-adobe-installer-used-install-dragonok%E2%80%99s-new-custom-backdoor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3df69ef5-b3fe-383b-96a3-0000fc650415","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/elf_imeij.a","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/elf_imeij.a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23e8212b-55af-08ff-587a-0000e2209325","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/kevthehermit/RATDecoders","pattern":"[url:value = 'https://github.com/kevthehermit/RATDecoders']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e06d8f6e-7679-c4f0-8b18-000039273a05","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar","pattern":"[url:value = 'https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9c02529-2044-19fb-b570-0000b07d2a7f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2016/11/floki-bot-and-the-stealthy-dropper/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2016/11/floki-bot-and-the-stealthy-dropper/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04639d06-b412-5a54-7a7c-0000e0affdad","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/","pattern":"[url:value = 'https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecda2637-e9bc-0238-415a-0000708a0eb9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/07/unit42-investigating-the-luminositylink-remote-access-trojan-configuration/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/07/unit42-investigating-the-luminositylink-remote-access-trojan-configuration/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--122a0751-a500-8368-3634-00000df25e2a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-inner-workings-eyepyramid/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-inner-workings-eyepyramid/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3567a122-d110-388d-ea6e-0000ab75ae46","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-ghostadmin-malware-used-for-data-theft-and-exfiltration/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-ghostadmin-malware-used-for-data-theft-and-exfiltration/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--964a52df-a0e1-dddc-8453-00006c27a06d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securityaffairs.co/wordpress/78867/breaking-news/shamoon-virustotal.html","pattern":"[url:value = 'https://securityaffairs.co/wordpress/78867/breaking-news/shamoon-virustotal.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b3a9e6c-fe99-dbf0-77b6-00009c750957","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://en.wikipedia.org/wiki/Shamoon","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Shamoon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2caac4a5-c1da-52a9-8193-0000b25082b5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blogs.forcepoint.com/security-labs/mm-core-memory-backdoor-returns-bigboss-and-sillygoose","pattern":"[url:value = 'https://blogs.forcepoint.com/security-labs/mm-core-memory-backdoor-returns-bigboss-and-sillygoose']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf7a4803-a8cc-3977-4f08-00007e40a667","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securityintelligence.com/tag/shiz-trojan-malware/","pattern":"[url:value = 'https://securityintelligence.com/tag/shiz-trojan-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dec636ae-4f59-7edf-d102-0000dc8bc3ea","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2017/01/unit42-2016-updates-shifu-banking-trojan/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2017/01/unit42-2016-updates-shifu-banking-trojan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f271cc78-7975-ec2f-3b46-0000eed9a55c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99","pattern":"[url:value = 'https://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a67f9a42-68a5-1321-637b-0000cc7c129b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://en.wikipedia.org/wiki/Zeus_(malware)","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Zeus_(malware)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a88d3232-42c7-b21b-feaa-0000fda23175","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Zbot","pattern":"[domain-name:value = 'Trojan.Zbot']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--460c3017-0bc9-6393-cd9d-00003bef8ac5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://attack.mitre.org/wiki/Software/S0049","pattern":"[url:value = 'https://attack.mitre.org/wiki/Software/S0049']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc63fe9d-f1f9-bee4-5930-00005f399260","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://twitter.com/Timo_Steffens/status/814781584536719360","pattern":"[url:value = 'https://twitter.com/Timo_Steffens/status/814781584536719360']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d96045e3-f84c-a570-2971-00001e1459a2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.Tinybaron","pattern":"[domain-name:value = 'Backdoor.Tinybaron']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daad6c95-4136-6b84-270c-00006e81c491","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/security_response/writeup.jsp?docid=2015-031915-4935-99","pattern":"[url:value = 'https://www.symantec.com/security_response/writeup.jsp?docid=2015-031915-4935-99']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2888523d-ecb8-716e-9df2-0000432d1f5f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Seaduke","pattern":"[domain-name:value = 'Trojan.Seaduke']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3235732-67ab-89d5-5b88-00008404ce02","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.virusbulletin.com/conference/vb2014/abstracts/back-blackenergy-2014-targeted-attacks-ukraine-and-poland/","pattern":"[url:value = 'https://www.virusbulletin.com/conference/vb2014/abstracts/back-blackenergy-2014-targeted-attacks-ukraine-and-poland/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--978dac0a-1cd8-416d-7f4b-0000685acc97","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://en.wikipedia.org/wiki/Mirai_(malware)","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Mirai_(malware)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--238442a8-2ffc-bf73-9dc4-00000b8723eb","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india","pattern":"[url:value = 'https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ca5df65-ae34-9ce4-8c3d-00001a76c2fe","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://citizenlab.org/2016/11/parliament-keyboy/","pattern":"[url:value = 'https://citizenlab.org/2016/11/parliament-keyboy/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e717692f-d32c-1b80-bf4b-0000f08b11bd","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.checkpoint.com/downloads/volatile-cedar-technical-report.pdf","pattern":"[url:value = 'https://www.checkpoint.com/downloads/volatile-cedar-technical-report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57a00d25-e911-4358-a833-0000a9881c57","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/adaptivethreat/Empire","pattern":"[url:value = 'https://github.com/adaptivethreat/Empire']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57d47f2e-9698-92bb-c2ba-0000efbc5de7","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.sophos.com/medialibrary/PDFs/technical%20papers/sophos-vawtrak-international-crimeware-as-a-service-tpna.pdf","pattern":"[url:value = 'https://www.sophos.com/medialibrary/PDFs/technical%20papers/sophos-vawtrak-international-crimeware-as-a-service-tpna.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5546bc43-1d28-da04-2efe-000051657373","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://en.wikipedia.org/wiki/Akbot","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Akbot']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5736fbaa-d91a-59ef-4391-0000186b30a0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/worlds-largest-spam-botnet-finds-a-new-way-to-avoid-detection-for-now/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/worlds-largest-spam-botnet-finds-a-new-way-to-avoid-detection-for-now/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00a49dff-e809-4b75-4d24-00005fbae2e5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://en.wikipedia.org/wiki/Necurs_botnet","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Necurs_botnet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--177c4856-b6f5-cf6e-a6db-0000fd54efa1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.gdatasoftware.com/2015/03/24274-the-andromeda-gamarue-botnet-is-on-the-rise-again","pattern":"[url:value = 'https://blog.gdatasoftware.com/2015/03/24274-the-andromeda-gamarue-botnet-is-on-the-rise-again']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f37ff85a-854f-6f4e-967b-00008982e923","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dridex-financial-trojan.pdf","pattern":"[url:value = 'http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dridex-financial-trojan.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdccb076-2b37-698f-abd1-0000d21d7192","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/blog/research/73660/adwind-faq/","pattern":"[url:value = 'https://securelist.com/blog/research/73660/adwind-faq/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24e8271c-c24a-2a2d-422c-0000955ec7b1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan","pattern":"[url:value = 'http://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bc1bb13-1a01-4831-b4ae-0000ebe41f09","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.Dripion","pattern":"[domain-name:value = 'Backdoor.Dripion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0289e57-c5d8-a64c-f86d-000047f27255","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/10/unit42-houdinis-magic-reappearance/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/10/unit42-houdinis-magic-reappearance/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03377189-19de-affb-0247-0000940b881a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f66db37-36ce-2177-64a2-0000134f6e6d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1371ed87-6293-e399-9a9c-0000dcde84b3","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.amnesty.org/download/Documents/ASA3383662018ENGLISH.PDF","pattern":"[url:value = 'https://www.amnesty.org/download/Documents/ASA3383662018ENGLISH.PDF']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c9e8f1b-066c-ae58-3f96-00004fa933d4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.arbornetworks.com/blog/asert/mad-max-dga/","pattern":"[url:value = 'https://www.arbornetworks.com/blog/asert/mad-max-dga/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f43b6f8-2677-a99f-7c50-000012eb7edd","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://objective-see.com/blog/blog_0x25.html#XAgent","pattern":"[url:value = 'https://objective-see.com/blog/blog_0x25.html#XAgent']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bcb5c7d-16a5-090f-6686-0000b2e7b746","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://app.box.com/s/l7n781ig6n8wlf1aff5hgwbh4qoi5jqq","pattern":"[url:value = 'https://app.box.com/s/l7n781ig6n8wlf1aff5hgwbh4qoi5jqq']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59a3c17d-343a-3d9d-db9d-00003561aaa9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5eadc892-bf6c-e71f-ee20-0000a1a5ab7d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2016/06/irongate_ics_malware.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2016/06/irongate_ics_malware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee921017-375d-f406-6150-0000b9dc108c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ea73ead-af29-2deb-3eb3-00002ca1a6a5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.bit9.com/2013/02/25/bit9-security-incident-update/","pattern":"[url:value = 'https://blog.bit9.com/2013/02/25/bit9-security-incident-update/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3318c8b-855b-f30b-564a-0000dffe6611","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e00897d4-adaa-d2c8-4615-00002176437d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: www.arbornetworks.com","pattern":"[domain-name:value = 'www.arbornetworks.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d28b8728-78d9-b22c-c1f7-0000cc800600","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.symantec.com/connect/blogs/operation-cloudyomega-ichitaro-zero-day-and-ongoing-cyberespionage-campaign-targeting-japan","pattern":"[url:value = 'http://www.symantec.com/connect/blogs/operation-cloudyomega-ichitaro-zero-day-and-ongoing-cyberespionage-campaign-targeting-japan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1e6afdb-02c7-9a0c-e523-0000155c78c5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.fireeye.com/blog/technical/threat-intelligence/2014/07/spy-of-the-tiger.html","pattern":"[url:value = 'http://www.fireeye.com/blog/technical/threat-intelligence/2014/07/spy-of-the-tiger.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4756d11a-3d9e-b9ed-c0d4-0000ffec63d0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.cybersquared.com/killing-with-a-borrowed-knife-chaining-core-cloud-service-profile-infrastructure-for-cyber-attacks","pattern":"[url:value = 'http://www.cybersquared.com/killing-with-a-borrowed-knife-chaining-core-cloud-service-profile-infrastructure-for-cyber-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad3e3673-b1a9-499c-5d5e-0000eabc1fd4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.circl.lu/pub/tr-13/","pattern":"[url:value = 'https://www.circl.lu/pub/tr-13/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faafe48d-3766-6a22-22ea-000061e04516","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.secureworks.com/research/threats/htran/","pattern":"[url:value = 'http://www.secureworks.com/research/threats/htran/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03653697-6de7-3b6a-3e1d-0000b8eeef7a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://cofense.com/major-us-financial-institutions-imitated-advanced-geodo-emotet-phishing-lures-appear-authentic-containing-proofpoint-url-wrapped-links/","pattern":"[url:value = 'https://cofense.com/major-us-financial-institutions-imitated-advanced-geodo-emotet-phishing-lures-appear-authentic-containing-proofpoint-url-wrapped-links/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1db5896-7475-b991-6388-00006e8b5d5d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.bleepingcomputer.com/news/security/emotet-returns-with-thanksgiving-theme-and-better-phishing-tricks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/emotet-returns-with-thanksgiving-theme-and-better-phishing-tricks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e83f7b8-6789-1ceb-30fa-000010774f98","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.forcepoint.com/blog/security-labs/thanks-giving-emotet","pattern":"[url:value = 'https://www.forcepoint.com/blog/security-labs/thanks-giving-emotet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28d59ec3-a5d2-9e80-244a-00007ee4ec50","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/analysis/publications/69560/the-banking-trojan-emotet-detailed-analysis/","pattern":"[url:value = 'https://securelist.com/analysis/publications/69560/the-banking-trojan-emotet-detailed-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d306124-e034-7cd8-6342-0000910dc1b5","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://pwc.blogs.com/cyber_security_updates/2014/10/scanbox-framework-whos-affected-and-whos-using-it-1.html","pattern":"[url:value = 'http://pwc.blogs.com/cyber_security_updates/2014/10/scanbox-framework-whos-affected-and-whos-using-it-1.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d82acfa-c304-451e-a11d-00004d21a22c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf","pattern":"[url:value = 'http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e099046b-0a91-19bf-4d37-00005d4b8f6b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.avast.com/2013/07/22/multisystem-trojan-janicab-attacks-windows-and-macosx-via-scripts/","pattern":"[url:value = 'http://blog.avast.com/2013/07/22/multisystem-trojan-janicab-attacks-windows-and-macosx-via-scripts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b81842f5-8c0c-53d9-0f86-0000965a41fc","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.clearskysec.com/dustysky/","pattern":"[url:value = 'http://www.clearskysec.com/dustysky/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a0a85b5-d026-5f97-217d-000091c2fc4f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2014/10/new-indicators-compromise-apt-group-nitro-uncovered/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2014/10/new-indicators-compromise-apt-group-nitro-uncovered/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f60b577-ad89-cedc-e093-000071c800e1","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.threatconnect.com/news/threatconnect-enables-healthy-networking-biomed-life-sciences-industry/","pattern":"[url:value = 'http://www.threatconnect.com/news/threatconnect-enables-healthy-networking-biomed-life-sciences-industry/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efd1d7dd-571b-fc9d-c776-00004e8a52b8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://labs.alienvault.com/labs/index.php/2011/another-sykipot-sample-likely-targeting-us-federal-agencies/","pattern":"[url:value = 'http://labs.alienvault.com/labs/index.php/2011/another-sykipot-sample-likely-targeting-us-federal-agencies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40d2fced-ab3f-a8a7-a2df-000085981b54","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/","pattern":"[url:value = 'http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1b2a4d1-c9ac-f982-9bca-00009739b105","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://labs.alienvault.com/labs/index.php/2013/latest-adobe-pdf-exploit-used-to-target-uyghur-and-tibetan-activists/","pattern":"[url:value = 'http://labs.alienvault.com/labs/index.php/2013/latest-adobe-pdf-exploit-used-to-target-uyghur-and-tibetan-activists/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb9e6bad-fa74-a866-177e-0000b4688749","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.symantec.com/connect/blogs/trojantaidoor-takes-aim-policy-think-tanks","pattern":"[url:value = 'http://www.symantec.com/connect/blogs/trojantaidoor-takes-aim-policy-think-tanks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d0ab7f7-c0e7-c1c0-5568-00000facf187","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.cylance.com/techblog/Grand-Theft-Auto-Panda.shtml","pattern":"[url:value = 'http://www.cylance.com/techblog/Grand-Theft-Auto-Panda.shtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94ec73fe-317f-1809-ffdd-0000e6829f86","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox","pattern":"[url:value = 'https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92f65b7d-be3b-7f26-167e-0000a5ce6d89","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html","pattern":"[url:value = 'http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b8d1741-00be-3230-f9fb-000013a4d979","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://en.wikipedia.org/wiki/Regin_(malware)","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Regin_(malware)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f1601bd-e892-5a2e-a0df-0000d43faca2","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.sentinelone.com/blog/understanding-kjw0rm-malware-we-dive-in-to-the-tv5-cyber-attack/","pattern":"[url:value = 'https://www.sentinelone.com/blog/understanding-kjw0rm-malware-we-dive-in-to-the-tv5-cyber-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a14b5ad-9370-195c-d896-0000a6be0587","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_sasfis.tl","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_sasfis.tl']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4416e22e-a7eb-2a41-b13a-00005e390a3f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf","pattern":"[url:value = 'https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9f5b58e-852b-e80c-b775-00004bb82fa3","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.malwarebytes.org/intelligence/2012/06/you-dirty-rat-part-2-blackshades-net/","pattern":"[url:value = 'https://blog.malwarebytes.org/intelligence/2012/06/you-dirty-rat-part-2-blackshades-net/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67c406d5-1050-132d-1f97-0000b567133d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-and-fbi-assistant-director-charge-announce-charges-connection","pattern":"[url:value = 'https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-and-fbi-assistant-director-charge-announce-charges-connection']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90bef53e-eb66-8771-2975-00009f9106d7","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/japan-us-defense-industries-among-targeted-entities-in-latest-attack/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/japan-us-defense-industries-among-targeted-entities-in-latest-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9ccbe91-aedb-f7e8-7fc0-0000e0339a7d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-fakem-rat.pdf","pattern":"[url:value = 'http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-fakem-rat.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91277b99-fa62-0ad3-53d8-00006f75d316","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://download01.norman.no/documents/ThemanyfacesofGh0stRat.pdf","pattern":"[url:value = 'http://download01.norman.no/documents/ThemanyfacesofGh0stRat.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c05027e-e162-546c-cc40-0000cea38bfc","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: C.Rufus","pattern":"[domain-name:value = 'C.Rufus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72bd86c8-2d60-7a4f-609a-0000b3c372d8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/files/2015/02/The-Desert-Falcons-targeted-attacks.pdf","pattern":"[url:value = 'https://securelist.com/files/2015/02/The-Desert-Falcons-targeted-attacks.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f1dbad1-9c08-1efc-82f2-00000511307d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/03/digital-quartermaster-scenario-demonstrated-in-attacks-against-the-mongolian-government/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/03/digital-quartermaster-scenario-demonstrated-in-attacks-against-the-mongolian-government/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce78bad6-438a-5da3-7a5a-00003d86b3de","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://objective-see.com/blog/blog_0x25.html#Snake","pattern":"[url:value = 'https://objective-see.com/blog/blog_0x25.html#Snake']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59c90053-fdb8-b1ec-64aa-00007834af0a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf","pattern":"[url:value = 'https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0aecc70a-e848-f34f-d99d-0000cc3972f0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Wipbot","pattern":"[domain-name:value = 'Trojan.Wipbot']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a5d5d28-00a0-82ae-c2ab-0000d8e75cbc","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.gdatasoftware.com/2015/01/23927-evolution-of-sophisticated-spyware-from-agent-btz-to-comrat","pattern":"[url:value = 'https://blog.gdatasoftware.com/2015/01/23927-evolution-of-sophisticated-spyware-from-agent-btz-to-comrat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77fcda6d-789b-0506-296a-00007ba58e08","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://attack.mitre.org/wiki/Software/S0034","pattern":"[url:value = 'https://attack.mitre.org/wiki/Software/S0034']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b529fabd-06ab-680e-23a3-00009511b903","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://kasperskycontenthub.com/securelist/files/2015/05/TheNaikonAPT-MsnMM.pdf","pattern":"[url:value = 'https://kasperskycontenthub.com/securelist/files/2015/05/TheNaikonAPT-MsnMM.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f54226c-38b9-db06-892a-00007e0fa438","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www2.fireeye.com/WEB-2015RPTAPT30.html","pattern":"[url:value = 'https://www2.fireeye.com/WEB-2015RPTAPT30.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c67631fe-035d-d9c4-ce69-00003417c809","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5c1147c-d308-577b-811c-00006b50f14c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong","pattern":"[url:value = 'http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a865709e-0826-c2a4-3b07-0000a284821e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.Pirpi","pattern":"[domain-name:value = 'Backdoor.Pirpi']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef4ccc7b-bf35-b75b-3185-0000b4f75709","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.securestate.com/blog/2013/02/20/apt-if-it-aint-broke","pattern":"[url:value = 'https://www.securestate.com/blog/2013/02/20/apt-if-it-aint-broke']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5051870-d7a6-1cb7-5cb7-000052f641dd","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/gnaegle/cse4990-practical3","pattern":"[url:value = 'https://github.com/gnaegle/cse4990-practical3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71f701c9-5321-b897-5268-000050cabeee","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/","pattern":"[url:value = 'https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57e16014-bbb0-3dc9-27ec-0000a1ec37a3","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Agent.ALQHI","pattern":"[domain-name:value = 'Agent.ALQHI']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--149cbbe7-a575-3382-0230-0000a6532b83","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/winnti-more-than-just-a-game-130410.pdf","pattern":"[url:value = 'https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/winnti-more-than-just-a-game-130410.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ab6dc29-376b-5ba7-7b27-0000cc65a461","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/blog/incidents/57455/nettraveler-is-back-the-red-star-apt-returns-with-new-tricks/","pattern":"[url:value = 'https://securelist.com/blog/incidents/57455/nettraveler-is-back-the-red-star-apt-returns-with-new-tricks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2b9e804-275b-535e-3e6e-0000d7659f7c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securityledger.com/2013/09/apt-for-hire-symantec-outs-hidden-lynx-hacking-crew/","pattern":"[url:value = 'https://securityledger.com/2013/09/apt-for-hire-symantec-outs-hidden-lynx-hacking-crew/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eca29df6-97c7-2990-dae6-0000b9087cb3","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.darkreading.com/attacks-breaches/elite-chinese-cyberspy-group-behind-bit9-hack/d/d-id/1140495","pattern":"[url:value = 'http://www.darkreading.com/attacks-breaches/elite-chinese-cyberspy-group-behind-bit9-hack/d/d-id/1140495']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bf67533-35f8-688d-bfe0-0000a70b015d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.Moudoor","pattern":"[domain-name:value = 'Backdoor.Moudoor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb4bf037-9237-2328-ca61-000073fcb78e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: AGENT.ABQMR","pattern":"[domain-name:value = 'AGENT.ABQMR']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc7639f2-7470-97dc-9f82-0000d1d284da","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: AGENT.BMZA","pattern":"[domain-name:value = 'AGENT.BMZA']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c9e43b5-f97a-2dfa-92a5-0000ba5e72d7","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: AGENT.AQUP.DROPPER","pattern":"[domain-name:value = 'AGENT.AQUP.DROPPER']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5625b1-da9c-dedd-93bb-0000bdcb5812","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: AGENT.GUNZ","pattern":"[domain-name:value = 'AGENT.GUNZ']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fef77716-6f47-e209-0516-0000af7a121c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://telussecuritylabs.com/threats/show/TSL20120614-05","pattern":"[url:value = 'http://telussecuritylabs.com/threats/show/TSL20120614-05']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--861f7d93-257d-9475-0659-00001cba49cf","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.symantec.com/connect/blogs/cve-2012-1875-exploited-wild-part-1-trojannaid","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/cve-2012-1875-exploited-wild-part-1-trojannaid']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd11b3fc-a5b0-986a-4e34-0000edf0125e","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2015/06/evilgrab-delivered-by-watering-hole-attack-on-president-of-myanmars-website/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2015/06/evilgrab-delivered-by-watering-hole-attack-on-president-of-myanmars-website/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b51225bc-8d2d-3d29-f2fd-00002378e3c0","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/evilgrab-malware-family-used-in-targeted-attacks-in-asia/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/evilgrab-malware-family-used-in-targeted-attacks-in-asia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2578bf4f-b16e-9a13-348d-00005b3d350f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: DLLSERV.BE","pattern":"[domain-name:value = 'DLLSERV.BE']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--230b2967-6d3c-9007-7cf7-00006a7ade4b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.rsaconference.com/writable/presentations/file_upload/hta-w02-dissecting-derusbi.pdf","pattern":"[url:value = 'https://www.rsaconference.com/writable/presentations/file_upload/hta-w02-dissecting-derusbi.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c14a104-356d-9b15-8488-00005eb9b48b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.novetta.com/wp-content/uploads/2014/11/Derusbi.pdf","pattern":"[url:value = 'http://www.novetta.com/wp-content/uploads/2014/11/Derusbi.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8562c783-abde-3c0e-e18f-00003002a10f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html","pattern":"[url:value = 'http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd030c77-1aed-925c-f00f-000090742510","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.secureworks.com/research/sakula-malware-family","pattern":"[url:value = 'https://www.secureworks.com/research/sakula-malware-family']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--600f5221-2513-b016-7eca-0000393e8f45","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Atros2.CKPN","pattern":"[domain-name:value = 'Atros2.CKPN']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be103461-be16-1f9d-acf0-00001bfe0794","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://nanocore.io/","pattern":"[url:value = 'https://nanocore.io/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12953c84-25b8-2bdb-e43b-0000e1dce8d4","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.symantec.com/connect/blogs/nanocore-another-rat-tries-make-it-out-gutter","pattern":"[url:value = 'http://www.symantec.com/connect/blogs/nanocore-another-rat-tries-make-it-out-gutter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a39fc485-0c20-bc5e-2379-0000dcae00f9","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://github.com/kevthehermit/RATDecoders/blob/master/yaraRules/njRat.yar","pattern":"[url:value = 'https://github.com/kevthehermit/RATDecoders/blob/master/yaraRules/njRat.yar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54f8467f-12b3-10ef-ddbc-0000be9ef83a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.fidelissecurity.com/files/files/FTA_1009-njRAT_Uncovered_rev2.pdf","pattern":"[url:value = 'http://www.fidelissecurity.com/files/files/FTA_1009-njRAT_Uncovered_rev2.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e5f52d2-e814-4acc-effb-00000922d70d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/lost-door-rat-accessible-customizable-attack-tool/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/lost-door-rat-accessible-customizable-attack-tool/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--711eb5c0-8b4c-7fc0-9086-00000664b401","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/04/unit42-python-based-pwobot-targets-european-organizations/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/04/unit42-python-based-pwobot-targets-european-organizations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0404cc4f-32cc-d827-9328-0000ef92d30c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securityintelligence.com/android-malware-about-to-get-worse-gm-bot-source-code-leaked/","pattern":"[url:value = 'https://securityintelligence.com/android-malware-about-to-get-worse-gm-bot-source-code-leaked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47d0118f-8faf-34ab-50de-0000cb15e890","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlaziok-targets-energy-sector","pattern":"[url:value = 'http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlaziok-targets-energy-sector']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd6d7ce3-f601-7d7f-746d-00000f913874","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Laziok","pattern":"[domain-name:value = 'Trojan.Laziok']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f54df4ce-27f3-95f7-3403-000017fae785","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://thehackernews.com/2015/08/elise-malware-hacking.html","pattern":"[url:value = 'http://thehackernews.com/2015/08/elise-malware-hacking.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71719193-881f-a8d5-39e2-0000568db1d8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Zegost.BW","pattern":"[domain-name:value = 'Zegost.BW']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8beb3ec9-9c0e-2c9d-dae2-0000634165c8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Win32.Staser.ytq","pattern":"[domain-name:value = 'Trojan.Win32.Staser.ytq']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f2e1aab-8160-1ae4-7443-00004da00034","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor%3aWin32%2fZegost.BW","pattern":"[url:value = 'https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor%3aWin32%2fZegost.BW']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb916184-8ba0-beed-4426-0000e9a40f7d","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://blog.fortinet.com/2016/08/29/german-speakers-targeted-by-spam-leading-to-ozone-rat","pattern":"[url:value = 'https://blog.fortinet.com/2016/08/29/german-speakers-targeted-by-spam-leading-to-ozone-rat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ac20731-26a0-fb5d-d5d4-0000ebf4ff18","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.crowdstrike.com/blog/whois-anchor-panda/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/whois-anchor-panda/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df27161a-13b7-abc5-af3c-00005c55636b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/04/unit42-new-poison-ivy-rat-variant-targets-hong-kong-pro-democracy-activists/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/04/unit42-new-poison-ivy-rat-variant-targets-hong-kong-pro-democracy-activists/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df237824-140a-234e-b6f0-0000c66480f8","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.Win32.PoisonIvy","pattern":"[domain-name:value = 'Backdoor.Win32.PoisonIvy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52613ab7-3d0d-ecd7-e1a6-00002b7b22de","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml","pattern":"[url:value = 'https://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32418956-2edf-ea8f-fcd9-000077dd459a","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf","pattern":"[url:value = 'https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b3a99bb-56e9-0cd8-cf5c-00005bf2bc95","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.zscaler.com/pdf/whitepapers/msupdater_trojan_whitepaper.pdfx","pattern":"[url:value = 'https://www.zscaler.com/pdf/whitepapers/msupdater_trojan_whitepaper.pdfx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--174e9683-a234-7277-d56f-000003693036","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Inject","pattern":"[domain-name:value = 'Trojan.Inject']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6af4546e-1ce3-e11d-98c0-00001480d62c","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Trojan.Heur.JP.juW","pattern":"[domain-name:value = 'Trojan.Heur.JP.juW']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba705070-ecb4-8b58-d290-0000376e075b","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"domain: Backdoor.FSZO","pattern":"[domain-name:value = 'Backdoor.FSZO']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83083e0b-796f-6b33-54e8-0000b73d3983","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/112/pulling-the-plug-on-plugx","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/112/pulling-the-plug-on-plugx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--774fe025-95af-e729-ca19-000072ed6e3f","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/the-tinbatinybanker-malware/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/the-tinbatinybanker-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f636919-179b-4e99-cae1-000087053d52","created":"2026-08-06T13:13:03-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://thehackernews.com/search/label/Zusy%20Malware","pattern":"[url:value = 'https://thehackernews.com/search/label/Zusy%20Malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:03-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec83e32d-6789-aaea-8d10-0000c501e244","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/crpx0","pattern":"[url:value = 'https://www.ransomlook.io/group/crpx0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8b229c2-bfe9-9488-8fe2-000007744a33","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://crpx0.su/","pattern":"[url:value = 'http://crpx0.su/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6b512bc-b82f-f880-4117-0000fbcd75fc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion/","pattern":"[url:value = 'http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87094932-1bc8-f19f-8c12-00008bfe383f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/redact","pattern":"[url:value = 'https://www.ransomlook.io/group/redact']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a24ce437-824d-ac5c-d0c6-0000902a8d4a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ursba4dbibo27dtwtgy3l2pc3ekut7helebvmy7ny3b2s3mbzph4qdad.onion","pattern":"[url:value = 'http://ursba4dbibo27dtwtgy3l2pc3ekut7helebvmy7ny3b2s3mbzph4qdad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25b7c76d-1f69-779c-d8cb-000065c77a5e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurqowkellytpvj3afh4aid.onion/","pattern":"[url:value = 'http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurqowkellytpvj3afh4aid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94ca680e-3b0c-ecf6-9abe-0000287da231","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sevyware","pattern":"[url:value = 'https://www.ransomlook.io/group/sevyware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9685ead9-2dad-9a84-1e0f-00004f6d274e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sevykkkuzbxjpkb7gtfxnltn73bm6vaxglxh5xsd55trqqew3xpowwid.onion/index.php","pattern":"[url:value = 'http://sevykkkuzbxjpkb7gtfxnltn73bm6vaxglxh5xsd55trqqew3xpowwid.onion/index.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6cdf44b-fab1-d417-a6a5-00001dbcbdcd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/spy","pattern":"[url:value = 'https://www.ransomlook.io/group/spy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6875beef-11ad-265f-c2a9-00000ce1d4de","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://spycorp.pro/","pattern":"[url:value = 'https://spycorp.pro/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ab617df-47fa-f8c5-76a8-00005522a586","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/0day","pattern":"[url:value = 'https://www.ransomlook.io/group/0day']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd8c903f-0465-2a0c-a11c-00004e0ea2af","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://odaygplp3zhyx7zl45egetl6dzc4reduisnoyym34rjdmaryfaz5doqd.onion/","pattern":"[url:value = 'http://odaygplp3zhyx7zl45egetl6dzc4reduisnoyym34rjdmaryfaz5doqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38a56b68-d0df-eb49-4de0-000092073a05","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/settra","pattern":"[url:value = 'https://www.ransomlook.io/group/settra']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdd14fde-8c91-ed87-3361-0000f554eca1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlsztmxj4lqkyohnfdrntqyd.onion/","pattern":"[url:value = 'http://pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlsztmxj4lqkyohnfdrntqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d92c742c-88ed-fd6f-454b-0000bcaa2ae2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zfjkyxx2c536oqdld4kid.onion/","pattern":"[url:value = 'http://c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zfjkyxx2c536oqdld4kid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bafc61c0-8e77-3fcd-99df-0000ad343785","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgxxyspgwzbxkc3uze7jid.onion/","pattern":"[url:value = 'http://ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgxxyspgwzbxkc3uze7jid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0aa19669-bc9a-7377-c6b5-000035ba0be9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://26z3gms2rshr2zzedxhw5fbucilmgt2inhmxzmuhteyztpxohoqplgyd.onion/","pattern":"[url:value = 'http://26z3gms2rshr2zzedxhw5fbucilmgt2inhmxzmuhteyztpxohoqplgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7063238b-0088-99c0-de35-00007304f63c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion/","pattern":"[url:value = 'http://settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c6a395e-6db3-304d-5046-000031b743b4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ulose","pattern":"[url:value = 'https://www.ransomlook.io/group/ulose']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca1a83a5-4a89-2511-f347-0000c609e81d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/icarus","pattern":"[url:value = 'https://www.ransomlook.io/group/icarus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd1b41a0-f8ac-2f99-91fe-00004e09af9b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://e6ujsppajgb756x7x5ykdryvlcjynltb52eiwi6pd4bfwo6hddd6neid.onion/","pattern":"[url:value = 'http://e6ujsppajgb756x7x5ykdryvlcjynltb52eiwi6pd4bfwo6hddd6neid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffe69296-2001-ea2d-51a2-000007f62ec6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bavacai","pattern":"[url:value = 'https://www.ransomlook.io/group/bavacai']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc0539d2-e098-1220-61bb-00000495dd39","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/doommageddon","pattern":"[url:value = 'https://www.ransomlook.io/group/doommageddon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c065ebed-683e-bce6-6b1b-0000d51eb96d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion/","pattern":"[url:value = 'http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--768157fe-e154-fb86-3a4f-000024696327","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cmd","pattern":"[url:value = 'https://www.ransomlook.io/group/cmd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c4cd704-c7e9-06b1-1e3a-0000426cb39d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cmdofficial.com/","pattern":"[url:value = 'https://cmdofficial.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76b68c73-265d-ff8e-1e6e-000017f5522f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion/","pattern":"[url:value = 'http://cmdnkiqjije2tllr3biee2sjgj3i4robg2cbtilbnytdhh2wy3syrlyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5540e673-c267-81db-28e5-0000dc398608","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blackfile","pattern":"[url:value = 'https://www.ransomlook.io/group/blackfile']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa341916-154d-1a17-948f-00005669c76b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://blacknbsxfdmjtx4yn533zzm4bemtdfl6dyopbmhg46ckhn4qy7i77id.onion/","pattern":"[url:value = 'http://blacknbsxfdmjtx4yn533zzm4bemtdfl6dyopbmhg46ckhn4qy7i77id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8136cc1a-11a3-3c57-efef-00004d326e52","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/triple","pattern":"[url:value = 'https://www.ransomlook.io/group/triple']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05717402-8229-dba2-30b3-00009ba36c9d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6qqz6m3b6htudohg2mlf5gdcalonxy3sh5g4dix4mpyirjcgelqqufad.onion","pattern":"[url:value = 'http://6qqz6m3b6htudohg2mlf5gdcalonxy3sh5g4dix4mpyirjcgelqqufad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c07462b6-e430-561b-8c59-000035067bcc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ojcmpbdncjo5dhaxxll44bq6to3kwqtoeraevgsjquhdtt4uv5l4igid.onion/","pattern":"[url:value = 'http://ojcmpbdncjo5dhaxxll44bq6to3kwqtoeraevgsjquhdtt4uv5l4igid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cda5d0e-b105-317e-5f19-000097fb701b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/wallstreet","pattern":"[url:value = 'https://www.ransomlook.io/group/wallstreet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea73ecaf-ab97-9a20-355f-00001d95c37f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/","pattern":"[url:value = 'http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8ab3a2b-6e48-32d9-226a-0000a4c3487e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/booba","pattern":"[url:value = 'https://www.ransomlook.io/group/booba']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8884bd64-5e4e-fe5c-81c5-00000016b116","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onion/","pattern":"[url:value = 'http://7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06c4bf48-3ad6-de75-944d-000075ab2d0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onion/leaks","pattern":"[url:value = 'http://7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onion/leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9810516-5242-9300-e220-00000b15dd36","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/titan","pattern":"[url:value = 'https://www.ransomlook.io/group/titan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a829ab2a-18f9-5403-dd44-0000ceed7b7e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://titanblog.org/","pattern":"[url:value = 'https://titanblog.org/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5df0c2af-18e3-3b2f-0393-00006223187e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/deadlock","pattern":"[url:value = 'https://www.ransomlook.io/group/deadlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef90ff63-7f84-0d72-54d1-0000ddcc5e0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mnt6","pattern":"[url:value = 'https://www.ransomlook.io/group/mnt6']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12f216a4-49c7-3742-f81e-0000652c96e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ttvbuilv5mf2wggfjgmvin22ndzghpukhsyy6coz3p4wt5nqnxah7tyd.onion/","pattern":"[url:value = 'http://ttvbuilv5mf2wggfjgmvin22ndzghpukhsyy6coz3p4wt5nqnxah7tyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52a58bd9-0b6c-781c-9c07-000008e55da4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/prinz","pattern":"[url:value = 'https://www.ransomlook.io/group/prinz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0affdb1-635c-5443-cde2-0000d791f0b0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion/","pattern":"[url:value = 'http://prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bdb51cf-6bee-8f7c-87cb-0000dc24f381","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6cudc5cqa2bjpwdhcwm2lj6dbqejjjqzeo6ipwvmbazr6cgu7vfk3dad.onion/","pattern":"[url:value = 'http://6cudc5cqa2bjpwdhcwm2lj6dbqejjjqzeo6ipwvmbazr6cgu7vfk3dad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3bbf8bb-9393-34a9-5c09-0000bdab551d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/hyflock","pattern":"[url:value = 'https://www.ransomlook.io/group/hyflock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cafe5d58-dff0-4077-c6e9-0000c3c9c66e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://e5hdifgit6ua7k4ggmltume7kbyryksdnlrkc55we33fnshgxfeqgsyd.onion/","pattern":"[url:value = 'http://e5hdifgit6ua7k4ggmltume7kbyryksdnlrkc55we33fnshgxfeqgsyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23434c37-862b-05ec-7aea-0000664ba6bb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/aurora","pattern":"[url:value = 'https://www.ransomlook.io/group/aurora']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ebcc904-84d0-a2ce-39bc-00002b907ecc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://exposedrecords.io/","pattern":"[url:value = 'https://exposedrecords.io/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b80803ae-de41-952f-2d28-00000266ee8d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pavregldzg2ypbd3gxbil2suxfok7ykmcknwhkli24anpks6lndymyyd.onion/","pattern":"[url:value = 'http://pavregldzg2ypbd3gxbil2suxfok7ykmcknwhkli24anpks6lndymyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ea244e0-56fa-6852-03df-0000f159dda5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid.onion/","pattern":"[url:value = 'http://ijexszhscln27nl263lmcd7tx3jttkhm4wjhd4e3y6r4csdbfyeprvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7916bcba-b67e-9747-8ee9-0000801b6af4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/leak","pattern":"[url:value = 'https://www.ransomlook.io/group/leak']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47cffd90-1aaf-6a9c-02d5-0000a3acbdc8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/timc","pattern":"[url:value = 'https://www.ransomlook.io/group/timc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fad7e786-2bb5-98a2-88c7-00001846003a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rzzfiwoop67jrxadngcy7nvjm7suwtrjznview63ooowqfsm5sq7gmqd.onion/","pattern":"[url:value = 'http://rzzfiwoop67jrxadngcy7nvjm7suwtrjznview63ooowqfsm5sq7gmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e3faacf-09a3-6b13-847e-00008c0beda3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/killada","pattern":"[url:value = 'https://www.ransomlook.io/group/killada']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46362c5a-28c6-64e1-8de1-000063d610b9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://killada5556ahpb4cwmatv5qpzku2qmdlwawshtykpq37cvfva7zjhid.onion/","pattern":"[url:value = 'http://killada5556ahpb4cwmatv5qpzku2qmdlwawshtykpq37cvfva7zjhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5a365dc-4f33-1d25-e4af-000027b0e4af","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://killada7qgdpvzpezjxaa64b47bz47hzbn6oql5aa4lppzzwymnukqqd.onion/","pattern":"[url:value = 'http://killada7qgdpvzpezjxaa64b47bz47hzbn6oql5aa4lppzzwymnukqqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c02c255-7fd1-bcd5-e04c-000089c37d09","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://killadahaynpqrkppe2m2tgindbruaeiefzr7pm3cp47tzohhhnogwad.onion/","pattern":"[url:value = 'http://killadahaynpqrkppe2m2tgindbruaeiefzr7pm3cp47tzohhhnogwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f57a17da-0912-4cdf-a250-0000c13be909","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://killadax36r6bbb3md67ekcfv5yasdlnoaklyag66ot4tefa32ywgnyd.onion/","pattern":"[url:value = 'http://killadax36r6bbb3md67ekcfv5yasdlnoaklyag66ot4tefa32ywgnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51b05c0a-ddbe-e1c7-d290-0000248e61fd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://killadaxczzw3wnuaxkygib67lk2qkgnki4gyjqoo76vh53egitoyaqd.onion/","pattern":"[url:value = 'http://killadaxczzw3wnuaxkygib67lk2qkgnki4gyjqoo76vh53egitoyaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b1caf3b-49b6-f7b2-21d6-0000e1d6b3dd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://killadaayyuzdshwskrnsvh5owzuwa4yj7gs2vbhkcjpfslrplfgwwqd.onion/","pattern":"[url:value = 'http://killadaayyuzdshwskrnsvh5owzuwa4yj7gs2vbhkcjpfslrplfgwwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32d325c1-aede-fd42-43bf-00009332ea62","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/audit","pattern":"[url:value = 'https://www.ransomlook.io/group/audit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46c988c7-925f-626b-405a-00007174ad7a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cjg2avmzoly7k6mw7xobnyre354jxro4qegkoazhsmigdk2j3aziexyd.onion/","pattern":"[url:value = 'http://cjg2avmzoly7k6mw7xobnyre354jxro4qegkoazhsmigdk2j3aziexyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a393527-df96-caaf-0f9c-000034405f4f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6tdqqaxftvradka5d2frzgwixis7fmro7rfh4ettzcx7jfapkebe6jad.onion/","pattern":"[url:value = 'http://6tdqqaxftvradka5d2frzgwixis7fmro7rfh4ettzcx7jfapkebe6jad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff5f14e3-fc65-cdb7-37a9-00008aa8b098","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/threatmarket","pattern":"[url:value = 'https://www.ransomlook.io/group/threatmarket']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6bc3104-7628-cb4b-5814-0000f7f51581","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hi6bo2aihmuzkaj6gi6sigmut5bcwvguqpma3hwxsjfbqsccnchmybid.onion/","pattern":"[url:value = 'http://hi6bo2aihmuzkaj6gi6sigmut5bcwvguqpma3hwxsjfbqsccnchmybid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37c15abb-f034-89e5-690c-0000914a1390","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lamashtu","pattern":"[url:value = 'https://www.ransomlook.io/group/lamashtu']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7249c3d7-b38b-4081-68df-000093671bd0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion/api/posts?page=1&filter=all","pattern":"[url:value = 'http://lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion/api/posts?page=1&filter=all']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4626059a-c6a2-a515-bf41-0000ab880976","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion/","pattern":"[url:value = 'http://lamashtux5j74mcm7lwwgn5yrvuwtrpxjoyendif3v3hrztjesfoyayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84f8acca-10a5-dc49-fcd7-0000d99adf77","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/alp-001","pattern":"[url:value = 'https://www.ransomlook.io/group/alp-001']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34a22310-1845-a0e7-66cc-00006e21534f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qthem3ogqqixjhhwacto6pqbjfy2vcykdlz7woulnewsrwy4lfjocfqd.onion/","pattern":"[url:value = 'http://qthem3ogqqixjhhwacto6pqbjfy2vcykdlz7woulnewsrwy4lfjocfqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14c3e0fd-8e3b-63f9-7a66-00001579c5df","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b4riuxx7ypobdptctf6lyfcvgi6vn74iurzdh4kn2agbk7472dvywgyd.onion/index","pattern":"[url:value = 'http://b4riuxx7ypobdptctf6lyfcvgi6vn74iurzdh4kn2agbk7472dvywgyd.onion/index']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--031f5fd2-37ef-224a-4ead-0000ca50e89d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/nblock","pattern":"[url:value = 'https://www.ransomlook.io/group/nblock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a434e2e8-a455-2ea6-e9cb-00001e7ba1c9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nblockn6jjp3xxh2do4ckkcer7w54sube7jdqaq7ttfvucgz6nsi4fad.onion/","pattern":"[url:value = 'http://nblockn6jjp3xxh2do4ckkcer7w54sube7jdqaq7ttfvucgz6nsi4fad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f51fbe8-26fb-323b-d266-0000b8a39d8d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blackwater","pattern":"[url:value = 'https://www.ransomlook.io/group/blackwater']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0651b9e1-d7c3-5613-01cc-0000753d8bac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ejzl7cjxmkx7lzhiqwidmrwtfjv45pkczbc4fnyaut3t7gll3yaiq5id.onion/","pattern":"[url:value = 'http://ejzl7cjxmkx7lzhiqwidmrwtfjv45pkczbc4fnyaut3t7gll3yaiq5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb15319d-1c64-9f5c-9b3b-0000aa3d8def","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6t5g73fbzdjuhvvovuvuhc4mdgefrwn75szssx4ftqzxyuacdij47pad.onion","pattern":"[url:value = 'http://6t5g73fbzdjuhvvovuvuhc4mdgefrwn75szssx4ftqzxyuacdij47pad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bca8862-70ff-97e5-e693-000037ce6326","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/krybit","pattern":"[url:value = 'https://www.ransomlook.io/group/krybit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1e0bc42-3031-3047-16ea-00006f121f0d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion/","pattern":"[url:value = 'http://krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a537b474-ed29-fa8f-604e-00009f9a4b34","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion/","pattern":"[url:value = 'http://krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cca9826b-6e4c-2757-aaf5-0000164b8026","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/","pattern":"[url:value = 'http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6277ef75-1f1f-1bdc-2642-0000b1cbe4cb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/","pattern":"[url:value = 'http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cca8991-266a-a8bc-8bfb-000099579f89","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/m3rx","pattern":"[url:value = 'https://www.ransomlook.io/group/m3rx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b4f4815-bf2a-fd47-0937-00003058bd62","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4k6plf4h2cm2nco6ae3inrsxnmqgl6lllmwefydhnlcq4tuhwbj4qpad.onion/","pattern":"[url:value = 'http://4k6plf4h2cm2nco6ae3inrsxnmqgl6lllmwefydhnlcq4tuhwbj4qpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--214557ea-1ffa-ad5d-ea9d-0000a34f6e75","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pippahtohg6qgioqu3ixrsueefuw7thythmmeanyrgwn3eixcuu6jvqd.onion/","pattern":"[url:value = 'http://pippahtohg6qgioqu3ixrsueefuw7thythmmeanyrgwn3eixcuu6jvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c6d451c-3381-d23b-e4f9-00005f47b903","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/netrunner","pattern":"[url:value = 'https://www.ransomlook.io/group/netrunner']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23f888b7-3d12-e094-1b96-0000745bc575","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://netrunrs65cn2yidokrmxn5rrur2gjpuyuwrt6mkfy6lek4jnqojn4qd.onion/","pattern":"[url:value = 'http://netrunrs65cn2yidokrmxn5rrur2gjpuyuwrt6mkfy6lek4jnqojn4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b1a460b-8c95-a98d-ddab-0000a362bbcd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://netrunrsb3bivj5gnwajzxlig5qkteb6edgthxj7fmsvhkzxtwfxwaad.onion/","pattern":"[url:value = 'http://netrunrsb3bivj5gnwajzxlig5qkteb6edgthxj7fmsvhkzxtwfxwaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aedfdfbd-6c2d-2b6f-f3ea-0000293c3ed6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zetarink","pattern":"[url:value = 'https://www.ransomlook.io/group/zetarink']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d62b3364-38e8-d6fb-b0ea-0000e37fbaf4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5cxxlyurwn2usx5qwtlny7o3r5a5nb46lznelb56w2xuo7x35nbmulyd.onion","pattern":"[url:value = 'http://5cxxlyurwn2usx5qwtlny7o3r5a5nb46lznelb56w2xuo7x35nbmulyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4231b646-ea0a-9e17-dfa4-00006320bd9a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/xp95","pattern":"[url:value = 'https://www.ransomlook.io/group/xp95']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d348076a-38bd-629e-55a5-0000867054ee","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://37lfmtakhknzx5t6k57ieijkiqrc4c3kpimfvrmafva25ut2tknvw3yd.onion/","pattern":"[url:value = 'http://37lfmtakhknzx5t6k57ieijkiqrc4c3kpimfvrmafva25ut2tknvw3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfbbce2f-100a-29d4-86cf-0000ceadd408","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/exitium","pattern":"[url:value = 'https://www.ransomlook.io/group/exitium']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6cca42b-36fd-e31d-6dcd-000098d71b7f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://m3ksukzn2glzfdvlusohril7n3iyk4z4fudf6mm22lwhpbpt5aiee5qd.onion/","pattern":"[url:value = 'http://m3ksukzn2glzfdvlusohril7n3iyk4z4fudf6mm22lwhpbpt5aiee5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f98c6436-f7d1-b822-378d-0000310fbddd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vect","pattern":"[url:value = 'https://www.ransomlook.io/group/vect']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4afeafde-f099-67ac-24f5-000000fb22e3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/","pattern":"[url:value = 'http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6edf775-5dc6-f182-9cec-0000230a064c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://158.94.210.11:8000/","pattern":"[url:value = 'http://158.94.210.11:8000/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fe4d237-942c-6294-0dbb-0000c13b3748","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bu7zr6fotni3qxxoxlcmpikwtp5mjzy7jkxt7akflnm2kwkbdtgtjuid.onion/","pattern":"[url:value = 'http://bu7zr6fotni3qxxoxlcmpikwtp5mjzy7jkxt7akflnm2kwkbdtgtjuid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a99c2f1c-a15e-c978-f571-00000aeff811","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lsd","pattern":"[url:value = 'https://www.ransomlook.io/group/lsd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d253403d-4c00-ee4e-83d3-0000dade7cf4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://t.me/rewreglsd","pattern":"[url:value = 'http://t.me/rewreglsd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ecf7d72-4208-c28c-1a49-000032492104","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/reynolds","pattern":"[url:value = 'https://www.ransomlook.io/group/reynolds']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--669c73b3-46bf-8eca-2c33-0000cec5f0db","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ironchain","pattern":"[url:value = 'https://www.ransomlook.io/group/ironchain']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a165458-a85c-ddcb-b396-0000bcda17dd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion","pattern":"[url:value = 'http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0836d5a4-31c1-d47d-c26d-000019f214d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/payload","pattern":"[url:value = 'https://www.ransomlook.io/group/payload']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8aea396b-777d-d50e-7cdc-0000feafe739","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://payload6eualw6kni6v2lqn7ovjcl76ojx25z5unsyvqo3lbqy3bo5qd.onion/","pattern":"[url:value = 'http://payload6eualw6kni6v2lqn7ovjcl76ojx25z5unsyvqo3lbqy3bo5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b01d50bb-adbd-dca5-e7bb-0000e4c06562","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kittykatkrew","pattern":"[url:value = 'https://www.ransomlook.io/group/kittykatkrew']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcf206e7-4e0f-2489-7bb4-00005d32b7c1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vs6ccwled72hwmescxr2e32mmfrm6vbqbo7gbmmkxnu7g5fps7ndeeyd.onion/","pattern":"[url:value = 'http://vs6ccwled72hwmescxr2e32mmfrm6vbqbo7gbmmkxnu7g5fps7ndeeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99aab398-1c16-590e-d966-0000fe9d1bf2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/shadowbyt3$","pattern":"[url:value = 'https://www.ransomlook.io/group/shadowbyt3$']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01cfe3bc-d9f2-37a2-a30a-000046ba3dd5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion/","pattern":"[url:value = 'http://shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a00ace0-acf8-0022-2757-00005f266691","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad.onion/leaks.php","pattern":"[url:value = 'http://sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad.onion/leaks.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3024f218-0752-2b7f-8e65-0000fccad0b8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://45.84.0.211","pattern":"[url:value = 'http://45.84.0.211']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ddf502a-b810-9fb4-293f-00006d7b1484","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://shadoz22.io/","pattern":"[url:value = 'http://shadoz22.io/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94db54d2-1969-d37c-60f1-0000b5ad3768","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://shadowsblog.cloud-ip.cc/","pattern":"[url:value = 'https://shadowsblog.cloud-ip.cc/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62cb0329-e45d-736c-7fa7-0000e4717058","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://shadowbyt3s.8bit.ca/index.php","pattern":"[url:value = 'https://shadowbyt3s.8bit.ca/index.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e781dc3-77ac-c449-11cb-0000c62df8fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/insomnia","pattern":"[url:value = 'https://www.ransomlook.io/group/insomnia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd52475d-e5d4-5246-054f-0000aa4f119a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r3keoxye5mki4fqcvlk4hpfqqzxmakchjpmem7oppynobcieamdbmcyd.onion/","pattern":"[url:value = 'http://r3keoxye5mki4fqcvlk4hpfqqzxmakchjpmem7oppynobcieamdbmcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff286f8e-fa43-0526-deb7-0000c80dac49","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cipherforce","pattern":"[url:value = 'https://www.ransomlook.io/group/cipherforce']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6f235ce-04a5-804d-88d5-00009ec5afa4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://22evxpggnkyrxpluewqsrv5j4jtde6hut2peq3w44d6ase676qlkoead.onion/","pattern":"[url:value = 'http://22evxpggnkyrxpluewqsrv5j4jtde6hut2peq3w44d6ase676qlkoead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29d5687c-0d92-bbc9-806f-0000f2001347","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://o3ydbkayttkyg4iw2nc732jxmmex25bjeyqyvuuyngnxmpehdefjr3qd.onion/","pattern":"[url:value = 'http://o3ydbkayttkyg4iw2nc732jxmmex25bjeyqyvuuyngnxmpehdefjr3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0938183b-dc01-1181-e7cf-000076516f11","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://scbrksw5fgjtujc2ah42roo6bij2unr2tggfcynpbql5a7yp3s22taid.onion:8000/","pattern":"[url:value = 'http://scbrksw5fgjtujc2ah42roo6bij2unr2tggfcynpbql5a7yp3s22taid.onion:8000/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb7967b3-727b-ebdb-2f85-0000300b31a4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://scbrksw5fgjtujc2ah42roo6bij2unr2tggfcynpbql5a7yp3s22taid.onion/","pattern":"[url:value = 'http://scbrksw5fgjtujc2ah42roo6bij2unr2tggfcynpbql5a7yp3s22taid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f97aa6a-5fa2-9ec9-2079-00008bb55953","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blackfield","pattern":"[url:value = 'https://www.ransomlook.io/group/blackfield']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--373fffcf-ad28-53d9-0f47-00004bc744ab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xcou7t6a4qlecsr7ipmxlwsseghxbebqltnxwaurxx3bbsbts7ljacqd.onion/","pattern":"[url:value = 'http://xcou7t6a4qlecsr7ipmxlwsseghxbebqltnxwaurxx3bbsbts7ljacqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6049050e-2be3-3d20-4efb-00008c9f65b5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/monolock","pattern":"[url:value = 'https://www.ransomlook.io/group/monolock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a01e1781-c7ec-f30f-3f03-0000eb0d8d4c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://mlock.tel/","pattern":"[url:value = 'https://mlock.tel/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddab46db-b13f-3c5a-3c20-0000928d0d41","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bravox","pattern":"[url:value = 'https://www.ransomlook.io/group/bravox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7684d63b-a6fd-01a6-acae-0000e1ff6a09","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bravoxxwcfz5qk43ychgveprpd5mw5hvxfs4a2uz2okx7mumiht4fzyd.onion/","pattern":"[url:value = 'http://bravoxxwcfz5qk43ychgveprpd5mw5hvxfs4a2uz2okx7mumiht4fzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74b576e7-7d1b-715d-d171-00009ab51a8c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bravoxxtrmqeeevhl7gdh2yzvlrjxajr66d33c7ozosrccx4cz7cepad.onion/","pattern":"[url:value = 'http://bravoxxtrmqeeevhl7gdh2yzvlrjxajr66d33c7ozosrccx4cz7cepad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f79fdc56-e84c-a15c-e315-0000d17a139d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/clearwater","pattern":"[url:value = 'https://www.ransomlook.io/group/clearwater']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f84bb21-d96d-3b98-7922-0000201d591c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b6rgpykvtyqah4q5tii25ouevr5g3u2s7pqc24jdlyhrfms3itljtkqd.onion/","pattern":"[url:value = 'http://b6rgpykvtyqah4q5tii25ouevr5g3u2s7pqc24jdlyhrfms3itljtkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d97c4c9-6c5f-c3f5-fdfa-0000abf5fc91","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/aware","pattern":"[url:value = 'https://www.ransomlook.io/group/aware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5b488ac-cbb1-8304-4a1a-00001b4284d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ui2uleaiisccbtcooyi34cy5u3plpd5wraiza6wtibolshuf7tnzziid.onion/","pattern":"[url:value = 'http://ui2uleaiisccbtcooyi34cy5u3plpd5wraiza6wtibolshuf7tnzziid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3d46eb6-05ed-8544-4d1f-00004f65975b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/orion","pattern":"[url:value = 'https://www.ransomlook.io/group/orion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12b0401d-ccba-91e9-5d09-0000db908916","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid.onion/","pattern":"[url:value = 'http://cjfntkj5qeizxowuy3srceg7zo6namc3kfeor7pfn6bpdkl3w265ooid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a20004f-1f67-16e7-f468-0000b4deaf91","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/fletchen","pattern":"[url:value = 'https://www.ransomlook.io/group/fletchen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--003bb14e-dc52-2ed1-01ae-0000c2a793b9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/shinyhunters","pattern":"[url:value = 'https://www.ransomlook.io/group/shinyhunters']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e483294-2e73-a468-5678-00009b1bc87f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://91.215.85.103/","pattern":"[url:value = 'https://91.215.85.103/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6f8960e-1721-685c-422d-00006a953ff0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://176.120.22.24/","pattern":"[url:value = 'https://176.120.22.24/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11e92340-5a01-10d6-f9e0-0000e393e5c2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://91.202.233.104/","pattern":"[url:value = 'https://91.202.233.104/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23850060-fb60-117a-92ab-00002173f902","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://shinyhunte.rs/","pattern":"[url:value = 'https://shinyhunte.rs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4ecc0f5-e020-d54b-1289-0000253f8d3c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://91.215.85.22/","pattern":"[url:value = 'http://91.215.85.22/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bc6ef59-7869-b15c-c5d5-00003cfad86c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion/","pattern":"[url:value = 'http://toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21158a99-b173-1896-00f0-0000aa0552da","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/0apt","pattern":"[url:value = 'https://www.ransomlook.io/group/0apt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37b85d3b-96a5-0890-3317-000016e7574f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lynxr","pattern":"[url:value = 'https://www.ransomlook.io/group/lynxr']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--246627dd-d4a6-f637-96c8-00000f3395e1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/waissbein","pattern":"[url:value = 'https://www.ransomlook.io/group/waissbein']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--407edc3a-6481-af17-527e-000047baf380","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://syympi25sxgm55kyk5wkktns2why6q3ubscpnwqxepdkrmifxjvjd7qd.onion/","pattern":"[url:value = 'http://syympi25sxgm55kyk5wkktns2why6q3ubscpnwqxepdkrmifxjvjd7qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7d93762-4579-b30d-f804-0000d02d9053","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://samu747og2fgxujardbhkp5f5dkoprzyeithz4ob3g5dfvdvmzvp23yd.onion/","pattern":"[url:value = 'http://samu747og2fgxujardbhkp5f5dkoprzyeithz4ob3g5dfvdvmzvp23yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e17530-a9f3-fb32-7199-00005558ff07","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cipherwolf","pattern":"[url:value = 'https://www.ransomlook.io/group/cipherwolf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bd97e7b-a835-080c-53b6-0000e261fc5c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b63zgpxrwqttrr6ti3jvvezqdzahuirkkjuundu26gz4krtrrkncqjad.onion","pattern":"[url:value = 'http://b63zgpxrwqttrr6ti3jvvezqdzahuirkkjuundu26gz4krtrrkncqjad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33a6b1c4-75cc-7da0-4b93-0000a0bbe225","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/benzona","pattern":"[url:value = 'https://www.ransomlook.io/group/benzona']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b135b6c9-5ba2-e6e6-61df-00008e2425cd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wor3mnvotoznof5puzoa35y4bwgtozqe3bae2rpkxmz5dai4xqbcbyad.onion/","pattern":"[url:value = 'http://wor3mnvotoznof5puzoa35y4bwgtozqe3bae2rpkxmz5dai4xqbcbyad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d543dd1d-d3ac-911f-9956-00003bcbde20","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cpjhb63lxycwbyus2n35ddyhdzxhf756l4rtwdttojzhzgppt3vpmsqd.onion/","pattern":"[url:value = 'http://cpjhb63lxycwbyus2n35ddyhdzxhf756l4rtwdttojzhzgppt3vpmsqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdb880a1-a497-0b70-4d29-0000d2f5d1f1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://benzona6x5ggng3hx52h4mak5sgx5vukrdlrrd3of54g2uppqog2joyd.onion/","pattern":"[url:value = 'http://benzona6x5ggng3hx52h4mak5sgx5vukrdlrrd3of54g2uppqog2joyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71bf7597-78d7-fe6d-88ad-000005bcc804","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rwsu75mtgj5oiz3alkfpnxnopcbiqed6wllyoffpuruuu6my6imjzuqd.onion/","pattern":"[url:value = 'http://rwsu75mtgj5oiz3alkfpnxnopcbiqed6wllyoffpuruuu6my6imjzuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24ad00e6-3d5e-b74c-5347-0000f17e36cd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sicari","pattern":"[url:value = 'https://www.ransomlook.io/group/sicari']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39f65c71-6d7b-0e80-20e2-0000e3950281","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sicarinb4ktqcdpubjifzw3vixvzgtwacjmc5ks56kev52gxitegigad.onion","pattern":"[url:value = 'http://sicarinb4ktqcdpubjifzw3vixvzgtwacjmc5ks56kev52gxitegigad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b65d72a8-4dcc-df3d-ccd0-00002bce7ffd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sicariktdbhjtrk6f2pwdh6wlequw7pcjva25skkzz4m3zz3opyox3qd.onion","pattern":"[url:value = 'http://sicariktdbhjtrk6f2pwdh6wlequw7pcjva25skkzz4m3zz3opyox3qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78d5b8f8-18c8-5541-452a-000095046555","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sicari7m63wlggfxajiuonfsk72fgencne5ztzakyuhfxzq5rnbkjead.onion","pattern":"[url:value = 'http://sicari7m63wlggfxajiuonfsk72fgencne5ztzakyuhfxzq5rnbkjead.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07c16a52-b43e-7fcf-9e68-0000e83fce7c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sicarilxx2br6esqnhad4w26bcgb5j2snbbnhyo4b6t7kby2oy4x3jad.onion","pattern":"[url:value = 'http://sicarilxx2br6esqnhad4w26bcgb5j2snbbnhyo4b6t7kby2oy4x3jad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e42fe266-cbe4-1686-ec8a-00007fb55eef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sicariifoucvhyqg54smi3esg5sfcyw5z65t6yigqu4loyuoz62bb2id.onion","pattern":"[url:value = 'http://sicariifoucvhyqg54smi3esg5sfcyw5z65t6yigqu4loyuoz62bb2id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b03fd8d-3695-3bb0-ebba-00002580031c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/tridentlocker","pattern":"[url:value = 'https://www.ransomlook.io/group/tridentlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d8ab33c-9a71-ef0c-142a-00001b82ce42","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/minteye","pattern":"[url:value = 'https://www.ransomlook.io/group/minteye']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0f1da26-9ec0-7dde-d020-000079db9053","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kazu","pattern":"[url:value = 'https://www.ransomlook.io/group/kazu']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8d81738-3a13-60a4-72b5-000053852f4e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6czlbd2jfiy6765fbnbnzuwuqocg57ebvp3tbm35kib425k4qnmiiiqd.onion/","pattern":"[url:value = 'http://6czlbd2jfiy6765fbnbnzuwuqocg57ebvp3tbm35kib425k4qnmiiiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2f8ec24-1c33-8b98-0ef8-00008a9f6dbe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://darkshiz4d5ayumjvgbdhchwc7oeuc5jgbqkkgr2jj3ga5nvpjsswdad.onion","pattern":"[url:value = 'http://darkshiz4d5ayumjvgbdhchwc7oeuc5jgbqkkgr2jj3ga5nvpjsswdad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46be093c-2bc4-8add-1a33-0000241c7cde","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cry0","pattern":"[url:value = 'https://www.ransomlook.io/group/cry0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3e4d249-b70c-c5d2-e296-00009f5472ce","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pwn3dky35tub4ktj5bolc72oezg6qc3jvmbogaiwwkimiqtbbokyhrid.onion/","pattern":"[url:value = 'http://pwn3dky35tub4ktj5bolc72oezg6qc3jvmbogaiwwkimiqtbbokyhrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1637e1b2-4ba2-6a19-065d-0000cd740864","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cryoblogedawivdcknyd4jsjxkrx3xrqqltxla6wwjjnzm3f3jaxjzqd.onion/","pattern":"[url:value = 'http://cryoblogedawivdcknyd4jsjxkrx3xrqqltxla6wwjjnzm3f3jaxjzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f608288-c9ba-b5c0-5380-00005f579458","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/osiris","pattern":"[url:value = 'https://www.ransomlook.io/group/osiris']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6917fd6e-d72e-d55b-1333-000094feb9da","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/rest/blog/posts?offset=0&limit=10&search=","pattern":"[url:value = 'https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/rest/blog/posts?offset=0&limit=10&search=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e96b6d-f2e7-20a3-5073-0000eba6f509","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/app/publications","pattern":"[url:value = 'https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/app/publications']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a294d649-d160-58a3-199d-0000ab3dc687","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ausare.net","pattern":"[url:value = 'http://ausare.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a74f2bc8-b9f8-3b98-8db8-0000fbd92399","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/","pattern":"[url:value = 'https://osirisbm3357xrccnid23nlyuqwzbgqheaei6dxvyi34tbkqr3bmvfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a741ff64-c6cf-f1df-5f70-00002957aa81","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/rustylocker","pattern":"[url:value = 'https://www.ransomlook.io/group/rustylocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b460e863-f431-ad47-7224-000065f228df","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustyzoc5hc2mre56ug7lacant25o2gepoto3vghiajll4uw6cotmnqd.onion","pattern":"[url:value = 'http://rustyzoc5hc2mre56ug7lacant25o2gepoto3vghiajll4uw6cotmnqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b0d4661-9844-6784-baf4-000065f1708c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustywua527xyupr5vqqaigvjgnkvibp3ugv2utjx7zoopat7yzfpgqd.onion","pattern":"[url:value = 'http://rustywua527xyupr5vqqaigvjgnkvibp3ugv2utjx7zoopat7yzfpgqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee105523-9179-db07-7b2b-00001406048c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustyvkrpehhq7x2ellti6oa43mwwvdpsf3e7maddkhtmjxfgyp2rjqd.onion","pattern":"[url:value = 'http://rustyvkrpehhq7x2ellti6oa43mwwvdpsf3e7maddkhtmjxfgyp2rjqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d47e363-8b36-962e-3dc4-0000230c4456","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustyunet6zp35koogizqixpnn66fcz6ilosugnydhso6r6uerlgfzyd.onion","pattern":"[url:value = 'http://rustyunet6zp35koogizqixpnn66fcz6ilosugnydhso6r6uerlgfzyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc37572c-26a5-2d21-1f54-00008866947a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustyshyjstdvkiffwl4pif7f6jrpzmhcnv2qcrtxn4ivnn2berxreid.onion","pattern":"[url:value = 'http://rustyshyjstdvkiffwl4pif7f6jrpzmhcnv2qcrtxn4ivnn2berxreid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0530f06d-ea39-d9a0-a774-0000861cccc9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustyr2t5slcn66cnbiawdmledjyog5ywlh2jnbmtejflxnel4h3dwyd.onion","pattern":"[url:value = 'http://rustyr2t5slcn66cnbiawdmledjyog5ywlh2jnbmtejflxnel4h3dwyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--110bfa97-c30a-402b-632f-000075ab3b75","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustypiwiusst2zptoervivs4x3i2vvabd7jok5j5wae6upjdyxt5eid.onion","pattern":"[url:value = 'http://rustypiwiusst2zptoervivs4x3i2vvabd7jok5j5wae6upjdyxt5eid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d6f78f5-e0eb-1e6c-92a6-00007d927b8f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustynosqxg6f4rurkfj5qjplvcxgmxcq55e5uv4tvtrp4wgaz6ycqid.onion","pattern":"[url:value = 'http://rustynosqxg6f4rurkfj5qjplvcxgmxcq55e5uv4tvtrp4wgaz6ycqid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20ddce64-522d-fe98-f8aa-000016b372db","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustyi5lcri2qaulc4g3l3itk6h4q47bu2kmxglqaihp52vzub7b27yd.onion","pattern":"[url:value = 'http://rustyi5lcri2qaulc4g3l3itk6h4q47bu2kmxglqaihp52vzub7b27yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bafb795-8540-f297-4c37-0000e243b9c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustyfso7zdjlhf3ukdj34pvq6gjnlz3ci6cyv5wun53ilzvvjo4bdad.onion","pattern":"[url:value = 'http://rustyfso7zdjlhf3ukdj34pvq6gjnlz3ci6cyv5wun53ilzvvjo4bdad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ac94cdc-76ba-15e8-e054-0000ce91f3dd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustye6pskjsu5vo2wlxg24ir3esf6jzcis7asgfgqltja6nr5cvjlad.onion","pattern":"[url:value = 'http://rustye6pskjsu5vo2wlxg24ir3esf6jzcis7asgfgqltja6nr5cvjlad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e531021d-d7d6-b48b-14a9-0000836017d0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustyb2uj3aceqsouwei6rgrwvcpnwv7w4fkl5jdntryquabx4nlygyd.onion","pattern":"[url:value = 'http://rustyb2uj3aceqsouwei6rgrwvcpnwv7w4fkl5jdntryquabx4nlygyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77ed1144-a705-2c2a-96e3-00000e87dd10","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rustydl5ak6p6ajqnja6qzkxvp5huhe4olpdsq5oy75ea4o34aalpkqd.onion/","pattern":"[url:value = 'http://rustydl5ak6p6ajqnja6qzkxvp5huhe4olpdsq5oy75ea4o34aalpkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7cc39bb-f83c-0cac-cc67-0000a12b57a9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/root","pattern":"[url:value = 'https://www.ransomlook.io/group/root']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33db0c65-6114-44ba-3477-000007de0806","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/spirigatito","pattern":"[url:value = 'https://www.ransomlook.io/group/spirigatito']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--586e89ce-9cd2-8007-4644-00002f0c91e1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ms13-089","pattern":"[url:value = 'https://www.ransomlook.io/group/ms13-089']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de405982-796a-b5a3-b64d-00000b622d13","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://chatmsuppxeoma533636ga3g5k56wlyl3zvycya35nhgoktrtg7wgzyd.onion/home","pattern":"[url:value = 'http://chatmsuppxeoma533636ga3g5k56wlyl3zvycya35nhgoktrtg7wgzyd.onion/home']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29ee3d39-9af7-bc09-5549-0000f2961c59","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://msleakjir7pxbe6onlqe5uwgvdmy6nq4mnwfy7ojswbhnleenm77vgad.onion/","pattern":"[url:value = 'http://msleakjir7pxbe6onlqe5uwgvdmy6nq4mnwfy7ojswbhnleenm77vgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6ec3395-d75f-7562-b23d-00005279f410","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/fulcrumsec","pattern":"[url:value = 'https://www.ransomlook.io/group/fulcrumsec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e63504a-5ab5-0485-4496-0000e77b2060","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fulcrumsec.vg/","pattern":"[url:value = 'http://fulcrumsec.vg/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--939682d0-0bf8-1a0a-5199-00006926bcb5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4e3p3in2bl67hxchuwza7qvnpe7pyeloyztr5fnh257fxkovfhappjyd.onion/","pattern":"[url:value = 'http://4e3p3in2bl67hxchuwza7qvnpe7pyeloyztr5fnh257fxkovfhappjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cf4d245-669c-1ea8-cae9-00008bf99b61","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gsgot6tua7ffammwdv6vpxkog32b4z7qivtqkxz55afq2hkt2o24w5yd.onion/","pattern":"[url:value = 'http://gsgot6tua7ffammwdv6vpxkog32b4z7qivtqkxz55afq2hkt2o24w5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0206431-9ebb-6205-adf5-0000eb2044a2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/genesis","pattern":"[url:value = 'https://www.ransomlook.io/group/genesis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d6e6391-48fa-93ec-de09-0000ec7de37f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion/","pattern":"[url:value = 'http://genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--898b4c05-023c-037b-8dc5-0000d41bdd6d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zircon","pattern":"[url:value = 'https://www.ransomlook.io/group/zircon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f7331b3-ef07-27a8-6615-00003c3f22ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zircon7g4qp46d3gjhejbgxnqwzebcjqs2wkke5pxeux4rrgvbuoulqd.onion","pattern":"[url:value = 'http://zircon7g4qp46d3gjhejbgxnqwzebcjqs2wkke5pxeux4rrgvbuoulqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f41d49de-e8c4-1050-d28f-000031dcc5f5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/punisher","pattern":"[url:value = 'https://www.ransomlook.io/group/punisher']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec9b4703-d89a-5639-6e2f-00002ed56815","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jh3zjsqgqk5woyuls7dxgdtorcycjx3i3sgdqpwdbiizunb5vbmppiid.onion/","pattern":"[url:value = 'http://jh3zjsqgqk5woyuls7dxgdtorcycjx3i3sgdqpwdbiizunb5vbmppiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b0651be-450d-50ae-3619-000071755f0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/quicklock","pattern":"[url:value = 'https://www.ransomlook.io/group/quicklock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb06d967-2f5c-d2e6-826f-0000007743a3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dmkhn64rhzqtys7rns6zhtfgqyfbenrvwyaqi7lkvxhlj5yxbh2l54yd.onion","pattern":"[url:value = 'http://dmkhn64rhzqtys7rns6zhtfgqyfbenrvwyaqi7lkvxhlj5yxbh2l54yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--017a7634-44b4-62d2-8005-00001ea14eb1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/brotherhood","pattern":"[url:value = 'https://www.ransomlook.io/group/brotherhood']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c956198b-ea89-4b93-d6cc-0000001eecdf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://n5yiabvtytglkrpvxgultoekllhpivoshu5glizwxvtvk4fkymdr6uqd.onion/","pattern":"[url:value = 'http://n5yiabvtytglkrpvxgultoekllhpivoshu5glizwxvtvk4fkymdr6uqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fdc0a46-3d9a-4558-de09-0000f5ebc286","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tb2utalqu7qwyk33o7hccjoszprt6fsrpggrbwwzi72bu6f5wocqqhyd.onion/","pattern":"[url:value = 'http://tb2utalqu7qwyk33o7hccjoszprt6fsrpggrbwwzi72bu6f5wocqqhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ed54167-0f80-322e-80c0-0000a635c01a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://eyh7wketm3dwqadwfv5dti3yewbr7smrepmavshjfohhc6qwub44knqd.onion/","pattern":"[url:value = 'http://eyh7wketm3dwqadwfv5dti3yewbr7smrepmavshjfohhc6qwub44knqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df453a04-4cb6-8d23-c344-0000d06086cb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cxhu5iruoa3vkmn4blslh4qzabs6jzk26esxnngzjdlquo2beu2nrhyd.onion/","pattern":"[url:value = 'http://cxhu5iruoa3vkmn4blslh4qzabs6jzk26esxnngzjdlquo2beu2nrhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb073481-c5e8-63a0-51ba-000031cf52a6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4n6h3qqewk6dlqribjmw64al5szeuyhcbbfoar37p3yr43hz365nwnyd.onion/","pattern":"[url:value = 'http://4n6h3qqewk6dlqribjmw64al5szeuyhcbbfoar37p3yr43hz365nwnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd7a8c55-652c-67c9-4c9d-0000b9e7e62d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lashkbx7rkjrvrhkch3oit37tg5dlzjx5eyo3scnmox7sg2v4nmldaad.onion/","pattern":"[url:value = 'http://lashkbx7rkjrvrhkch3oit37tg5dlzjx5eyo3scnmox7sg2v4nmldaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7c25876-f9dc-d47a-1057-0000a302252b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2lb5n6bqncc4lu4grm46cpoqrq3yyuriyfzdwlemuajj6x6jbbsgrbqd.onion/","pattern":"[url:value = 'http://2lb5n6bqncc4lu4grm46cpoqrq3yyuriyfzdwlemuajj6x6jbbsgrbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcb6804b-8f1b-8ed5-898c-00009138a9c1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sj2wws6vnambuzjbvaqy5tyg6hp4mm2nwyc4wne356exwzgq6ayrjhqd.onion/","pattern":"[url:value = 'http://sj2wws6vnambuzjbvaqy5tyg6hp4mm2nwyc4wne356exwzgq6ayrjhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1952fa46-03b2-49b2-34a1-0000eb578d2a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uwwia3msl6b7ykekgbr7xxnxmpkq7wpgqze5vu7phzkm5eaeueoxtcad.onion/","pattern":"[url:value = 'http://uwwia3msl6b7ykekgbr7xxnxmpkq7wpgqze5vu7phzkm5eaeueoxtcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d32d52f-cdb7-de5a-1c8f-0000f3ff2424","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x2z7lngyalgei4zeerq5h3esvtnzisxdljjocqa6555qpivi3cmlrgyd.onion/","pattern":"[url:value = 'http://x2z7lngyalgei4zeerq5h3esvtnzisxdljjocqa6555qpivi3cmlrgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--824eeae8-a9e0-e0be-ab55-00006672b3c5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://azgepwfm4g4btbnf2qmc7qtniuqw3wqtpahqmzisnkcvfwdbl6izwsad.onion/","pattern":"[url:value = 'http://azgepwfm4g4btbnf2qmc7qtniuqw3wqtpahqmzisnkcvfwdbl6izwsad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b7a00fc-556b-b1e0-7c76-0000f8785763","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xwhzg446dgqx4ofxtidnjihugtii2ydebe6e33m7njzcql5qvkgpv3qd.onion/","pattern":"[url:value = 'http://xwhzg446dgqx4ofxtidnjihugtii2ydebe6e33m7njzcql5qvkgpv3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd8424ae-2565-c9cc-1b88-00003cad93a6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://a5wdkdd7unaacdlzcjm5javijatjwkkp726diotek3dvvaibqt7s4yqd.onion/","pattern":"[url:value = 'http://a5wdkdd7unaacdlzcjm5javijatjwkkp726diotek3dvvaibqt7s4yqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e835b730-6faf-05e8-37c7-00002d2a5c8a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fotxzhnoxtkpa6cwkimysoiy6o3ostmekoa3k6sy6ka5a7nuwddjciqd.onion/","pattern":"[url:value = 'http://fotxzhnoxtkpa6cwkimysoiy6o3ostmekoa3k6sy6ka5a7nuwddjciqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b438d3f7-ab08-d8c1-058f-0000c6ea0e0d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://brohoodyaifh2ptccph5zfljyajjabwjjo4lg6gfp4xb6ynw5w7ml6id.onion/","pattern":"[url:value = 'http://brohoodyaifh2ptccph5zfljyajjabwjjo4lg6gfp4xb6ynw5w7ml6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ed9f262-adbe-95f7-e64e-000066a0b381","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/tengu","pattern":"[url:value = 'https://www.ransomlook.io/group/tengu']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcaf7532-abf9-2627-a21f-0000c7b84766","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://longvqprqrb4zbxooswz4upefhtikhnyqv4gw4fkzpkc2wjpvxsucwid.onion/","pattern":"[url:value = 'http://longvqprqrb4zbxooswz4upefhtikhnyqv4gw4fkzpkc2wjpvxsucwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e807f8f-6bb7-b5ed-495c-00005b00ff94","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://longjr5sl6a57ajn52nysmvgobmb7lktjthssmt2jeyjagk3rw36djyd.onion/","pattern":"[url:value = 'http://longjr5sl6a57ajn52nysmvgobmb7lktjthssmt2jeyjagk3rw36djyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cd850fe-857d-f272-ac17-0000799f1c4a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://longhbqhzlv3p7tvx3iwhfizkmtkm2nhnlbw5d4qr65wjz5e6aa23mid.onion/","pattern":"[url:value = 'http://longhbqhzlv3p7tvx3iwhfizkmtkm2nhnlbw5d4qr65wjz5e6aa23mid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8089ad17-d182-1db2-6cb6-000062d209fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://longf6faa6tiudn5n6ar77z5balign2cxo2tjfsxuf6wnlzjamqew2yd.onion/","pattern":"[url:value = 'http://longf6faa6tiudn5n6ar77z5balign2cxo2tjfsxuf6wnlzjamqew2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f37c95e-5afa-469d-b9f5-000030d18f83","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://longejh5gj5igfinj36rmqt2ydx2vun6zmditi3ij6hebawnn4xucqad.onion/","pattern":"[url:value = 'http://longejh5gj5igfinj36rmqt2ydx2vun6zmditi3ij6hebawnn4xucqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91e7052d-daf3-077d-edba-000087fa1312","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://longcc4fqrfcqt5lzceutylaxir6h66fp6df3oin6mvwvz6pfdbxc6qd.onion/","pattern":"[url:value = 'http://longcc4fqrfcqt5lzceutylaxir6h66fp6df3oin6mvwvz6pfdbxc6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87669949-f28d-601c-7967-00008f6f0658","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fuvodyoktsjdwu3mrbbrmdsmtblkxau6l7r5dygfwgzhf36mabjtcjad.onion","pattern":"[url:value = 'http://fuvodyoktsjdwu3mrbbrmdsmtblkxau6l7r5dygfwgzhf36mabjtcjad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ff26218-132d-5dc9-97f4-0000e23b2dec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/nasir","pattern":"[url:value = 'https://www.ransomlook.io/group/nasir']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53a2a0ec-f4a6-cb58-49ad-0000c2511214","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yzcpwxuhbkyjnyn4qsf4o5dkvu6m2fyo7dwizmnlutanlmzlos7pa6qd.onion/","pattern":"[url:value = 'http://yzcpwxuhbkyjnyn4qsf4o5dkvu6m2fyo7dwizmnlutanlmzlos7pa6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff41615a-3045-e792-71e2-0000e860c5d7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kryptos","pattern":"[url:value = 'https://www.ransomlook.io/group/kryptos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73ee1453-b58d-3e73-f979-0000f390cd1e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kyber","pattern":"[url:value = 'https://www.ransomlook.io/group/kyber']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0be388ff-4641-5735-6929-000080b7d0c9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tp7e2ekeoqqozyq2t3oy53tzbybvg6ehtinc7kjowtpvbkssprkdmuid.onion/","pattern":"[url:value = 'http://tp7e2ekeoqqozyq2t3oy53tzbybvg6ehtinc7kjowtpvbkssprkdmuid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61bda811-d323-be29-fa46-00003a9c7558","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mlnmlnnrdhcaddwll4zqvfd2vyqsgtgj473gjoehwna2v4sizdukheyd.onion","pattern":"[url:value = 'http://mlnmlnnrdhcaddwll4zqvfd2vyqsgtgj473gjoehwna2v4sizdukheyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fbbf83d-f80e-3ed9-c556-0000581332b3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/scattered","pattern":"[url:value = 'https://www.ransomlook.io/group/scattered']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9fb8c3f-8c53-8b25-2037-000066181b69","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion/","pattern":"[url:value = 'http://shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e3f6c23-2565-8510-689e-0000b153b4ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/miga","pattern":"[url:value = 'https://www.ransomlook.io/group/miga']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc5dc168-9c46-1ed1-3ff7-0000758914cc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://q7gmt7pbo4rrt27ydkiv2kxd7cimhztq2x7hzd557jthhu5zp6ujieid.onion/","pattern":"[url:value = 'http://q7gmt7pbo4rrt27ydkiv2kxd7cimhztq2x7hzd557jthhu5zp6ujieid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0b6462d-8ca8-eca0-c9a9-000040c26e87","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/radiant","pattern":"[url:value = 'https://www.ransomlook.io/group/radiant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01c3d209-c9bb-e66b-78e4-00004ac44ab7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://trfqksm6peaeyz4q6egxbij5n2ih6zrg65of4kwasrejc7hnw2jtxryd.onion/","pattern":"[url:value = 'http://trfqksm6peaeyz4q6egxbij5n2ih6zrg65of4kwasrejc7hnw2jtxryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e204171c-0186-e893-b6c8-0000e3a45fd7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/white","pattern":"[url:value = 'https://www.ransomlook.io/group/white']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1c78bdd-f6c0-fba1-4f1d-0000ac50f58f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l3e4ct2egnlfz4ymexwn66jlz55vrnnn72ub4u3xqdjcp7xel5hpbzqd.onion/","pattern":"[url:value = 'http://l3e4ct2egnlfz4ymexwn66jlz55vrnnn72ub4u3xqdjcp7xel5hpbzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8207ba9b-90c4-8b09-89cd-0000857ec1ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/izis","pattern":"[url:value = 'https://www.ransomlook.io/group/izis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffb9117b-3d74-1301-d64c-00004db6ead8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://izis6oyht2suanp5fb5tsxqywwtww7ph5ho7vdjbtyzvs4hkidxgklid.onion/","pattern":"[url:value = 'http://izis6oyht2suanp5fb5tsxqywwtww7ph5ho7vdjbtyzvs4hkidxgklid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9edc2eb9-d1ce-a740-94f9-0000ba9b177c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://et3j2c6b55opkefctuiepsl2cj3vpwalain3qsanu33rubffx66fu3id.onion/","pattern":"[url:value = 'http://et3j2c6b55opkefctuiepsl2cj3vpwalain3qsanu33rubffx66fu3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0647614a-d7dc-5235-2c95-00001d25c36b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/octovillan","pattern":"[url:value = 'https://www.ransomlook.io/group/octovillan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e852cb09-5767-681e-af89-000056cc4094","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jvdg26n32ufrgd2c.onion","pattern":"[url:value = 'http://jvdg26n32ufrgd2c.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b693003b-09ba-dfeb-1ddc-0000b54e8d97","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/arachna","pattern":"[url:value = 'https://www.ransomlook.io/group/arachna']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1f50099-694a-77f6-cf52-0000cb63c0b3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ptyctpveqfevlukjw4hpdh6nb5oiemq6ek6tuuvxbtrfghvuutvscsid.onion/","pattern":"[url:value = 'http://ptyctpveqfevlukjw4hpdh6nb5oiemq6ek6tuuvxbtrfghvuutvscsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60f54d6a-a4d3-8d75-ba2c-000039363ce3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blackshrantac","pattern":"[url:value = 'https://www.ransomlook.io/group/blackshrantac']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cc63132-137d-6641-a295-000067c3147b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://shrantacpxim7z6m6pnszi52bb2tp23sntby3hklt36rezdja7bdjsyd.onion/","pattern":"[url:value = 'http://shrantacpxim7z6m6pnszi52bb2tp23sntby3hklt36rezdja7bdjsyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--129d6b5b-79c2-e055-345b-00009c28d978","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/coinbase","pattern":"[url:value = 'https://www.ransomlook.io/group/coinbase']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fe10d38-5d5a-236c-6640-0000bcad5d7a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iu6t4jcin7iexrdcgyspal6rsafyu4mw4tkdvugx4nmioxs7mbifdzad.onion/","pattern":"[url:value = 'http://iu6t4jcin7iexrdcgyspal6rsafyu4mw4tkdvugx4nmioxs7mbifdzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de02c864-1f42-670d-dbf2-000056851ae6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://chk4gwd4yku5jmhrqvqv4t52dwhccmi5e4ssomqreirl5wbosqdnb3qd.onion/","pattern":"[url:value = 'http://chk4gwd4yku5jmhrqvqv4t52dwhccmi5e4ssomqreirl5wbosqdnb3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d7308b0-775a-c0d4-23f5-000030fd110d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uzzgphpytgr7zpb6sudyf7ryds5g3cibrhwabwpf3sd7yjkv45b7uuad.onion/","pattern":"[url:value = 'http://uzzgphpytgr7zpb6sudyf7ryds5g3cibrhwabwpf3sd7yjkv45b7uuad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7367de3-004e-a2f4-5ec4-00000af9b992","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://otlnqz4lzee2xpnyy7vx6mwj6nonwgdloxeykwxulvgjwc5wzfacrzid.onion/","pattern":"[url:value = 'http://otlnqz4lzee2xpnyy7vx6mwj6nonwgdloxeykwxulvgjwc5wzfacrzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--544857ee-ebfc-7c97-ef70-0000daf7ba61","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5uvjhrqzsyyg4cku6uofsu7swmkqwit3na6plsaath4g3mgikievdead.onion/","pattern":"[url:value = 'http://5uvjhrqzsyyg4cku6uofsu7swmkqwit3na6plsaath4g3mgikievdead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e74f79a-a14b-675a-657c-00000867baa9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://won2bghjatxaavvf7eoepuwj74pej764mys575xan2h2uoctxnuojyyd.onion/","pattern":"[url:value = 'http://won2bghjatxaavvf7eoepuwj74pej764mys575xan2h2uoctxnuojyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d53b6c8c-bfda-710a-a767-0000641a6a10","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rfqsuxf2c3epm7tcxtqrsfaol3kpqe2omxfdls4lbg54ntsaazidgqid.onion/","pattern":"[url:value = 'http://rfqsuxf2c3epm7tcxtqrsfaol3kpqe2omxfdls4lbg54ntsaazidgqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23819446-9d80-4631-a2d6-00000ff34857","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pa4wtlap543g2gx34nphm5lcsrwwl3wwj6nb7omwqlrj3pruf4zuufyd.onion/","pattern":"[url:value = 'http://pa4wtlap543g2gx34nphm5lcsrwwl3wwj6nb7omwqlrj3pruf4zuufyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee97bc6b-31bb-18ce-0a8f-000096ef86d2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c5oxtg26apmuh3omkhuto22jy37rsgfifbvblvog7ur6d2rbhx7emxqd.onion/","pattern":"[url:value = 'http://c5oxtg26apmuh3omkhuto22jy37rsgfifbvblvog7ur6d2rbhx7emxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cd3b5ad-1f90-262c-bba7-0000a3be5242","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c7izex5h5shupbutwzsj73yputkqudfm7pvurawov7ciig6nkwssclad.onion/","pattern":"[url:value = 'http://c7izex5h5shupbutwzsj73yputkqudfm7pvurawov7ciig6nkwssclad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f5ad99f-b0df-5431-43c4-0000d97d7ce0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vkhztfqsjbh2in6425uvomeutn3oc4eos4264oexk57zdmntt2hoidid.onion/","pattern":"[url:value = 'http://vkhztfqsjbh2in6425uvomeutn3oc4eos4264oexk57zdmntt2hoidid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40e321e6-63dd-bb0a-c0e3-0000ec854fdd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion/","pattern":"[url:value = 'http://fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--659826d8-ca96-90db-1604-00004ae6b911","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/the","pattern":"[url:value = 'https://www.ransomlook.io/group/the']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51eb1e75-3842-294a-91af-000045d5eb6b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid.onion/","pattern":"[url:value = 'http://i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20766d60-4afa-1c8d-5f6a-0000d5944f4d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/","pattern":"[url:value = 'http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c253cc2f-e503-c831-8876-0000524adcbd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kirov","pattern":"[url:value = 'https://www.ransomlook.io/group/kirov']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e57d445-3d2b-11d8-1aa7-0000927ccec7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/securotrop","pattern":"[url:value = 'https://www.ransomlook.io/group/securotrop']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbf6f8d8-18be-ef4e-02d8-0000ff571d41","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/turkish","pattern":"[url:value = 'https://www.ransomlook.io/group/turkish']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33cb5291-6e65-5e60-8bcd-00008c9cb3b4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vbzxvet5nbga7jblaksuorsrvdsoe2x5youwadt7ywywpqzbliwfzmid.onion","pattern":"[url:value = 'http://vbzxvet5nbga7jblaksuorsrvdsoe2x5youwadt7ywywpqzbliwfzmid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2095e8b-42dc-825c-96da-000044f27913","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lamialocker","pattern":"[url:value = 'https://www.ransomlook.io/group/lamialocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b55b0595-935e-bf21-6dc4-00008e604339","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/yurei","pattern":"[url:value = 'https://www.ransomlook.io/group/yurei']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb189ba8-cae1-c647-6614-0000a2c4821a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion/","pattern":"[url:value = 'http://fewcriet5rhoy66k6c4cyvb2pqrblxtx4mekj3s5l4jjt4t4kn4vheyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c58370eb-08c2-b5ed-5ba2-00000a4fd146","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/xleaks","pattern":"[url:value = 'https://www.ransomlook.io/group/xleaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b778a1f5-b97b-a1a2-a77f-0000aebb8084","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fqb6joilbbd26d574bfaycnw6tkfqeqgkjnsikmu2eixkj746dqvvgqd.onion","pattern":"[url:value = 'http://fqb6joilbbd26d574bfaycnw6tkfqeqgkjnsikmu2eixkj746dqvvgqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a597bc8c-d0d8-a85d-188e-00003a4240bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cephalus","pattern":"[url:value = 'https://www.ransomlook.io/group/cephalus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--395e0f09-f0f2-6dea-bd52-0000f0ec1e24","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/toufan","pattern":"[url:value = 'https://www.ransomlook.io/group/toufan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39865e2c-f918-384d-b466-0000e5c2acdc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://toufanleaks.org/","pattern":"[url:value = 'https://toufanleaks.org/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dd3d061-f605-d574-4c2f-00002381a2c5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/obscura","pattern":"[url:value = 'https://www.ransomlook.io/group/obscura']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5281654-f8b0-331a-d508-0000b6eede4a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://obscurad3aphckihv7wptdxvdnl5emma6t3vikcf3c5oiiqndq6y6xad.onion/","pattern":"[url:value = 'http://obscurad3aphckihv7wptdxvdnl5emma6t3vikcf3c5oiiqndq6y6xad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d61cbc0-e514-a18e-29ef-000077628c88","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/desolator","pattern":"[url:value = 'https://www.ransomlook.io/group/desolator']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d07d7871-fb2c-529c-5cee-00006817b966","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lunalock","pattern":"[url:value = 'https://www.ransomlook.io/group/lunalock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--286383c5-9877-7cef-a414-0000a707ea47","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lunachataclss7bvlhk5zxs6pqpunxljeqhrn2bfl6wkhlwqxvgwgayd.onion/","pattern":"[url:value = 'http://lunachataclss7bvlhk5zxs6pqpunxljeqhrn2bfl6wkhlwqxvgwgayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e92492a-6a48-8770-17a2-0000fe168092","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lunalockcccxzkpfovwzifwxcytqkiuak6wzybnniqwxcmpsetpbetid.onion/","pattern":"[url:value = 'http://lunalockcccxzkpfovwzifwxcytqkiuak6wzybnniqwxcmpsetpbetid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b33f504e-30d7-42b9-7aa8-000082af95be","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/tssxx25","pattern":"[url:value = 'https://www.ransomlook.io/group/tssxx25']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ae4cc35-9831-6293-19c8-000016fedc9c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://techscckl72ibnfg2ksj5aqlanwgzw32asr6ml37aojnyw4nardojyid.onion/","pattern":"[url:value = 'http://techscckl72ibnfg2ksj5aqlanwgzw32asr6ml37aojnyw4nardojyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88ff436a-14fa-73c5-626c-00004760f89b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lockbit5","pattern":"[url:value = 'https://www.ransomlook.io/group/lockbit5']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb7bbdde-d393-6a09-ad9d-0000e5dd253e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion/","pattern":"[url:value = 'http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a2a4d50-eeb1-01a1-7670-000006a6930a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion/","pattern":"[url:value = 'http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86873aa5-f186-8c35-faf9-00007db01259","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/leaknet","pattern":"[url:value = 'https://www.ransomlook.io/group/leaknet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85eea8a9-79a3-e3c8-8158-000003b3da5a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bnlluetsuf6pv7mchgue46h43v66uxtccpg3n5vcdzbeqften5cedlid.onion/","pattern":"[url:value = 'http://bnlluetsuf6pv7mchgue46h43v66uxtccpg3n5vcdzbeqften5cedlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05ee9055-3bf4-1de9-a367-0000a8f2ec95","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ahic5qo3qbjgsyv7x2h5w7uh6nuh45km5srblj7i2amxt57xp4wud2qd.onion/","pattern":"[url:value = 'http://ahic5qo3qbjgsyv7x2h5w7uh6nuh45km5srblj7i2amxt57xp4wud2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ac75b3a-6e7a-9d95-0e93-000081c5f60e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nleakk6sejx45jxtk7x6iyt65hwvfrkifc5v7ertdlwm3gttbpvlvxqd.onion/","pattern":"[url:value = 'http://nleakk6sejx45jxtk7x6iyt65hwvfrkifc5v7ertdlwm3gttbpvlvxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bbe2735-50b4-d493-6f81-000020ca4e20","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/piratelock","pattern":"[url:value = 'https://www.ransomlook.io/group/piratelock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d542868-44b5-1978-9099-000083e9e4ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bytesfromheaven","pattern":"[url:value = 'https://www.ransomlook.io/group/bytesfromheaven']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0000129-3707-d3f2-3729-0000daf10940","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jhjqe4vmwfpmjgrminvt7hx7jmcmw2lw45emqmdqyjkvux2eh5lujnyd.onion","pattern":"[url:value = 'http://jhjqe4vmwfpmjgrminvt7hx7jmcmw2lw45emqmdqyjkvux2eh5lujnyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b8c7e61-8cb6-003c-05bd-0000e8d17fc1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bober","pattern":"[url:value = 'https://www.ransomlook.io/group/bober']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f94dba21-c051-90a3-a22f-0000dbbe129f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion","pattern":"[url:value = 'http://myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07b2fc5d-58e7-622d-f15f-00000d74845b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/pear","pattern":"[url:value = 'https://www.ransomlook.io/group/pear']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--295366d9-a857-4b29-7e5f-0000b7eb8757","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xsomiaq5awxh3zkzn334s3dgwuvngy6z2to7265exgovnkwk66hjypid.onion/","pattern":"[url:value = 'http://xsomiaq5awxh3zkzn334s3dgwuvngy6z2to7265exgovnkwk66hjypid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b53a2abe-3d8f-2d10-1cd7-000092d1839b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://m3wwhkus4dxbnxbtihexlyd2cv63qrvex6jiebc4vqe22kg2z3udebid.onion/","pattern":"[url:value = 'http://m3wwhkus4dxbnxbtihexlyd2cv63qrvex6jiebc4vqe22kg2z3udebid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d878b612-6e2f-3844-47cd-00000795c258","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://e7a6zgqfijn2ko6lzkz53tysjpnf22fxj4h2f3saufrmsts5pbul5eid.onion/","pattern":"[url:value = 'http://e7a6zgqfijn2ko6lzkz53tysjpnf22fxj4h2f3saufrmsts5pbul5eid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a53a28f6-d7f3-43c6-3a4e-0000de6e3d71","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://diyr2bnty7iktyxfd4kz65uigcfappjvux73dpgkkeocp3fmlgnuzyyd.onion/","pattern":"[url:value = 'http://diyr2bnty7iktyxfd4kz65uigcfappjvux73dpgkkeocp3fmlgnuzyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70f7c347-d62a-9ae8-e9ec-000042ad3da9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5qynbyjl4u6vbtnmpokslaxaknyicdvty7vn2qgxmaty3lb7wwxpkbid.onion/","pattern":"[url:value = 'http://5qynbyjl4u6vbtnmpokslaxaknyicdvty7vn2qgxmaty3lb7wwxpkbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2e30029-bafb-c56e-7037-0000fae98be1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://psvrn6ahevi6dgf55bzc26q3gjc7s6n7vcth34rmkl2y7e7dijhjfiqd.onion/","pattern":"[url:value = 'http://psvrn6ahevi6dgf55bzc26q3gjc7s6n7vcth34rmkl2y7e7dijhjfiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba1acf31-63af-9925-dd30-000060dff848","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://q2bg7ljsrpmy6736qqmpwsnqqm3w6d3hhrokohytnmldbom7sthp4sad.onion/","pattern":"[url:value = 'http://q2bg7ljsrpmy6736qqmpwsnqqm3w6d3hhrokohytnmldbom7sthp4sad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f93e2c4-315f-bb69-26ab-0000679e28ad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xq5m6ofel63h57by46algju25g37zkdwoxxt7ij45b6obo4mxzc3h6id.onion/","pattern":"[url:value = 'http://xq5m6ofel63h57by46algju25g37zkdwoxxt7ij45b6obo4mxzc3h6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac8ec7f7-51a3-ac07-de01-0000ca46cff9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://csxilwnl7orv6rwfjen5ye3tefk5shjtr4tysuykgxjsyngpvoqrvbid.onion/","pattern":"[url:value = 'http://csxilwnl7orv6rwfjen5ye3tefk5shjtr4tysuykgxjsyngpvoqrvbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbf61ea5-0aee-d393-005a-0000ab5ab218","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://etus2tmakckdlkyjpevoyciuao7er5fj3qm26aev3nch4fusptefiayd.onion/","pattern":"[url:value = 'http://etus2tmakckdlkyjpevoyciuao7er5fj3qm26aev3nch4fusptefiayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af77bc4f-02a7-7424-dada-000009a18ad7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pearsmob5sn44ismokiusuld34pnfwi6ctgin3qbvonpoob4lh3rmtqd.onion/","pattern":"[url:value = 'http://pearsmob5sn44ismokiusuld34pnfwi6ctgin3qbvonpoob4lh3rmtqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f3d2a63-1890-224f-6927-000089e4b0d1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yxwomyfmexm3bfcuumnugrzwluol5qwsw6pmne7jklgmzthkp35l2jqd.onion/","pattern":"[url:value = 'http://yxwomyfmexm3bfcuumnugrzwluol5qwsw6pmne7jklgmzthkp35l2jqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f24e704-986f-3966-3408-0000de436cb7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion/","pattern":"[url:value = 'http://peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fbb8a94-873b-7414-022f-000093b34f78","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.hookphish.com/blog/ransomware-group-blacknevas-hits-tani-and-abe/","pattern":"[url:value = 'https://www.hookphish.com/blog/ransomware-group-blacknevas-hits-tani-and-abe/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d64e90da-359c-4d14-b67d-0000944d1313","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/blacknevas/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/blacknevas/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--877df8e1-05ce-36ad-0cd2-0000ae87998a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion/","pattern":"[url:value = 'http://ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db04bbf3-3155-7442-ddec-000043a83b96","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zeta","pattern":"[url:value = 'https://www.ransomlook.io/group/zeta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4495841f-5b4f-9c1d-4a56-00003c869b23","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zeta-leaks.onion","pattern":"[url:value = 'http://zeta-leaks.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd8571b6-8bfa-0d3f-55a6-00009e53f8e9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sharpboys","pattern":"[url:value = 'https://www.ransomlook.io/group/sharpboys']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ccbda23-1b4c-b731-3e39-0000b91c8bf6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sharpboyz.io/","pattern":"[url:value = 'http://sharpboyz.io/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--969be760-ef4e-4634-b09a-0000ca43a1ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sinobi","pattern":"[url:value = 'https://www.ransomlook.io/group/sinobi']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e571cbda-3230-d0ec-b060-00007b64ba82","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobiea4snfqtkc43paumapo4oi7vxcy5vjzfoalunsnvzehozfhpyd.onion","pattern":"[url:value = 'http://sinobiea4snfqtkc43paumapo4oi7vxcy5vjzfoalunsnvzehozfhpyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b7b1444-a684-7232-79ca-00006a9c1f08","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobidxodgt4jsr3tlmf2rr4okjvvwfp5gh3lrqxnowomcx62ssrhqd.onion","pattern":"[url:value = 'http://sinobidxodgt4jsr3tlmf2rr4okjvvwfp5gh3lrqxnowomcx62ssrhqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0b2a053-a273-1a7d-8b6d-000011e4bbee","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobibdvzohujkliofkxiz3ueyedfh6bed2lzjz2z6pafw5jeoptsid.onion","pattern":"[url:value = 'http://sinobibdvzohujkliofkxiz3ueyedfh6bed2lzjz2z6pafw5jeoptsid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--728c0a0e-ce57-97b8-d848-0000e0094f57","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobihmkmncjubqin5u44vso3z2zongdmmtgle7eglskjmfb6u74rad.onion/","pattern":"[url:value = 'http://sinobihmkmncjubqin5u44vso3z2zongdmmtgle7eglskjmfb6u74rad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae7321bb-1778-87c7-2d39-000078ee6194","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cdn.sinobi.us.org/","pattern":"[url:value = 'http://cdn.sinobi.us.org/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--543d8a08-e8fe-fd1d-4e38-000063612892","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://chat.sinobi.us.org/","pattern":"[url:value = 'http://chat.sinobi.us.org/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aac982ab-d59b-5eb2-58cf-0000ca567758","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://blog.sinobi.us.org/leaks","pattern":"[url:value = 'http://blog.sinobi.us.org/leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fde27315-deec-a07b-6b6b-0000a48d8da9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobiea4snfqtkc43paumapo40i7vxcy5vjzfoalunsnvzehozfhpyd.onion/login","pattern":"[url:value = 'http://sinobiea4snfqtkc43paumapo40i7vxcy5vjzfoalunsnvzehozfhpyd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c01bd8a7-cb61-9e45-1a49-0000ebc58870","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobidxodgt4jsr3t1mf2rr4okjvvwfp5gh31rqxnowomcx62ssrhqd.onion/login","pattern":"[url:value = 'http://sinobidxodgt4jsr3t1mf2rr4okjvvwfp5gh31rqxnowomcx62ssrhqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c582ab7e-dd61-23bb-18a4-0000e45c871f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobicrh73ongfuxjajmlyyhalvkhlcgttxkxaxz3gvsgdcgf76uiqd.onion/login","pattern":"[url:value = 'http://sinobicrh73ongfuxjajmlyyhalvkhlcgttxkxaxz3gvsgdcgf76uiqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19f7a514-9ef6-b8be-1f9a-00001ff06108","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobibjqytwqxjw24zuerqcjyd3hoow6zia7z6kzvwawivamu7nqayd.onion/login","pattern":"[url:value = 'http://sinobibjqytwqxjw24zuerqcjyd3hoow6zia7z6kzvwawivamu7nqayd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4ce67aa-5a54-6d48-2ece-000076f98f0b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobibdvzohujkliofkxiz3ueyedfh6bed21zjz2z6pafw5jeoptsid.onion/login","pattern":"[url:value = 'http://sinobibdvzohujkliofkxiz3ueyedfh6bed21zjz2z6pafw5jeoptsid.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec3efef0-931c-ed6e-c27e-00000aece70a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sinobi7yuoppj76qnkwiobwfc2qve2xkv2ckvzyyjblwd7ucpptl62ad.onion/login","pattern":"[url:value = 'http://sinobi7yuoppj76qnkwiobwfc2qve2xkv2ckvzyyjblwd7ucpptl62ad.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35d41adf-e16c-e7b0-1d70-00004330db80","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/devman2","pattern":"[url:value = 'https://www.ransomlook.io/group/devman2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac90ff6f-9b07-bc3f-8f53-0000d4d6a729","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tygjm32hxyqienrgwxveiaw3azbjmfaln2znn2hldz2oe6v453ngwlyd.onion/","pattern":"[url:value = 'http://tygjm32hxyqienrgwxveiaw3azbjmfaln2znn2hldz2oe6v453ngwlyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--878817a2-d2ca-b567-3ac8-0000c86a43a3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://devmanblggk7ddrtqj3tsocnayow3bwnozab2s4yhv4shpv6ueitjzid.onion/","pattern":"[url:value = 'http://devmanblggk7ddrtqj3tsocnayow3bwnozab2s4yhv4shpv6ueitjzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--924c1e9c-4f7d-8839-e79a-0000ab5436cc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wugurgyscp5rxpihef5vl6b6m5ont3b6sezhl7boboso2enib2k3q6qd.onion/","pattern":"[url:value = 'http://wugurgyscp5rxpihef5vl6b6m5ont3b6sezhl7boboso2enib2k3q6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f636ab67-cc44-422e-9724-00003ba76846","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/blackbyte-crux","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/blackbyte-crux']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d6efe1c-75b7-8473-2eb1-0000c17f9fdb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securityboulevard.com/2025/07/new-crux-ransomware-emerges-in-three-attacks-this-month/","pattern":"[url:value = 'https://securityboulevard.com/2025/07/new-crux-ransomware-emerges-in-three-attacks-this-month/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc6878b6-1551-6ef1-2e86-0000912add24","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.itpro.com/business/cybersecurity-researchers-have-spotted-a-potent-new-ransomware-strain-being-used-in-the-wild","pattern":"[url:value = 'https://www.itpro.com/business/cybersecurity-researchers-have-spotted-a-potent-new-ransomware-strain-being-used-in-the-wild']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa142439-ab84-6953-fd5b-000034feae90","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.huntress.com/blog/crux-ransomware","pattern":"[url:value = 'https://www.huntress.com/blog/crux-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02559e62-7091-e9b0-8037-00004be6580d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blackbyte-crux","pattern":"[url:value = 'https://www.ransomlook.io/group/blackbyte-crux']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84f36caf-0cd7-3dad-95e5-0000cbaed87a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://faow6n2hkweyyalp67zvonafn2dzphw36cav653wamj724mwsmtfa5yd.onion/","pattern":"[url:value = 'http://faow6n2hkweyyalp67zvonafn2dzphw36cav653wamj724mwsmtfa5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f173607-cf17-834e-cf21-0000fbf647d6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dounczge5jhw4iztnnpzp54kd4ot3tikhjsimurtcewqssgye6vvrhqd.onion/","pattern":"[url:value = 'http://dounczge5jhw4iztnnpzp54kd4ot3tikhjsimurtcewqssgye6vvrhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31547281-bdd8-7abf-c4a3-0000658ebab1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cryp70n1c0d3","pattern":"[url:value = 'https://www.ransomlook.io/group/cryp70n1c0d3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42f0e858-1fb5-5635-3e9e-0000bdc3b11c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ranion","pattern":"[url:value = 'https://www.ransomlook.io/group/ranion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9803df5-3069-77b9-3557-0000c0293fb2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ssg3qvvuilseciagm4nixjqu3rsiheny5lifjnwt6o5ann64iocy64ad.onion/","pattern":"[url:value = 'http://ssg3qvvuilseciagm4nixjqu3rsiheny5lifjnwt6o5ann64iocy64ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cb1b083-026b-604a-198e-00004fa6cd99","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ranionv3j2o7wrn3um6de33eccbchhg32mkgnnoi72enkpp7jc25h3ad.onion/","pattern":"[url:value = 'http://ranionv3j2o7wrn3um6de33eccbchhg32mkgnnoi72enkpp7jc25h3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f203feb5-4937-16c5-d8fe-000024d5e42e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ransomedvc2","pattern":"[url:value = 'https://www.ransomlook.io/group/ransomedvc2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89833a47-3578-7e93-3700-0000d0bbd281","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://ransomed.biz/","pattern":"[url:value = 'https://ransomed.biz/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4daef2a6-fa91-0862-f820-00003e6769e1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mindware","pattern":"[url:value = 'https://www.ransomlook.io/group/mindware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b057c2b6-8577-e4f6-d2f6-00003966b627","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dfpc7yvle5kxmgg6sbcp5ytggy3oeob676bjgwcwhyr2pwcrmbvoilqd.onion/","pattern":"[url:value = 'http://dfpc7yvle5kxmgg6sbcp5ytggy3oeob676bjgwcwhyr2pwcrmbvoilqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--198a6045-6bfd-d613-f3ab-0000eab70b05","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.enigmasoftware.com/cryptedpayransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/cryptedpayransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c5346a7-3be7-3fe0-6156-00007c00e68a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/21736-cryptedpay-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/21736-cryptedpay-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76309536-f68f-36e4-ca37-0000fe7f9209","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cryptedpay","pattern":"[url:value = 'https://www.ransomlook.io/group/cryptedpay']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83f4547b-7229-5907-26bf-0000c8d56cc9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/himalayaa","pattern":"[url:value = 'https://www.ransomlook.io/group/himalayaa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5d7cdf7-0fc0-ef48-3060-0000221ece6a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ohu6eschnuhxfg46wvco7j3e76oqymo4cowfepbi7h6z3vf6if6lj5yd.onion/","pattern":"[url:value = 'http://ohu6eschnuhxfg46wvco7j3e76oqymo4cowfepbi7h6z3vf6if6lj5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe9f26a4-d01f-65bb-4c23-00008969bd1d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.rapid7.com/blog/post/2024/02/05/exploring-the-not-so-secret-code-of-blackhunt-ransomware-2/","pattern":"[url:value = 'https://www.rapid7.com/blog/post/2024/02/05/exploring-the-not-so-secret-code-of-blackhunt-ransomware-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8258924-797f-b50d-3bee-00006a775c2f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blackhunt","pattern":"[url:value = 'https://www.ransomlook.io/group/blackhunt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--579b46aa-37f6-a45d-632b-0000e1673f00","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion","pattern":"[url:value = 'http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e255673c-b916-83f3-1810-0000e8ba01a3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cybershafarat.com/2025/07/30/bqtlock-ransomware-op-status/","pattern":"[url:value = 'https://www.cybershafarat.com/2025/07/30/bqtlock-ransomware-op-status/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e1e4dfc-b10c-9faf-084c-0000f770c37f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/bqtlock","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/bqtlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5ae414f-6d21-9338-d4e4-000057bc7f4d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/33382-bqtlock-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/33382-bqtlock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1b8e17a-8e3e-907e-5003-00002fcf519a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bqtlock","pattern":"[url:value = 'https://www.ransomlook.io/group/bqtlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b9baf69-dc60-0c30-2f39-0000fd325f90","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yywhylvqeqynzik6ibocb53o2nat7lmzn5ynjpar3stndzcgmy6dkgid.onion/","pattern":"[url:value = 'http://yywhylvqeqynzik6ibocb53o2nat7lmzn5ynjpar3stndzcgmy6dkgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb022fb3-3c71-c985-ee61-0000cf7c5c6d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/homeland","pattern":"[url:value = 'https://www.ransomlook.io/group/homeland']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17a43b74-3811-fc20-33c8-00004a870dfc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://homelandjustice.ru","pattern":"[url:value = 'http://homelandjustice.ru']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--071a7f84-07ae-1c37-84f9-0000478f6ab6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/elonmusknow","pattern":"[url:value = 'https://www.ransomlook.io/group/elonmusknow']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f3e8a72-9768-7e38-cba1-0000a30e9485","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://leaksbcwijsbkxcx76s24qi4ab4jn7rgtzzyiss7fzco6amhj6h365ad.onion/","pattern":"[url:value = 'http://leaksbcwijsbkxcx76s24qi4ab4jn7rgtzzyiss7fzco6amhj6h365ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0bb9174-2a6c-6659-2409-0000936754dd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/payoutsking","pattern":"[url:value = 'https://www.ransomlook.io/group/payoutsking']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e582899f-5f49-9cfc-4b16-0000ebce7b88","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c6nrwsloenpiat7zilh243nvhe7a3edsfm3ct3kpxhu2fv7z36ksjcad.onion/","pattern":"[url:value = 'http://c6nrwsloenpiat7zilh243nvhe7a3edsfm3ct3kpxhu2fv7z36ksjcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c25409c0-247e-a43f-15fb-0000d81dfd88","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://v2mw3spxqhggig5zjd6tjnfamwntrprreij3dq77jlq74dduyjafeead.onion/","pattern":"[url:value = 'https://v2mw3spxqhggig5zjd6tjnfamwntrprreij3dq77jlq74dduyjafeead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba27eff7-97d2-c75c-d1e9-000038117a09","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion/","pattern":"[url:value = 'https://payoutsgn7cy6uliwevdqspncjpfxpmzgirwl2au65la7rfs5x3qnbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--751cfbdf-6180-f9b5-6933-000091ea53ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vulcan","pattern":"[url:value = 'https://www.ransomlook.io/group/vulcan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef1c1e4d-5128-304b-0f54-00004c743842","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/99fb65e2253ca3b34b83","pattern":"[url:value = 'http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/99fb65e2253ca3b34b83']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce97cdc2-3598-3826-3180-00007662a8aa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ank","pattern":"[url:value = 'https://www.ransomlook.io/group/ank']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1934e73d-529d-0929-0a5b-0000e84ea2ea","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ankexpn6vk3qc5ooyyj7ufi6nmyt44vxbjtbxxkq4bxo7xzghai7kiqd.onion/","pattern":"[url:value = 'http://ankexpn6vk3qc5ooyyj7ufi6nmyt44vxbjtbxxkq4bxo7xzghai7kiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80061129-a1b1-0dbc-795a-00007950be64","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/qilin-securotrop","pattern":"[url:value = 'https://www.ransomlook.io/group/qilin-securotrop']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69a323e8-b67a-e83d-d28f-0000a2f141ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion/","pattern":"[url:value = 'http://securo45z554mw7rgrt7wcgv5eenj2xmxyrsdj3fcjsvindu63s4bsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a83d8ce0-a02a-5d4f-fe89-000092ca0ef0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/d4rk4rmy","pattern":"[url:value = 'https://www.ransomlook.io/group/d4rk4rmy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bef1dffc-4095-2a53-1bcf-000084b2d4fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://d4rkd2fybtclo44hss2dpqpw7gmofboxhruax2az3uejw7puxxbpkvqd.onion/","pattern":"[url:value = 'http://d4rkd2fybtclo44hss2dpqpw7gmofboxhruax2az3uejw7puxxbpkvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f857016-92f3-d71f-fc72-00005e30942a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kawa","pattern":"[url:value = 'https://www.ransomlook.io/group/kawa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97de65c9-ae05-903d-7310-000013e988c7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/slam","pattern":"[url:value = 'https://www.ransomlook.io/group/slam']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9b6aff2-e6b6-0fae-d7eb-000049ab5446","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://encrP43djqOIjsq2ndakdkir91dndkqOd34dmaQq71.onion","pattern":"[url:value = 'http://encrP43djqOIjsq2ndakdkir91dndkqOd34dmaQq71.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d23bfd0e-0c14-37cb-20b8-0000eef11ea2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://encrEjdHGdmd45JdndqkOPqe8jhNdqk.onion","pattern":"[url:value = 'http://encrEjdHGdmd45JdndqkOPqe8jhNdqk.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c320a98e-d793-d805-6d75-00005b76548f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://encr5RhdkjNNJdwq62dfHIUJ7Gdmiu4KdJRvd9md.onion","pattern":"[url:value = 'http://encr5RhdkjNNJdwq62dfHIUJ7Gdmiu4KdJRvd9md.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f96698c8-7e29-3999-d8d2-0000768346d0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://encrKdm13nfKJNdwf7kd.onion","pattern":"[url:value = 'http://encrKdm13nfKJNdwf7kd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26641fe8-2618-5f01-40cf-0000d4026f4f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://encr9djfOJdew92nfjK9sdn34nfsks.onion","pattern":"[url:value = 'http://encr9djfOJdew92nfjK9sdn34nfsks.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62999275-bb2b-8f20-f436-00006ce82c0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/naga","pattern":"[url:value = 'https://www.ransomlook.io/group/naga']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c6f682f-83b0-6cb8-5538-0000b74ed959","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nagapay2ypwzsj7gb2hllyelhc6uepfrx7u356slaaemshrooxhbvfyd.onion/","pattern":"[url:value = 'http://nagapay2ypwzsj7gb2hllyelhc6uepfrx7u356slaaemshrooxhbvfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18c8a528-8ed0-bf56-c034-000084e750c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/warlock","pattern":"[url:value = 'https://www.ransomlook.io/group/warlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ddfc417-345d-274b-eaf3-000054e52d59","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://warlockoact3ayzqwlnay27b633bku2gmpq34dxb43v3qriujfea4yyd.onion","pattern":"[url:value = 'http://warlockoact3ayzqwlnay27b633bku2gmpq34dxb43v3qriujfea4yyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b0571ba-f465-4560-9717-00007af182cb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://warlockmdu64clit5pdwbp5hsd576vcjjigfwbtz5gtthmuy2fiqblad.onion","pattern":"[url:value = 'http://warlockmdu64clit5pdwbp5hsd576vcjjigfwbtz5gtthmuy2fiqblad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1c9007f-2a07-20e3-2103-000049631016","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://warlock6d4etw5gwwaakh6auh6cwkinhk2bx7bbldu4m5axlcwmbuuyd.onion","pattern":"[url:value = 'http://warlock6d4etw5gwwaakh6auh6cwkinhk2bx7bbldu4m5axlcwmbuuyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a35dc1d0-4171-1195-57c4-0000bec4bb7b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://warlock5zli2g4nuvixkgyivpda4ktg6flx5lbtw3u6g5lidgxzjc6id.onion","pattern":"[url:value = 'http://warlock5zli2g4nuvixkgyivpda4ktg6flx5lbtw3u6g5lidgxzjc6id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--feb962e2-c0d2-b8f5-9849-0000bb664393","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://warlock4fagqhnfuxtcmncfepe3jc33e33dmj2jsk64svxaerm5zhaqd.onion","pattern":"[url:value = 'http://warlock4fagqhnfuxtcmncfepe3jc33e33dmj2jsk64svxaerm5zhaqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa0d88d7-6b1a-bd2b-f4ab-0000f15b081f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://warlockoact3ayzqwlnay27b633bku2gmpq34dxb43v3qriujfea4yyd.onion/","pattern":"[url:value = 'http://warlockoact3ayzqwlnay27b633bku2gmpq34dxb43v3qriujfea4yyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a81a844-9494-3039-e7e9-00007f84e5ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ocwjy4ynmpbbzhumh2ama2vl3bc77lf5auqf7nf4k45lbmzoep2rbyid.onion/","pattern":"[url:value = 'http://ocwjy4ynmpbbzhumh2ama2vl3bc77lf5auqf7nf4k45lbmzoep2rbyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ace1fdd-21b7-8865-57da-0000c0a102ce","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zfytizegsze6uiswodhbaalyy5rawaytv2nzyzdkt3susbewviqqh7yd.onion/","pattern":"[url:value = 'http://zfytizegsze6uiswodhbaalyy5rawaytv2nzyzdkt3susbewviqqh7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fff71cd3-0ae4-51df-2bbf-0000be17f4da","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://elqfbcx5nofwtqfookqml7ltx2g6q6tmddys6e25vgu3al2meim6cbqd.onion/","pattern":"[url:value = 'http://elqfbcx5nofwtqfookqml7ltx2g6q6tmddys6e25vgu3al2meim6cbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd9e4577-65bd-5354-0d9a-00003f713e85","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/walocker","pattern":"[url:value = 'https://www.ransomlook.io/group/walocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--155626ca-4ab7-2f08-0962-0000299821c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://am7hswbi46e3ozxec3msxwwzxebkfulsgonhv5kndzeryc2pu46sxmad.onion/","pattern":"[url:value = 'http://am7hswbi46e3ozxec3msxwwzxebkfulsgonhv5kndzeryc2pu46sxmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66cc83c1-b336-ef34-cf8b-0000e667fcac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://weepangrbqjfsxd2noz4bmolztnqsma3vw4c6qfnbfusadzd2m26emqd.onion/index.php","pattern":"[url:value = 'http://weepangrbqjfsxd2noz4bmolztnqsma3vw4c6qfnbfusadzd2m26emqd.onion/index.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8570f4f4-8270-b399-3698-0000666ecba2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyware.com/news/global-group-ransomware-claims-breach-of-media-giant-albavision","pattern":"[url:value = 'https://cyware.com/news/global-group-ransomware-claims-breach-of-media-giant-albavision']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88dbac15-cbff-5fd0-d2d3-0000fd28dc04","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://picussecurity.com/resource/blog/tracking-global-group-ransomware-from-mamona-to-market-scale","pattern":"[url:value = 'https://picussecurity.com/resource/blog/tracking-global-group-ransomware-from-mamona-to-market-scale']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff36fda4-12cc-82b6-8bc1-000044afba84","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://broadcom.com/support/security-center/protection-bulletin/global-a-new-blacklock-ransomware-variant","pattern":"[url:value = 'https://broadcom.com/support/security-center/protection-bulletin/global-a-new-blacklock-ransomware-variant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--baea45ff-100a-602e-a570-0000873fc1df","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://infosecurity-magazine.com/news/ransomware-group-uses-ai-chatbot/","pattern":"[url:value = 'https://infosecurity-magazine.com/news/ransomware-group-uses-ai-chatbot/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f15dd1f-2e3e-c151-d707-0000ba47fe15","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cybersecurity-magazine.com/news/ransomware-ai-chatbot-pressure/","pattern":"[url:value = 'https://cybersecurity-magazine.com/news/ransomware-ai-chatbot-pressure/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ae9249b-3ecf-7de6-2bb5-00002d0ea94f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service","pattern":"[url:value = 'https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d1f7be7-dcfb-c086-113c-000019182e6e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/global","pattern":"[url:value = 'https://www.ransomlook.io/group/global']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--306b9bf2-6699-0223-2636-00000ae30921","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7bmz2tc4p2jk23dcyehg37cd7veflk3fyhxrnbxz75vvno2azfy6qayd.onion/","pattern":"[url:value = 'http://7bmz2tc4p2jk23dcyehg37cd7veflk3fyhxrnbxz75vvno2azfy6qayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8d311d6-bf86-8b3f-e32b-00003171acea","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gdbkvfe6g3whrzkdlbytksygk45zwgmnzh5i2xmqyo3mrpipysjagqyd.onion/","pattern":"[url:value = 'http://gdbkvfe6g3whrzkdlbytksygk45zwgmnzh5i2xmqyo3mrpipysjagqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--964f844e-1098-e0c7-036d-000037fee4bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion/","pattern":"[url:value = 'http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1c47d36-e587-70f8-c275-0000d208dd4f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onion/","pattern":"[url:value = 'http://vg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19ac4825-cba8-36fe-47c3-00002d30eb72","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/teamxxx","pattern":"[url:value = 'https://www.ransomlook.io/group/teamxxx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07f2bd7d-7618-7cee-060d-0000aa87fd6f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tp5cwh6d2b5hekcg6jlhoe6mawa7dlwiv47epvnfmzuaaur2dnaa3uid.onion/","pattern":"[url:value = 'http://tp5cwh6d2b5hekcg6jlhoe6mawa7dlwiv47epvnfmzuaaur2dnaa3uid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bc33b36-2fef-1e0c-38b1-0000ea4fa025","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/imn","pattern":"[url:value = 'https://www.ransomlook.io/group/imn']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e81ef3f0-eb3a-bd3f-7f36-0000842cb98b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ho7yirtlkkkytbzkn4bklwuxlu6n3eatkhvvlgjaoub2kvlm3qjq.b32.i2p","pattern":"[url:value = 'http://ho7yirtlkkkytbzkn4bklwuxlu6n3eatkhvvlgjaoub2kvlm3qjq.b32.i2p']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88f5fa2b-135e-7c4b-4a5b-0000e3eae383","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://imncrewwfkbjkhr2oylerfm5qtbzfphhmpcfag43xc2kfgvluqtlgoid.onion/","pattern":"[url:value = 'http://imncrewwfkbjkhr2oylerfm5qtbzfphhmpcfag43xc2kfgvluqtlgoid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--235a961b-9d7b-ed32-1812-000048a09c6a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/desolated","pattern":"[url:value = 'https://www.ransomlook.io/group/desolated']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa701838-4a1e-f83e-6af5-00000c101819","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/azzasec","pattern":"[url:value = 'https://www.ransomlook.io/group/azzasec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e3bcef5-b352-5b7a-968a-0000a30be72f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sebzpewd2zz7jap56r37icjee4pn5scss3mjxz74uq32ua2aa3n5vqad.onion","pattern":"[url:value = 'http://sebzpewd2zz7jap56r37icjee4pn5scss3mjxz74uq32ua2aa3n5vqad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee339ed0-41ca-2954-3bab-000029edb6f2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lcryptorx","pattern":"[url:value = 'https://www.ransomlook.io/group/lcryptorx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db7bb0f1-3e51-8c4f-8459-000063625a9e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lcryptordecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion","pattern":"[url:value = 'http://lcryptordecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ae051dc-f83a-2068-0e04-0000734f07fd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lcryxdecryptor4f6xzyorj9qsb5e.onion","pattern":"[url:value = 'http://lcryxdecryptor4f6xzyorj9qsb5e.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9188cd21-aa4b-3d78-898c-000050cecbf9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lyrix","pattern":"[url:value = 'https://www.ransomlook.io/group/lyrix']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fa01246-72f5-6225-ab4c-00002e4367c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4hfwnas3oexnkdimschyyld6fftxchsk77wvucpxewlwapmjhjuhjxad.onion","pattern":"[url:value = 'http://4hfwnas3oexnkdimschyyld6fftxchsk77wvucpxewlwapmjhjuhjxad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e70bf2d8-103b-e844-b484-0000c6b47b76","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://share.jtor.xyz/torrents/","pattern":"[url:value = 'https://share.jtor.xyz/torrents/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--907cd3d1-52d4-6eeb-dc30-00008b9bb1f2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://twniiyed6mydtbe64i5mdl56nihl7atfaqtpww6gqyaiohgc75apzpad.onion/","pattern":"[url:value = 'http://twniiyed6mydtbe64i5mdl56nihl7atfaqtpww6gqyaiohgc75apzpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bde9c6f-555c-7372-7fac-00000b62f34d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/nova","pattern":"[url:value = 'https://www.ransomlook.io/group/nova']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0dd4bb3-ccba-b1d5-79a4-0000d8813d90","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cceoxb5youzqo2uk7t7274ittlphj6vimzkjtu75yi5grceqozm5znid.onion","pattern":"[url:value = 'http://cceoxb5youzqo2uk7t7274ittlphj6vimzkjtu75yi5grceqozm5znid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcc2755c-063d-9544-7d99-0000b6f2bc89","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://novamojnnc7n7brrnflr7evyrho2e5ynskicrjxuvhn5r6jjlxyjj4ad.onion/","pattern":"[url:value = 'http://novamojnnc7n7brrnflr7evyrho2e5ynskicrjxuvhn5r6jjlxyjj4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--746c547a-711b-a61a-101a-000037c31d7f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/","pattern":"[url:value = 'http://novadmrkp4vbk2padk5t6pbxolndceuc7hrcq4mjaoyed6nxsqiuzyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fed41ff-cc85-3991-e769-00007d3791ed","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://novaxtychr6ohlc4zr5its73p6i7unpuhpwoodtzrg2y4w4seytatlid.onion/","pattern":"[url:value = 'http://novaxtychr6ohlc4zr5its73p6i7unpuhpwoodtzrg2y4w4seytatlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9c505fe-7195-464c-5267-0000dd55d9f7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pifk3xu3vad6cuxsjll4qjomyaaaoyvnyqppro75pazadzctrrvpdnyd.onion/","pattern":"[url:value = 'http://pifk3xu3vad6cuxsjll4qjomyaaaoyvnyqppro75pazadzctrrvpdnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f95c9168-f92c-62c0-5ea4-0000b835794b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ms5fasbpbfpbxmgtrhcspvg5ajmb2tpxdcg7x2wdd6equemuivqi5syd.onion/","pattern":"[url:value = 'http://ms5fasbpbfpbxmgtrhcspvg5ajmb2tpxdcg7x2wdd6equemuivqi5syd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47ad4b21-33e0-8a7c-acc4-0000761320a5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://noval3kb6snxuofmqmw2we3cvzci2tfknurgxi7gdyet55xh6zhno5id.onion/","pattern":"[url:value = 'https://noval3kb6snxuofmqmw2we3cvzci2tfknurgxi7gdyet55xh6zhno5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78148d0f-b51a-4555-b8e4-00006bdd3090","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://novaeogps7purkdhxmaymmnanqiwtqf3r3iu3we4khkzwegkoefbxnyd.onion/","pattern":"[url:value = 'https://novaeogps7purkdhxmaymmnanqiwtqf3r3iu3we4khkzwegkoefbxnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1846d38-7825-9ad0-901a-0000e488a3e4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://raaskpzmkcoraswmzotjkzplq3aw6mcbogvd5uzbgsnhqb7az3ax2qid.onion/","pattern":"[url:value = 'https://raaskpzmkcoraswmzotjkzplq3aw6mcbogvd5uzbgsnhqb7az3ax2qid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8321a18b-8c53-d751-0374-0000e2632cba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://npnlc7i2mxnngj6angcj5pwesbaapksstqqez2qmtgmimezcpo4haryd.onion/","pattern":"[url:value = 'https://npnlc7i2mxnngj6angcj5pwesbaapksstqqez2qmtgmimezcpo4haryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c289657-e0c0-afba-49e3-00008f2bf8d1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://nova25eabfdep76t52dt34n2qdrhrn7vxuaeitcy5x2ovxnut767bwid.onion/","pattern":"[url:value = 'https://nova25eabfdep76t52dt34n2qdrhrn7vxuaeitcy5x2ovxnut767bwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44d676af-f33e-b2ec-5504-00003087f626","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://nova5cr2op6uo73korzmzkvil2btj3erjaujwtbbvtpko3yx7ivq3myd.onion/","pattern":"[url:value = 'https://nova5cr2op6uo73korzmzkvil2btj3erjaujwtbbvtpko3yx7ivq3myd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcf3d211-4bea-5fac-1197-00007e28886e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://novazzitmugtbjwuttc5hhsemkmvwh3iyt27oeeunu5mkw62qpfeykid.onion/","pattern":"[url:value = 'https://novazzitmugtbjwuttc5hhsemkmvwh3iyt27oeeunu5mkw62qpfeykid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c285ac96-968c-5741-9eb6-000092880564","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://leak7y2247fj7dbb35rpfyxuyaqtwbshiwxp6h35ttzlhrxmhvi4fead.onion/","pattern":"[url:value = 'http://leak7y2247fj7dbb35rpfyxuyaqtwbshiwxp6h35ttzlhrxmhvi4fead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cd7c5da-932c-550e-598d-0000da529178","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://vctmy3tytuah2offux4bixzunh53pnepsnsrr2hly6blpgiewqodnzad.onion/","pattern":"[url:value = 'https://vctmy3tytuah2offux4bixzunh53pnepsnsrr2hly6blpgiewqodnzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad05de29-9af3-ba72-8e65-0000ac3b2472","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://novaoddh3vxylxqpsfdjprliknbzgbkv6nkazpzu3cvykrgpyzuywryd.onion/","pattern":"[url:value = 'https://novaoddh3vxylxqpsfdjprliknbzgbkv6nkazpzu3cvykrgpyzuywryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--164fd50b-669b-23ff-47a1-0000e20fc702","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://novag4k2te3mstt2xq5irywlpaw6edgkpiwgg4t2q7eecisj2qqtvbid.onion/","pattern":"[url:value = 'https://novag4k2te3mstt2xq5irywlpaw6edgkpiwgg4t2q7eecisj2qqtvbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18f5e9e7-2d50-3f26-27d4-00001ab0cda5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://novatd4577pzlvdyy42slydhrhru7fpcflbbxlajcmbfrgzyeis6d3id.onion/","pattern":"[url:value = 'https://novatd4577pzlvdyy42slydhrhru7fpcflbbxlajcmbfrgzyeis6d3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53d66f05-f53e-7ccf-06dc-00007f68879f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://novavagygnhqyf7a5tgbuvmujve5a2jzgbrq2n4dvetkhvr2zjg27cad.onion/","pattern":"[url:value = 'http://novavagygnhqyf7a5tgbuvmujve5a2jzgbrq2n4dvetkhvr2zjg27cad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0830e479-665e-1726-4aa8-0000b39d103d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://novav75eqkjoxct7xuhhwnjw5uaaxvznhtbykq6zal5x7tfevxzjyqyd.onion/","pattern":"[url:value = 'http://novav75eqkjoxct7xuhhwnjw5uaaxvznhtbykq6zal5x7tfevxzjyqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64d5e228-3b40-2794-dda9-000058d9e5a7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://novaeogps7purkdhxmaymmnanqiwtqf3r3iu3we4khkzwegkoefbxnyd.onion/","pattern":"[url:value = 'http://novaeogps7purkdhxmaymmnanqiwtqf3r3iu3we4khkzwegkoefbxnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8aaede29-6862-4a62-8ddb-0000ed3f5e35","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bitdefender.com/blog/businessinsights/bitdefender-threat-debrief-june-2025","pattern":"[url:value = 'https://www.bitdefender.com/blog/businessinsights/bitdefender-threat-debrief-june-2025']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d44ff51-afe8-7e49-092c-00007b9d79ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://asec.ahnlab.com/en/88240/","pattern":"[url:value = 'https://asec.ahnlab.com/en/88240/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a5cfb9b-edc4-6082-8612-000090a5371c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/datacarry","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/datacarry']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8e5c433-54ba-02a5-2842-0000adad1a62","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/datacarry","pattern":"[url:value = 'https://www.ransomlook.io/group/datacarry']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a38bf3e6-e65a-2a96-9670-00001ce201c9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dcarryhaih5oldidg3tbqwnde4lxljytnpvberrwgj2vlvunopd46dad.onion/","pattern":"[url:value = 'http://dcarryhaih5oldidg3tbqwnde4lxljytnpvberrwgj2vlvunopd46dad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--494a3432-4a4c-857f-3ee4-0000feba2f60","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/worldleaks","pattern":"[url:value = 'https://www.ransomlook.io/group/worldleaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a538634e-b7c8-4066-470a-0000e8a0653b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies/","pattern":"[url:value = 'https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3410022a-7c02-0b3a-7d72-0000ee2df44a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jf2zjpxfh3sob5xr6uc53k7rt4y4vl6rt6bdynd3ptuv4cu5yi43elad.onion/","pattern":"[url:value = 'http://jf2zjpxfh3sob5xr6uc53k7rt4y4vl6rt6bdynd3ptuv4cu5yi43elad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c929528-c1df-79e1-bfe1-0000d01fdecd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://silentbgdghp3zeldwpumnwabglreql7jcffhx5vqkvtf2lshc4n5zid.onion/","pattern":"[url:value = 'http://silentbgdghp3zeldwpumnwabglreql7jcffhx5vqkvtf2lshc4n5zid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--985435b8-22c3-ac7c-ac7d-0000f10cbdc5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://theravenfile.com/2025/09/23/gunra-ransomware-what-you-dont-know/","pattern":"[url:value = 'https://theravenfile.com/2025/09/23/gunra-ransomware-what-you-dont-know/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91747840-1a89-0471-3d38-000034628e24","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://watchguard.com/wgrd-security-hub/ransomware-tracker/gunra","pattern":"[url:value = 'https://watchguard.com/wgrd-security-hub/ransomware-tracker/gunra']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e268ef41-208a-8f08-6d27-00001fa1a4f2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://industrialcyber.co/ransomware/cyfirma-warns-of-gunra-ransomware-surge-targeting-critical-infrastructure-using-double-extortion","pattern":"[url:value = 'https://industrialcyber.co/ransomware/cyfirma-warns-of-gunra-ransomware-surge-targeting-critical-infrastructure-using-double-extortion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--861b3dfc-58cc-90c9-6a58-0000a8254ece","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.darkreading.com/threat-intelligence/nimble-gunra-ransomware-linux-variant","pattern":"[url:value = 'https://www.darkreading.com/threat-intelligence/nimble-gunra-ransomware-linux-variant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4736c95-83d8-4bd9-5fcc-00000fea3b5c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/g/gunra-ransomware-linux-variant.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/g/gunra-ransomware-linux-variant.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74ef7ac6-198a-602d-7e06-00008431c1bd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/gunra","pattern":"[url:value = 'https://www.ransomlook.io/group/gunra']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd160954-ca29-4933-78d7-0000bad5cd67","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://raas.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion","pattern":"[url:value = 'http://raas.lgiil72vkmdtbc3qv4tyq6wedyjxqr2qd4ze7xl2cxgerdnymxj7soqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2696f388-f6d3-fd05-1c53-00003dad8bbf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion/","pattern":"[url:value = 'http://nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f83e14c2-eed9-920e-66de-00008992cd86","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ryrw2ojab62yij4y33ssfgvm2d2vwt3tcqetu6qmpwznqhooqxz3wpqd.onion/","pattern":"[url:value = 'http://ryrw2ojab62yij4y33ssfgvm2d2vwt3tcqetu6qmpwznqhooqxz3wpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4b5be4a-6007-15cf-2cad-000048368939","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6oeuvb4fq65xlrft2ezxjmkeqnu7oafbsevrr3ocer27wft6ivvhstqd.onion/","pattern":"[url:value = 'http://6oeuvb4fq65xlrft2ezxjmkeqnu7oafbsevrr3ocer27wft6ivvhstqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd608ef1-7501-b10f-1ad8-0000a8c28869","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://myeli53ogsryjg2kob4xqxtwkr5oc5zj7jr5fcfizpytwe566k5thxyd.onion/","pattern":"[url:value = 'http://myeli53ogsryjg2kob4xqxtwkr5oc5zj7jr5fcfizpytwe566k5thxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ef7f8e3-eaaf-ce85-5255-0000a06e2733","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tgsst34i6z4mwdj2kpigixxb3k3xfz7xhuqnsowvfvyu3snm6nv4s5ad.onion/","pattern":"[url:value = 'http://tgsst34i6z4mwdj2kpigixxb3k3xfz7xhuqnsowvfvyu3snm6nv4s5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40a95439-bb0e-e730-b5ea-0000ae1118ed","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion","pattern":"[url:value = 'http://nsnhzysbntsqdwpys6mhml33muccsvterxewh5rkbmcab7bg2ttevjqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dd82486-ac9a-0c8a-a52b-0000682e99b1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vrlgjxbl6yroq26xkcjpafgmmxrlpawvr4agppna6apfxjxav2mq66ad.onion","pattern":"[url:value = 'http://vrlgjxbl6yroq26xkcjpafgmmxrlpawvr4agppna6apfxjxav2mq66ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a433100-08a2-ed4f-7414-0000ddfe52bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jzbhtsuwysslrzi2n5is3gmzsyh6ayhm7jt3xowldhk7rej4dqqubxqd.onion/","pattern":"[url:value = 'http://jzbhtsuwysslrzi2n5is3gmzsyh6ayhm7jt3xowldhk7rej4dqqubxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c6c9fe0-035e-69d3-79a7-0000ef492e34","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2bw7r32r5eshwk2h7uekj3lwzorxds2jyhyzqyilphid3r27x5hsf4yd.onion","pattern":"[url:value = 'http://2bw7r32r5eshwk2h7uekj3lwzorxds2jyhyzqyilphid3r27x5hsf4yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--139f8813-feac-3dc5-af01-000079fcc402","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion/","pattern":"[url:value = 'http://gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18602f83-2ff9-8fa9-daed-000048abb95a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ransombay","pattern":"[url:value = 'https://www.ransomlook.io/group/ransombay']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2026c717-0acd-7603-f1c4-0000bba9340f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rrrbaygxp3f2qtgvfqk6ffhdrm24ucxvbr6mhxsga4faefqyd77w7tqd.onion/","pattern":"[url:value = 'http://rrrbaygxp3f2qtgvfqk6ffhdrm24ucxvbr6mhxsga4faefqyd77w7tqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--161b9cab-47a0-0b0b-17d8-000076cafbc3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rrrbayguhgtgxrdg5myxkdc2cxei25u6brknfqkl3a35nse7f2arblyd.onion/","pattern":"[url:value = 'http://rrrbayguhgtgxrdg5myxkdc2cxei25u6brknfqkl3a35nse7f2arblyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc4330b9-6818-ee16-e013-00000e6aa614","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rrrbay3nf4c2wxmhprc6eotjlpqkeowfuobodic4x4nzqtosx3ebirid.onion/","pattern":"[url:value = 'http://rrrbay3nf4c2wxmhprc6eotjlpqkeowfuobodic4x4nzqtosx3ebirid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf2e9370-5215-7822-edd6-0000263df957","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cyberex","pattern":"[url:value = 'https://www.ransomlook.io/group/cyberex']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--846e9488-5880-3f5e-b030-0000a4770c53","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wun2vkbns2ypyxfe7wffycdgbxsym564eamfk27py3pesqxikqpqfoyd.onion","pattern":"[url:value = 'http://wun2vkbns2ypyxfe7wffycdgbxsym564eamfk27py3pesqxikqpqfoyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f01390d0-e457-dfb4-ee35-00008c00bbaa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p6lm43x2ntdgx5ixdqfmhrniz7rxv7xtiudbyicwcpir6oeig7jhrfyd.onion","pattern":"[url:value = 'http://p6lm43x2ntdgx5ixdqfmhrniz7rxv7xtiudbyicwcpir6oeig7jhrfyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fefe7b60-9ae8-25aa-dde5-00002a6ff156","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dire-wolf","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dire-wolf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c89fb274-e951-ba98-cbfa-000011cdc705","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.darkreading.com/threat-intelligence/dire-wolf-ransomware-manufacturing-technology","pattern":"[url:value = 'https://www.darkreading.com/threat-intelligence/dire-wolf-ransomware-manufacturing-technology']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1955ba77-310a-4751-bbc3-0000a0e3d82b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/dire-wolf-strikes-new-ransomware-group-targeting-global-sectors/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/dire-wolf-strikes-new-ransomware-group-targeting-global-sectors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c4341b2-097b-b7ef-9845-0000341b01e2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/direwolf","pattern":"[url:value = 'https://www.ransomlook.io/group/direwolf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f736d93e-10e1-379a-66e6-000045c3660c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://direwolf66s5zealav7azcyqeipiswecvvnapyuby3dek473kyqfucad.onion","pattern":"[url:value = 'http://direwolf66s5zealav7azcyqeipiswecvvnapyuby3dek473kyqfucad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72b80707-54a3-37d1-a3dd-00007bc2fe20","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://direwolfgpyqohwxwoetsz7a6p72diu32c3wfysqdx4ei6bwft7zh3yd.onion/","pattern":"[url:value = 'http://direwolfgpyqohwxwoetsz7a6p72diu32c3wfysqdx4ei6bwft7zh3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--959c1a78-aaca-6a61-db05-0000e7005967","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/","pattern":"[url:value = 'http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33f899c4-3b01-b7a5-049b-00007135307c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.hivepro.com/threat-advisory/devman-ransomware-is-a-new-derivative-of-the-dragonforce-family/","pattern":"[url:value = 'https://www.hivepro.com/threat-advisory/devman-ransomware-is-a-new-derivative-of-the-dragonforce-family/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d64f97f-5139-2d11-0ff7-0000247a956b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/devman","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/devman']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87e21026-aa68-3b45-cf84-0000cc70ee7e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/devman-a-new-dragonforce-ransomware-variant","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/devman-a-new-dragonforce-ransomware-variant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a01f59b-43d9-bdee-f121-00001bfc37fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://medium.com/@anyrun/devman-ransomware-analysis-of-new-dragonforce-variant-ede707fd30b1","pattern":"[url:value = 'https://medium.com/@anyrun/devman-ransomware-analysis-of-new-dragonforce-variant-ede707fd30b1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ed8553c-b7d7-b6c3-ebeb-000096c3aac3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/devman","pattern":"[url:value = 'https://www.ransomlook.io/group/devman']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b95e2e4-a307-54f9-937b-0000b6b0cb3c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qljmlmp4psnn3wqskkf3alqquatymo6hntficb4rhq5n76kuogcv7zyd.onion/","pattern":"[url:value = 'http://qljmlmp4psnn3wqskkf3alqquatymo6hntficb4rhq5n76kuogcv7zyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aaacee1-b03c-6c74-b626-00003f2c4f65","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://theravenfile.com/2025/06/16/bert-ransomware/","pattern":"[url:value = 'https://theravenfile.com/2025/06/16/bert-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3ca1f90-26ef-dd20-cbf0-0000bf8ed8ad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.fortra.com/blog/bert-ransomware-what-you-need-know","pattern":"[url:value = 'https://www.fortra.com/blog/bert-ransomware-what-you-need-know']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e91bdd94-ac21-979b-4000-0000b09f27d5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.darkreading.com/cyber-risk/bert-blitzes-linux-windows-systems","pattern":"[url:value = 'https://www.darkreading.com/cyber-risk/bert-blitzes-linux-windows-systems']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a686ccc3-f127-f718-c1df-0000040bd346","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.halcyon.ai/blog/bert-ransomwares-first-moves-kill-the-vms-kill-the-backups","pattern":"[url:value = 'https://www.halcyon.ai/blog/bert-ransomwares-first-moves-kill-the-vms-kill-the-backups']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50d5de4f-68a8-8d5b-8d3c-000066b241c9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securityboulevard.com/2025/07/new-bert-ransomware-evolves-with-multiple-variants/","pattern":"[url:value = 'https://securityboulevard.com/2025/07/new-bert-ransomware-evolves-with-multiple-variants/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64cd9143-f5c4-98e9-ee6e-00000b257305","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.csoonline.com/article/4019468/trend-micro-flags-bert-a-rapidly-growing-ransomware-threat.html","pattern":"[url:value = 'https://www.csoonline.com/article/4019468/trend-micro-flags-bert-a-rapidly-growing-ransomware-threat.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f60d571-43d6-414f-0be0-000010b817b4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/bert","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/bert']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--752e87ee-b640-9c3f-3b5f-0000ff1ebb32","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bert","pattern":"[url:value = 'https://www.ransomlook.io/group/bert']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c56c227d-a747-6095-2c3b-00004be9d53b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wtwdv3ss4d637dka7iafl7737ucykei7pluzc7is3mgo2vl5nmq7eeid.onion/","pattern":"[url:value = 'http://wtwdv3ss4d637dka7iafl7737ucykei7pluzc7is3mgo2vl5nmq7eeid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ab68036-c7ad-07f8-18e1-0000cd115254","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bertblogsoqmm4ow7nqyh5ik7etsmefdbf25stauecytvwy7tkgizhad.onion/","pattern":"[url:value = 'http://bertblogsoqmm4ow7nqyh5ik7etsmefdbf25stauecytvwy7tkgizhad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b4ebf47-cf3d-f6a1-67e0-0000739a0090","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyfirma.com/research/tracking-ransomware-april-2025","pattern":"[url:value = 'https://www.cyfirma.com/research/tracking-ransomware-april-2025']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae4ac16b-1e72-9114-ba38-0000f41c2f40","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sangfor.com/blog/cybersecurity/vietnam-cmc-group-ransomware-attack-anatomy-asian-cyber-shock","pattern":"[url:value = 'https://www.sangfor.com/blog/cybersecurity/vietnam-cmc-group-ransomware-attack-anatomy-asian-cyber-shock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--464407fb-07c4-8a61-cf00-00007317ca97","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/crypto24","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/crypto24']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5949a8a-3849-2007-5d75-00006418ee90","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://exchange.xforce.ibmcloud.com/threats/guid%3Afa7cb7e2ed554da0b7413eca362ed8f8","pattern":"[url:value = 'https://exchange.xforce.ibmcloud.com/threats/guid%3Afa7cb7e2ed554da0b7413eca362ed8f8']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42708742-efd4-d260-c4cd-0000a3af63f2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/crypto24","pattern":"[url:value = 'https://www.ransomlook.io/group/crypto24']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c302b1f-dac0-916f-c93e-0000b3a56c3a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onion:5050/data","pattern":"[url:value = 'http://j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onion:5050/data']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95be9351-8c37-8fa9-5478-0000efbd46ee","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nnvsec.online/","pattern":"[url:value = 'http://nnvsec.online/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f47a1f7-ed06-66de-7914-00001b59792f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onion/","pattern":"[url:value = 'http://j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce20959c-5c3e-7644-6ff2-000037275a63","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/satanlock","pattern":"[url:value = 'https://www.ransomlook.io/group/satanlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e2ded3a-5be6-6c6c-956b-00007385f402","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://42fybwnnv2t6fykirmgxpwvvfidgnfmegrz4lpi3vskivfid7z7kqyqd.onion/","pattern":"[url:value = 'http://42fybwnnv2t6fykirmgxpwvvfidgnfmegrz4lpi3vskivfid7z7kqyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe08a5af-74fe-ba3f-efde-0000fbf99f93","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tzhwmgguyxrg6q3tu4q3gvopcjynrhw6ryx2bdl5ghisdkyunfua5xyd.onion/","pattern":"[url:value = 'http://tzhwmgguyxrg6q3tu4q3gvopcjynrhw6ryx2bdl5ghisdkyunfua5xyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01bef552-5773-cd92-7721-0000de5c3402","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://satanlock2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion","pattern":"[url:value = 'http://satanlock2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc660d87-585f-8775-93de-00000173f247","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2hxbnjzuymvdca4buxlyu4eolz4mbbxw2cnpibbb2od7z77y76di7cad.onion/","pattern":"[url:value = 'http://2hxbnjzuymvdca4buxlyu4eolz4mbbxw2cnpibbb2od7z77y76di7cad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e885d240-045f-40ee-8f99-0000aa3018b4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mgeegnexyhhn5dpqewihjy33qyhng3gy66h3fogiwefl5hljhtmfznad.onion/","pattern":"[url:value = 'http://mgeegnexyhhn5dpqewihjy33qyhng3gy66h3fogiwefl5hljhtmfznad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0f22463-33f2-03fd-572e-00001cbc42a1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://212.24.99.211","pattern":"[url:value = 'http://212.24.99.211']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4b26d1f-ca2a-40c9-8db7-00001630665d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mcafee","pattern":"[url:value = 'https://www.ransomlook.io/group/mcafee']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c5239b9-88c0-cc68-8c13-0000b5183d0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/blacksnake-ransomware-another-chaos-variant","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/blacksnake-ransomware-another-chaos-variant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1ef091d-4b96-4db1-983a-000001ff318c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.netskope.com/blog/netskope-threat-coverage-blacksnake-ransomware","pattern":"[url:value = 'https://www.netskope.com/blog/netskope-threat-coverage-blacksnake-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--850f84ac-ae49-f0bf-319e-0000eb44a1f1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blacksnake","pattern":"[url:value = 'https://www.ransomlook.io/group/blacksnake']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1c4d741-484d-1fa2-e0c5-0000d75ef789","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/frozen","pattern":"[url:value = 'https://www.ransomlook.io/group/frozen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9b7936a-a6cf-daee-81a1-0000be5ff477","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zerolockersec","pattern":"[url:value = 'https://www.ransomlook.io/group/zerolockersec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--776f3d59-71c8-7776-4f7a-000020fe6491","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ghfuviaplse6nbeowu7ghhid5hdowutbwbrv77aqgwco2b2ntgj3auad.onion","pattern":"[url:value = 'http://ghfuviaplse6nbeowu7ghhid5hdowutbwbrv77aqgwco2b2ntgj3auad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--915c9445-1f0c-113e-9134-0000f5d758d5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/nvrmre","pattern":"[url:value = 'https://www.ransomlook.io/group/nvrmre']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b3ea417-2e47-c360-450c-0000e6159446","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ioot5g6iwj26tcowu4646qyijf2sgeddggoxgch5r3oovkh6gfco3sqd.onion","pattern":"[url:value = 'http://ioot5g6iwj26tcowu4646qyijf2sgeddggoxgch5r3oovkh6gfco3sqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3d40ab0-238c-dbe0-bb91-00004a79452a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/taronis","pattern":"[url:value = 'https://www.ransomlook.io/group/taronis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fec47ac1-4a4a-95f2-b58d-00002dc22ef2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/farattack","pattern":"[url:value = 'https://www.ransomlook.io/group/farattack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2feca79a-2e6d-9526-f127-00004c08fcda","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mamona","pattern":"[url:value = 'https://www.ransomlook.io/group/mamona']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--616af6a2-9d07-8a8f-6ced-0000c10b02bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/","pattern":"[url:value = 'http://bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e824b6b-cbe7-e29e-3558-0000a0cf1523","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://185.158.113.114:5000/admin/login","pattern":"[url:value = 'http://185.158.113.114:5000/admin/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab5eebaa-e0d2-7ddb-f495-000011c0cb67","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://185.158.113.114:5000/affiliate/login","pattern":"[url:value = 'http://185.158.113.114:5000/affiliate/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b10e44e-8e0c-2cc9-28ac-0000a9d7c393","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion/","pattern":"[url:value = 'http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8a1c934-27e0-d977-5fb8-00006cfdf763","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/miliphen","pattern":"[url:value = 'https://www.ransomlook.io/group/miliphen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54067dad-bb0c-af98-6f1f-000056242947","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/skira","pattern":"[url:value = 'https://www.ransomlook.io/group/skira']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65ace69a-e39f-653d-ab55-0000d3b6c344","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mtgc3qvyedjnfu7cen2zsupdppi5ys5g2hm6xwujvoepw25p4dy6huid.onion/news.html","pattern":"[url:value = 'http://mtgc3qvyedjnfu7cen2zsupdppi5ys5g2hm6xwujvoepw25p4dy6huid.onion/news.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbbf9479-0fcb-f57b-aaa4-0000e1a5f7b9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/30382-deathgrip-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/30382-deathgrip-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68b597f5-5ee9-003b-1ae2-0000c272af23","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.enigmasoftware.com/deathgripransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/deathgripransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a457647-41dd-d29f-96d1-0000fe70b5fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/deathgrip-raas-small-time-threat-actors-aim-high-with-lockbit-yashma-builders","pattern":"[url:value = 'https://www.sentinelone.com/blog/deathgrip-raas-small-time-threat-actors-aim-high-with-lockbit-yashma-builders']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--977e008c-bccd-75b6-06fd-0000abe4fbe6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/deathgrip-emergence-of-a-new-ransomware-as-a-service","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/deathgrip-emergence-of-a-new-ransomware-as-a-service']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d803f77b-98fc-ec15-a406-00006e26e407","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/deathgrip","pattern":"[url:value = 'https://www.ransomlook.io/group/deathgrip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a793033e-8369-929e-a373-000098a81cae","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/thanos","pattern":"[url:value = 'https://www.ransomlook.io/group/thanos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d55a0344-3ced-b091-561c-000023768b4e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyclonis.com/remove-bidon-ransomware/","pattern":"[url:value = 'https://cyclonis.com/remove-bidon-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5569e75-4c74-83e7-b920-0000cb86bca5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/27412-bidon-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/27412-bidon-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f961a16c-1dbe-8572-2119-00003812ab75","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.enigmasoftware.com/bidonransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/bidonransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c484e9ca-c08d-9320-d935-00000d275960","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bidon","pattern":"[url:value = 'https://www.ransomlook.io/group/bidon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73fba9ff-b9db-a0fc-b0de-00001f445d04","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/eruption","pattern":"[url:value = 'https://www.ransomlook.io/group/eruption']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ac4eecf-13ad-7640-0630-000032714c82","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://bazaar.abuse.ch/browse/tag/DarkyLock/","pattern":"[url:value = 'https://bazaar.abuse.ch/browse/tag/DarkyLock/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1d8eeb5-42ba-5d85-3af7-00007f16fd30","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/24283-darky-lock-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/24283-darky-lock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55be775e-ca79-08f7-29c7-0000def337fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/darky-lock/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/darky-lock/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--160ae7ea-2263-68e4-2c05-0000a1e99cfb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/darkylock","pattern":"[url:value = 'https://www.ransomlook.io/group/darkylock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b81fb97f-1457-9931-5e7b-000013d4727f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/telegram","pattern":"[url:value = 'https://www.ransomlook.io/group/telegram']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0481401a-41ff-baa4-426d-00008f019fbf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/gazprom","pattern":"[url:value = 'https://www.ransomlook.io/group/gazprom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ade08c18-8142-a53b-ed93-0000d17f82f4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://elastio.com/detectable-ransomware/cerber-2021/","pattern":"[url:value = 'https://elastio.com/detectable-ransomware/cerber-2021/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5d55942-cb15-a1a9-ec90-00001aa8dc93","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/cerber2021-ransomware-back-in-action/","pattern":"[url:value = 'https://www.sentinelone.com/blog/cerber2021-ransomware-back-in-action/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1a84c6e-c73c-e04b-5683-000032fe8886","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-cerber-ransomware-targets-confluence-and-gitlab-servers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-cerber-ransomware-targets-confluence-and-gitlab-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--119847a7-cda0-935f-aaac-000069adccee","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cerberimposter","pattern":"[url:value = 'https://www.ransomlook.io/group/cerberimposter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d34de097-6244-0ff2-7711-00005a3925c9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/key","pattern":"[url:value = 'https://www.ransomlook.io/group/key']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebe55227-e798-c29d-cbfe-000091993c01","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/grinch","pattern":"[url:value = 'https://www.ransomlook.io/group/grinch']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9bcda6f-b435-d180-ead6-00000efd1b28","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vasalocker","pattern":"[url:value = 'https://www.ransomlook.io/group/vasalocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94b38aa8-4062-dd45-4952-0000b019db15","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cymulate.com/threats/catb-ransomware/","pattern":"[url:value = 'https://cymulate.com/threats/catb-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a902ee3-0f4f-34d7-95f9-0000a4dab1a5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.vmray.com/catb-ransomware-a-new-threat-exploiting-dll-side-loading/","pattern":"[url:value = 'https://www.vmray.com/catb-ransomware-a-new-threat-exploiting-dll-side-loading/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca475b2c-94cc-e309-395d-000074d6aa4c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.fortinet.com/blog/threat-research/ransomware-roundup-catb-ransomware","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/ransomware-roundup-catb-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc9d2c4f-02fb-35db-2a6b-0000383f0bf8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/decrypting-catb-ransomware-analyzing-their-latest-attack-methods/","pattern":"[url:value = 'https://www.sentinelone.com/blog/decrypting-catb-ransomware-analyzing-their-latest-attack-methods/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68155a80-a582-d700-0268-000038ca0f73","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/catb","pattern":"[url:value = 'https://www.ransomlook.io/group/catb']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0e76d1b-5cfe-6bd0-7d06-00000a386bee","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://asec.ahnlab.com/en/60537/","pattern":"[url:value = 'https://asec.ahnlab.com/en/60537/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc87e3cb-aa83-2505-bff3-00006f038a5f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74331a88-3d23-fafb-8153-000014ad942f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-kasseika-ransomware-emerges-with-links-to-blackmatter-lockbit/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-kasseika-ransomware-emerges-with-links-to-blackmatter-lockbit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdc84c3c-4b7c-b884-aa69-00001074136c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kasseika","pattern":"[url:value = 'https://www.ransomlook.io/group/kasseika']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98175766-c62e-c5ef-0180-0000ce05bcf0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kryptina","pattern":"[url:value = 'https://www.ransomlook.io/group/kryptina']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3da86b0-da89-bc4f-f10e-00003af7bf1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/weyhro","pattern":"[url:value = 'https://www.ransomlook.io/group/weyhro']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--028c25c2-8c9b-9b1c-b83e-00006aa0186e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://weyhro.hk","pattern":"[url:value = 'http://weyhro.hk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93f7dd19-6ae9-58e7-a7d4-0000f0ce012f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://weyhro27ruifvuqkk3hxzcrtxv2lsalntxgkv6q2j3znkhdqudz54rqd.onion/leaks","pattern":"[url:value = 'http://weyhro27ruifvuqkk3hxzcrtxv2lsalntxgkv6q2j3znkhdqudz54rqd.onion/leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--064dcfcd-7948-3a1a-171e-0000290eb617","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p7teg7yh2dwxg2tsbgnki3zrt5p7wgaegtfh4cobeqbhcq55nwt2m6yd.onion/files/?share=I1Ny5ax","pattern":"[url:value = 'http://p7teg7yh2dwxg2tsbgnki3zrt5p7wgaegtfh4cobeqbhcq55nwt2m6yd.onion/files/?share=I1Ny5ax']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--690ec5fa-17af-1d17-a315-00001d10bdcd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p7teg7yh2dwxg2tsbgnki3zrt5p7wgaegtfh4cobeqbhcq55nwt2m6yd.onion/","pattern":"[url:value = 'http://p7teg7yh2dwxg2tsbgnki3zrt5p7wgaegtfh4cobeqbhcq55nwt2m6yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9222db5-c690-4094-4d0f-0000c2a96297","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/tuborg","pattern":"[url:value = 'https://www.ransomlook.io/group/tuborg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b02923f9-3364-914c-49fb-0000b278e24c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyberscoop.com/mandiant-sabbath-arcane-ransomware-rebrand/","pattern":"[url:value = 'https://cyberscoop.com/mandiant-sabbath-arcane-ransomware-rebrand/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a719268-d3fb-a6c3-f650-0000d6c7768e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.anvilogic.com/threat-reports/unc2190-arcane-and-sabbath","pattern":"[url:value = 'https://www.anvilogic.com/threat-reports/unc2190-arcane-and-sabbath']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92421493-f8f1-5c5b-1c04-0000bd5fb47c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/arcane","pattern":"[url:value = 'https://www.ransomlook.io/group/arcane']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf5f17c6-e786-209c-4912-00009f036760","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyfirma.com/research/vanhelsing-ransomware/","pattern":"[url:value = 'https://www.cyfirma.com/research/vanhelsing-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66812e8f-013c-0ed2-20dc-00008fa7a3ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vanhelsing","pattern":"[url:value = 'https://www.ransomlook.io/group/vanhelsing']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15b56f54-a600-1e7c-ea65-0000c6adf3bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhel[REDACTED].onion\\nhttp://vanhel[REDACTED].onion\\nhttp://vanhel[REDACTED].onion","pattern":"[url:value = 'http://vanhel[REDACTED].onion\\\\nhttp://vanhel[REDACTED].onion\\\\nhttp://vanhel[REDACTED].onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--875a5dcc-1a80-d88d-b5d1-0000e868b1fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhel[REDACTED].onion\\n\\thttp://vanhel[REDACTED].onion\\n\\thttp://vanhel[REDACTED].onion\\n\\thttp://vanhel[REDACTED].onion\\n\\n3","pattern":"[url:value = 'http://vanhel[REDACTED].onion\\\\n\\\\thttp://vanhel[REDACTED].onion\\\\n\\\\thttp://vanhel[REDACTED].onion\\\\n\\\\thttp://vanhel[REDACTED].onion\\\\n\\\\n3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd07354c-ac49-7a26-ddd8-0000b1a366c2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.torproject.org/download/\\n2","pattern":"[url:value = 'https://www.torproject.org/download/\\\\n2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6febb2e4-49c5-f031-b4bc-0000bbb6ca77","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhelq3jf5afpkwwlcfm32sdblpfkx2cfa4kxaeoabtnxjpu2qnt7id.onion/","pattern":"[url:value = 'http://vanhelq3jf5afpkwwlcfm32sdblpfkx2cfa4kxaeoabtnxjpu2qnt7id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9e6adab-fd0d-cbce-b943-0000739b726f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhel4wqo425m7rdjolykd22js3hkrvpwld6iyvpjslj63l5ocaqoqd.onion/","pattern":"[url:value = 'http://vanhel4wqo425m7rdjolykd22js3hkrvpwld6iyvpjslj63l5ocaqoqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1561886e-68ed-519f-680f-00007fd0e01c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhelln5ly3sw63b5ke25gxvp5rr67wd7rgzezo4mhegm4qpsolbkqd.onion/","pattern":"[url:value = 'http://vanhelln5ly3sw63b5ke25gxvp5rr67wd7rgzezo4mhegm4qpsolbkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--282763a4-c03e-0a17-eabb-0000c1dd3d35","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion/","pattern":"[url:value = 'http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad45dd23-ee5e-aa34-c18d-0000fc5db3f7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion/","pattern":"[url:value = 'http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7410459-22b2-1c8a-ebc9-0000f2ace454","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion/","pattern":"[url:value = 'http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00af9e70-ce8e-5e3e-2b86-0000092c3413","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion/","pattern":"[url:value = 'http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d05025c-81bf-04ee-00b0-0000d38c047a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion/","pattern":"[url:value = 'http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccb56951-fdb7-4464-6ca8-0000963c9608","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion/","pattern":"[url:value = 'http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c55d846c-e28f-56ae-6f67-0000ff8e0729","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion/","pattern":"[url:value = 'http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f3a976c-7676-7f4a-cec3-00004db7b20a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mcrypt2019","pattern":"[url:value = 'https://www.ransomlook.io/group/mcrypt2019']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62e35bfa-7bdf-c0b0-3e42-00002c698497","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/offwhite","pattern":"[url:value = 'https://www.ransomlook.io/group/offwhite']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6acced57-3097-57fe-b8af-0000e4877ecb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.porthas.com/blog/b0-ransomware-decryption/","pattern":"[url:value = 'https://www.porthas.com/blog/b0-ransomware-decryption/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ebd020a-ecad-8c60-25dd-00007e076d95","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/b0","pattern":"[url:value = 'https://www.ransomlook.io/group/b0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf412fd2-bbce-f30f-30a6-000069bced24","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bzsn5crutf7eiq5mlohn2n2lkaqcafp6tsr6g5b3y4rxbq4g32bg3uid.onion/","pattern":"[url:value = 'http://bzsn5crutf7eiq5mlohn2n2lkaqcafp6tsr6g5b3y4rxbq4g32bg3uid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--789d3d0a-200e-4489-f1c8-00001db76747","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.scworld.com/news/medusalocker-ransomware-variant-paired-with-paid_memes-toolkit","pattern":"[url:value = 'https://www.scworld.com/news/medusalocker-ransomware-variant-paired-with-paid_memes-toolkit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2294485-617d-5c1c-cd97-0000c52f8e4a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/","pattern":"[url:value = 'https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23090193-4a97-ca01-9f64-00006be4cac1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/babylockerkz","pattern":"[url:value = 'https://www.ransomlook.io/group/babylockerkz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0d64506-0524-6ff3-a3f1-00001245f54d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/obsidian","pattern":"[url:value = 'https://www.ransomlook.io/group/obsidian']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfa766d7-5f3e-d34d-2ffc-000007a59cae","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hermes-ransomware-used-as-a-wiper-in-taiwan-bank-heist/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hermes-ransomware-used-as-a-wiper-in-taiwan-bank-heist/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3183e8d9-e3da-5d32-fb5f-00009438e05e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.symantec.com/blogs/threat-intelligence/hermes-ransomware","pattern":"[url:value = 'https://www.symantec.com/blogs/threat-intelligence/hermes-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4dce3b1-5a20-99fa-70f8-0000cadcefbd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/18/b/hermes-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/18/b/hermes-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9112abcd-d315-1add-e3f2-0000d34b5446","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/hermes","pattern":"[url:value = 'https://www.ransomlook.io/group/hermes']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f55d5948-e568-76a9-0ad4-0000f45c5277","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mailto","pattern":"[url:value = 'https://www.ransomlook.io/group/mailto']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--403e9d0a-6611-96aa-864b-0000fc6f29c4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sundawn","pattern":"[url:value = 'https://www.ransomlook.io/group/sundawn']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c3c4512-6bf3-829d-b9f0-000049b5f52b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.securityweek.com/ransomware-attack-knocks-100-romanian-hospitals-offline/","pattern":"[url:value = 'https://www.securityweek.com/ransomware-attack-knocks-100-romanian-hospitals-offline/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f0b18aa-d99f-31e2-aba9-00003550dca6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://gurucul.com/blog/backmydata-ransomware/","pattern":"[url:value = 'https://gurucul.com/blog/backmydata-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3117789e-b545-5d70-914e-000067cea65c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/backmydata/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/backmydata/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ce9fbbe-8c40-9f35-451a-00001528f422","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/backmydata","pattern":"[url:value = 'https://www.ransomlook.io/group/backmydata']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5671f59-7f89-7e9a-1c8e-00008997aa31","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-globe","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-globe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0f6122b-1fbd-af7c-5cf7-0000ec44cbb5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/10512-globe-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/10512-globe-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--261ba236-f1e8-6334-92eb-0000c2c4cb2d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/globe-ransomware-gives-you-the-opportunity-to-customize-your-encryption/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/globe-ransomware-gives-you-the-opportunity-to-customize-your-encryption/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1593deac-378c-9f7a-8975-000052a9cbd0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/globe","pattern":"[url:value = 'https://www.ransomlook.io/group/globe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bb86ba7-c391-dc4f-8e91-00006bf28702","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.superantispyware.com/blog/what-is-colossus-ransomware/","pattern":"[url:value = 'https://www.superantispyware.com/blog/what-is-colossus-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afcd60d2-d31f-0626-a4fd-0000fa5371f5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.securityweek.com/colossus-ransomware-hits-automotive-company-us/","pattern":"[url:value = 'https://www.securityweek.com/colossus-ransomware-hits-automotive-company-us/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39f04b73-67c7-1b9e-6fdf-00000cf1f74c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.zerofox.com/intelligence/flash-report-colossus-ransomware/","pattern":"[url:value = 'https://www.zerofox.com/intelligence/flash-report-colossus-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ab9866b-1a40-8a51-d6f3-00006f9055a0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/colossus","pattern":"[url:value = 'https://www.ransomlook.io/group/colossus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79e177b4-87da-d613-c597-000058e30635","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: colossus.support","pattern":"[domain-name:value = 'colossus.support']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d62f8210-3f57-9109-a9e1-00004a342198","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/27581-freeworld-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/27581-freeworld-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b31ccb6c-6681-2509-f337-000089b42593","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.darkreading.com/cyberattacks-data-breaches/mssql-databases-under-fire-from-freeworld-ransomware","pattern":"[url:value = 'https://www.darkreading.com/cyberattacks-data-breaches/mssql-databases-under-fire-from-freeworld-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6b4703c-4117-e7c9-3ad3-00003a3457ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/","pattern":"[url:value = 'https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de532eab-0543-d95c-4b18-0000d83efe93","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://thehackernews.com/2023/09/threat-actors-targeting-microsoft-sql.html","pattern":"[url:value = 'https://thehackernews.com/2023/09/threat-actors-targeting-microsoft-sql.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--105b1d76-2543-a377-51b4-0000a7dfb53c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/freeworld-ransomware","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/freeworld-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fce71a66-33eb-2730-7c83-0000366f7fc0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/freeworld","pattern":"[url:value = 'https://www.ransomlook.io/group/freeworld']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--527eac1e-8416-5388-d391-0000cf7a2206","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: FreeWorld-Contact.txt","pattern":"[domain-name:value = 'FreeWorld-Contact.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97148ca8-f7a5-8314-09a1-0000aef14adb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/secp0","pattern":"[url:value = 'https://www.ransomlook.io/group/secp0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c89da670-f714-f55b-667f-0000d664d9a0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://secp0-news.ws/","pattern":"[url:value = 'https://secp0-news.ws/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--792d67bb-644d-98cd-6d8c-0000521ef533","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://secp0-support.cfd/","pattern":"[url:value = 'https://secp0-support.cfd/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3c3136e-3ac4-6a1d-17aa-0000d5bd71df","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://secp0-support.net/","pattern":"[url:value = 'https://secp0-support.net/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02c4ffd0-7b15-0d9a-312d-000076d28b47","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion/","pattern":"[url:value = 'http://2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90f3c5b7-81ea-415d-298e-0000a65e2d06","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bhn2xz5jer2xeibxjzhgfp7qclttnbvkkvd4hvlmjbnz66jxq7yzn6ad.onion/","pattern":"[url:value = 'http://bhn2xz5jer2xeibxjzhgfp7qclttnbvkkvd4hvlmjbnz66jxq7yzn6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c467dda-86d3-b3f2-88bd-00007146161a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion/files/12b3429e1124122e/","pattern":"[url:value = 'http://secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion/files/12b3429e1124122e/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45eb7d06-d82c-c464-0e10-00005db20512","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://secp0-news.net/","pattern":"[url:value = 'https://secp0-news.net/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--602d6652-9f43-3ba9-7da4-0000ed362f44","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://any.run/malware-trends/fargo","pattern":"[url:value = 'https://any.run/malware-trends/fargo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ec00f1d-5488-5fd5-7dad-0000fc74abfc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fargo-ransomware-targeting-ms-sql-servers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fargo-ransomware-targeting-ms-sql-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e2c3a89-ceab-a722-c2c5-00000de3d725","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://asec.ahnlab.com/en/44987/","pattern":"[url:value = 'https://asec.ahnlab.com/en/44987/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53c502b9-e9d9-3c54-b5f3-0000e7c1d4df","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/fargo","pattern":"[url:value = 'https://www.ransomlook.io/group/fargo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56e465e4-ec7f-901a-5a2b-0000e5708407","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/elpaco-team-ransomware","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/elpaco-team-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ffece9c-73ee-8a75-2f09-00000f0321de","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://hivepro.com/wp-content/uploads/2024/12/TA2024453.pdf","pattern":"[url:value = 'https://hivepro.com/wp-content/uploads/2024/12/TA2024453.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b16e062a-8264-5614-8a6f-00003dfc6df0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securelist.com/elpaco-ransomware-a-mimic-variant/114635/","pattern":"[url:value = 'https://securelist.com/elpaco-ransomware-a-mimic-variant/114635/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1d41044-36e7-8342-a76a-0000489964ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/elpaco","pattern":"[url:value = 'https://www.ransomlook.io/group/elpaco']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35f615c5-bf38-3973-ed46-00000079a00d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyfirma.com/news/weekly-intelligence-report-07-feb-2025/","pattern":"[url:value = 'https://www.cyfirma.com/news/weekly-intelligence-report-07-feb-2025/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3272593e-1793-7c39-63c7-00000ff17b0b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.isvworld.com/search/news/1543268-aptlock-ransomware","pattern":"[url:value = 'https://www.isvworld.com/search/news/1543268-aptlock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a48ffbe-9c22-7044-6c9f-0000d095a26e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.enigmasoftware.com/aptlockransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/aptlockransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66ec0377-75d1-75a8-875f-00002759c68d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/31862-aptlock-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/31862-aptlock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b0c2842-41df-ae5c-da5c-0000d383feda","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/aptlock","pattern":"[url:value = 'https://www.ransomlook.io/group/aptlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24b63635-e857-d209-3a1e-00007dc8e53d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sr3b2uzrzzubagq64savzjjarul6bacpk6onddobj72gqkdjgm5z4qyd.onion/","pattern":"[url:value = 'http://sr3b2uzrzzubagq64savzjjarul6bacpk6onddobj72gqkdjgm5z4qyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aff4c569-1a63-d5a0-7bb4-00007287bc9f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: access.txt","pattern":"[domain-name:value = 'access.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36882461-4ad8-22b3-c61b-0000afe80e3b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/delta","pattern":"[url:value = 'https://www.ransomlook.io/group/delta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--004d8e2e-4000-e6bf-1dcd-00006bc8a6ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/rapture","pattern":"[url:value = 'https://www.ransomlook.io/group/rapture']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba961e26-2d75-9197-1e9b-0000059b76e8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mario","pattern":"[url:value = 'https://www.ransomlook.io/group/mario']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d14aa7a-e2ec-8580-1e3e-0000e322284b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/19/h/dharma-ransomware-continues-to-target-servers-via-open-rdp-ports.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/19/h/dharma-ransomware-continues-to-target-servers-via-open-rdp-ports.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6969afeb-fb1c-5e99-4f25-00004c30035c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cisa.gov/news-events/alerts/aa23-259a","pattern":"[url:value = 'https://www.cisa.gov/news-events/alerts/aa23-259a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6db9cfd7-3d82-0daf-ef1a-0000826fa6df","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/dharma-ransomware-switches-to-the-aes-256-encryption-algorithm/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/dharma-ransomware-switches-to-the-aes-256-encryption-algorithm/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70f6487b-0eae-3c6e-374e-0000c0ac504b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/dharma","pattern":"[url:value = 'https://www.ransomlook.io/group/dharma']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--597782a6-bb47-c10e-9b7b-0000ee577a73","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/grep","pattern":"[url:value = 'https://www.ransomlook.io/group/grep']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f8e2412-677e-be26-8de8-0000103c7d7e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://grep3ql4yhlmpq5zy3en5bvenvfhrpzb6bgnkxeyse6basc7x4sqhgqd.onion/","pattern":"[url:value = 'http://grep3ql4yhlmpq5zy3en5bvenvfhrpzb6bgnkxeyse6basc7x4sqhgqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3f51ce6-58be-5aa6-801a-000072b9b291","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/wiki","pattern":"[url:value = 'https://www.ransomlook.io/group/wiki']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f0aa110-1564-ac25-8a10-0000bf998217","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zixer2","pattern":"[url:value = 'https://www.ransomlook.io/group/zixer2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--663ecb27-60c4-6b40-421f-0000201b0683","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cybersecuritydive.com/news/veeam-cve-exploit-frag-ransomware/732670/","pattern":"[url:value = 'https://www.cybersecuritydive.com/news/veeam-cve-exploit-frag-ransomware/732670/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29d6c500-de2c-c7f8-4f7f-00002d4b116d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securityaffairs.com/170717/malware/veeam-backup-replication-flaw-frag-ransomware.html","pattern":"[url:value = 'https://securityaffairs.com/170717/malware/veeam-backup-replication-flaw-frag-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa256163-4cc2-0765-ecac-00008905bedc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyjax.com/resources/blog/frag-explodes-onto-the-scene-new-dls-emerges-for-frag-ransomware/","pattern":"[url:value = 'https://cyjax.com/resources/blog/frag-explodes-onto-the-scene-new-dls-emerges-for-frag-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0674a500-2693-478a-698f-0000706eb821","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/frag","pattern":"[url:value = 'https://www.ransomlook.io/group/frag']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73fc4166-abf9-b9fa-602a-0000e545323c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://34o4m3f26ucyeddzpf53bksy76wd737nf2fytslovwd3viac3by5chad.onion/tada/posts/leaks?page=1","pattern":"[url:value = 'http://34o4m3f26ucyeddzpf53bksy76wd737nf2fytslovwd3viac3by5chad.onion/tada/posts/leaks?page=1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f9ce1bd-4687-8e66-5859-0000872c35a0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://34o4m3f26ucyeddzpf53bksy76wd737nf2fytslovwd3viac3by5chad.onion/leaks/","pattern":"[url:value = 'http://34o4m3f26ucyeddzpf53bksy76wd737nf2fytslovwd3viac3by5chad.onion/leaks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0719ebd7-2144-6b74-0ed2-0000a551e4fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://34o4m3f26ucyeddzpf53bksy76wd737nf2fytslovwd3viac3by5chad.onion/","pattern":"[url:value = 'http://34o4m3f26ucyeddzpf53bksy76wd737nf2fytslovwd3viac3by5chad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4440e5a-1e60-d292-30a0-00007a6f460b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xhvzsaxl3vbio6dg547envq5xgap3pwobtursdvwatdoxextv43kb7id.onion","pattern":"[url:value = 'http://xhvzsaxl3vbio6dg547envq5xgap3pwobtursdvwatdoxextv43kb7id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--910ff85e-ea58-92f3-d2e9-0000de8e30a1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/blackbit-ransomware-imitates-lockbit-demands-bitcoin/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/blackbit-ransomware-imitates-lockbit-demands-bitcoin/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63923ed5-5d9c-6865-b463-000020f05b03","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/i/blackbit-ransomware-a-lockbit-imitation.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/i/blackbit-ransomware-a-lockbit-imitation.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ecf1c7e-c156-87db-4e8c-000047b582d6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blackbit","pattern":"[url:value = 'https://www.ransomlook.io/group/blackbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16fd1a9c-5b3d-9eb1-acb4-0000735e7056","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://blackbittk6ux3mtrbh2qjpmrkygdmh3uqafj5h2dg2bt63jzh5xf3iad.onion","pattern":"[url:value = 'http://blackbittk6ux3mtrbh2qjpmrkygdmh3uqafj5h2dg2bt63jzh5xf3iad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2f1b6a8-7ce5-a7cb-d7e7-00005b388260","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mortalkombat","pattern":"[url:value = 'https://www.ransomlook.io/group/mortalkombat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e4a1cb9-e3ce-90aa-fdf8-00004e8775ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.2-spyware.com/remove-cerbersyslock-ransomware.html","pattern":"[url:value = 'https://www.2-spyware.com/remove-cerbersyslock-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fdd2e39-c1a2-7b53-f25a-00002ca93c9b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cerbersyslock","pattern":"[url:value = 'https://www.ransomlook.io/group/cerbersyslock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ea798c3-3db9-c6bd-d036-000096b55b80","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/elcometa","pattern":"[url:value = 'https://www.ransomlook.io/group/elcometa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6991452-c92c-d713-036d-00003c334303","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/nightspire","pattern":"[url:value = 'https://www.ransomlook.io/group/nightspire']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99c944e9-e4e9-caf8-927d-000024e85e0d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p3reixfwlpjtein4yta3kiwyijxdktypcipz6jjq4wgbyi73e3fsmeyd.onion","pattern":"[url:value = 'http://p3reixfwlpjtein4yta3kiwyijxdktypcipz6jjq4wgbyi73e3fsmeyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0593fed0-4fe0-72b4-999d-00009ac67e56","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/","pattern":"[url:value = 'http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0fe3d3b-8e50-74b4-1a5e-0000eca5d8ca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion/","pattern":"[url:value = 'http://nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a43bcfe1-d2a8-6474-60ab-0000a13fdd38","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion/","pattern":"[url:value = 'http://nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b509c40-06c7-722e-1e3a-000032735cf7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion/","pattern":"[url:value = 'http://a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9ed5125-3aa3-5a0e-a452-0000b7eb339c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion/datas.php","pattern":"[url:value = 'http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion/datas.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c16b49e8-9d26-b665-ca4d-0000a85c88eb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion/server-info","pattern":"[url:value = 'http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion/server-info']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7b80f4b-2361-02fc-5630-0000ca9b0009","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion/","pattern":"[url:value = 'http://nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2477215c-1943-d817-adb1-0000d32e6322","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/oceans","pattern":"[url:value = 'https://www.ransomlook.io/group/oceans']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5575ebe1-d60e-19b9-f314-0000c1b350f8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mountlocker","pattern":"[url:value = 'https://www.ransomlook.io/group/mountlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f32637df-44ae-89e7-1e13-000030a91299","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/darkwave","pattern":"[url:value = 'https://www.ransomlook.io/group/darkwave']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0e0484f-a1b4-646a-2349-0000171aa8f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sm76tw7iliyprkyeywcac4s6fnqrkyujyezi3xdr4bkebz5edi2kh6ad.onion/","pattern":"[url:value = 'http://sm76tw7iliyprkyeywcac4s6fnqrkyujyezi3xdr4bkebz5edi2kh6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89bdb1e8-5cba-2647-bde4-00001b8994f7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/muliaka","pattern":"[url:value = 'https://www.ransomlook.io/group/muliaka']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b0ec3dc-b85c-1bce-3c30-0000778a205b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://s2w.inc/en/resource/detail/871","pattern":"[url:value = 'https://s2w.inc/en/resource/detail/871']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e544746d-1db3-02fa-a8d9-00008e9b2443","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://medium.com/s2wblog/detailed-analysis-of-ailock-ransomware-1d3263beff15","pattern":"[url:value = 'https://medium.com/s2wblog/detailed-analysis-of-ailock-ransomware-1d3263beff15']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9edca583-396f-e431-bcf3-00004b1036ba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://gbhackers.com/ailock-ransomware-emerges-with-hybrid-encryption-tactics/","pattern":"[url:value = 'https://gbhackers.com/ailock-ransomware-emerges-with-hybrid-encryption-tactics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65f85651-b392-32e3-0d3d-0000c68f81b0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.fortra.com/blog/ailock-ransomware","pattern":"[url:value = 'https://www.fortra.com/blog/ailock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8599dc16-67a2-30ea-e5ea-000048833b1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ailock","pattern":"[url:value = 'https://www.ransomlook.io/group/ailock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cee7ebb4-5c60-474a-6232-0000b5c54e50","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://eddo6w66t6t4kribwjbxvtehtsny4g6j2a5gj6pzivivcu5nywhegtqd.onion/","pattern":"[url:value = 'http://eddo6w66t6t4kribwjbxvtehtsny4g6j2a5gj6pzivivcu5nywhegtqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb0fe0da-2bda-3258-e3cf-0000baa91bce","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wqse4qzvrtbg5o3evt2eexovcilxpvlsopwvpu7toimx64njqekzuqid.onion/","pattern":"[url:value = 'http://wqse4qzvrtbg5o3evt2eexovcilxpvlsopwvpu7toimx64njqekzuqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13a67c7f-bcf4-3c19-0230-000017e45af7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pptiuraybrwacfl5v2qmzknenqxwt5eojtbh5cxxejaq3oo4bidkv7id.onion/","pattern":"[url:value = 'http://pptiuraybrwacfl5v2qmzknenqxwt5eojtbh5cxxejaq3oo4bidkv7id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39c5d004-e044-ecc9-649a-000099491e6b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ccpgp25zc37xccprbjr46iurz5c5awhqxltm6xn7nef7dxpsyegwncid.onion/","pattern":"[url:value = 'http://ccpgp25zc37xccprbjr46iurz5c5awhqxltm6xn7nef7dxpsyegwncid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf895b95-0945-c2c7-ba33-0000c2858011","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://q37z64a4j7455p6zcdxfpqrrgctmd46vaz2uejsqgxbmrcjbd4w3fqid.onion/","pattern":"[url:value = 'http://q37z64a4j7455p6zcdxfpqrrgctmd46vaz2uejsqgxbmrcjbd4w3fqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a46f2e23-439d-56aa-38db-00001877c856","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://44ga7x7kicz2bbxaohdfw5iw6j7dgg4kyctwtf4kh6gsxifbah4jv4ad.onion/","pattern":"[url:value = 'http://44ga7x7kicz2bbxaohdfw5iw6j7dgg4kyctwtf4kh6gsxifbah4jv4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1fa4b10-bf8a-d624-03ba-0000a6b56bc3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b26gczu5dbhaovnkp5c3ef3vdphqxj64z4nwzvfdabplbptgp56gsdyd.onion/","pattern":"[url:value = 'http://b26gczu5dbhaovnkp5c3ef3vdphqxj64z4nwzvfdabplbptgp56gsdyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89fdb013-d6d5-a2fe-fccb-0000cddf7817","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://epnsv5xaxnrks5yliq5wlthbmdlidkjddon3rx5llftx4ueiwfzdx6ad.onion/","pattern":"[url:value = 'http://epnsv5xaxnrks5yliq5wlthbmdlidkjddon3rx5llftx4ueiwfzdx6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e82057da-538f-7be1-f7ac-0000bafc1efb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://to3odzfolkvhkj3jf5oo3qq5hvdycy5n5n6bi564yrxdgavnwv5znjqd.onion/","pattern":"[url:value = 'http://to3odzfolkvhkj3jf5oo3qq5hvdycy5n5n6bi564yrxdgavnwv5znjqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--726ce107-2ff3-e982-0334-0000f258bc87","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qcncet2rpvs3t5lnvuzzth3vbro46snkylgyqx3igdnb5bv324nzojqd.onion/","pattern":"[url:value = 'http://qcncet2rpvs3t5lnvuzzth3vbro46snkylgyqx3igdnb5bv324nzojqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3499dd21-b3a6-8692-f56d-000070bcf9ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://igf7rlhjtvitxh72suhb55hqic67pvphbqikkrqqilzj3drhirglziyd.onion/","pattern":"[url:value = 'http://igf7rlhjtvitxh72suhb55hqic67pvphbqikkrqqilzj3drhirglziyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7114d78-ceb1-b79c-d54f-000081f36d4b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://woed7o3il2jrxzczupntvhutc2ogs5otn6ekgoya6qo33qcuhomkhwad.onion/","pattern":"[url:value = 'http://woed7o3il2jrxzczupntvhutc2ogs5otn6ekgoya6qo33qcuhomkhwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9824e703-9a2a-d9f9-1cdf-0000db0c7a95","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://27kmvzlfn3dpb6s4zq3qknqpcbrk5qzhwmg5awhjmu3m2okgpd4pgrid.onion/","pattern":"[url:value = 'http://27kmvzlfn3dpb6s4zq3qknqpcbrk5qzhwmg5awhjmu3m2okgpd4pgrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d4d84db-0946-9709-9215-00002228ff70","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tsz2oqrfnyik3vtcx5rzubfuam3n5kapvkkagqr7yzxdxvdhehjxghqd.onion/","pattern":"[url:value = 'http://tsz2oqrfnyik3vtcx5rzubfuam3n5kapvkkagqr7yzxdxvdhehjxghqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--889fe111-c9c8-4fc4-9be1-0000ce47c019","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fgx4uh7pzf4xr7k56opyfsy7qmg64xisiv5scgcadaddur7qiv6t3yyd.onion/","pattern":"[url:value = 'http://fgx4uh7pzf4xr7k56opyfsy7qmg64xisiv5scgcadaddur7qiv6t3yyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6daea0ea-5a9b-5688-bb9e-0000cf6a22b3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dwwnfgp43qjp5cy7n3ab6g5ubdxk4jkma37oykt6loeet7cyadtty5qd.onion/","pattern":"[url:value = 'http://dwwnfgp43qjp5cy7n3ab6g5ubdxk4jkma37oykt6loeet7cyadtty5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e8960a3-667d-6848-e159-0000ded1f6ca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tgyvw6pui3apxlezhiht5ubcmbm6fzn5klh2fi6qcqbvqhhfkyhnejad.onion/","pattern":"[url:value = 'http://tgyvw6pui3apxlezhiht5ubcmbm6fzn5klh2fi6qcqbvqhhfkyhnejad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aec7119d-bf20-cd02-3189-000057641aa0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mbqmgrf2kvabejqmoh4kl5tw5fko5pphzmmlbxhgjp5ar5ret7qpobad.onion/","pattern":"[url:value = 'http://mbqmgrf2kvabejqmoh4kl5tw5fko5pphzmmlbxhgjp5ar5ret7qpobad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--050ae485-0cc0-51f6-95ea-0000c94f4336","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tsz2oqrfnyik3vtcx5rzubfuam3n5kapvkkagqr7yzxdxvdhehjxghqd.onion/demanor.lst.zip","pattern":"[url:value = 'http://tsz2oqrfnyik3vtcx5rzubfuam3n5kapvkkagqr7yzxdxvdhehjxghqd.onion/demanor.lst.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--178cfafe-1c47-0c24-61d0-00004171dd5f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://s5v5hvtk3oyxg3m6afgxeuwlasqku3adeosv7kwwjfvhf22vqiwotrqd.onion/ardlaw.zip","pattern":"[url:value = 'http://s5v5hvtk3oyxg3m6afgxeuwlasqku3adeosv7kwwjfvhf22vqiwotrqd.onion/ardlaw.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e7ace54-9bf4-8ec1-05be-00007a6aa1ae","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://27kmvzlfn3dpb6s4zq3qknqpcbrk5qzhwmg5awhjmu3m2okgpd4pgrid.onion/oozooree.html","pattern":"[url:value = 'http://27kmvzlfn3dpb6s4zq3qknqpcbrk5qzhwmg5awhjmu3m2okgpd4pgrid.onion/oozooree.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf817052-5a74-9939-449f-00002ece758f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://woed7o3il2jrxzczupntvhutc2ogs5otn6ekgoya6qo33qcuhomkhwad.onion/goolooqu.html","pattern":"[url:value = 'http://woed7o3il2jrxzczupntvhutc2ogs5otn6ekgoya6qo33qcuhomkhwad.onion/goolooqu.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf9dfd27-b726-0d35-ec8d-0000e6d8657d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qcncet2rpvs3t5lnvuzzth3vbro46snkylgyqx3igdnb5bv324nzojqd.onion/tiohaedai.html","pattern":"[url:value = 'http://qcncet2rpvs3t5lnvuzzth3vbro46snkylgyqx3igdnb5bv324nzojqd.onion/tiohaedai.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1b95c41-8e52-f490-eb84-0000219dbb88","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://to3odzfolkvhkj3jf5oo3qq5hvdycy5n5n6bi564yrxdgavnwv5znjqd.onion/eishohzu.html","pattern":"[url:value = 'http://to3odzfolkvhkj3jf5oo3qq5hvdycy5n5n6bi564yrxdgavnwv5znjqd.onion/eishohzu.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6cf44f8-ac4f-bb35-ee7e-0000d06f3220","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://epnsv5xaxnrks5yliq5wlthbmdlidkjddon3rx5llftx4ueiwfzdx6ad.onion/iviilumu.html","pattern":"[url:value = 'http://epnsv5xaxnrks5yliq5wlthbmdlidkjddon3rx5llftx4ueiwfzdx6ad.onion/iviilumu.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2484d208-7126-913f-c4c2-0000a3bef496","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x7ghos27bltjtfombanecwgynfk4jw53ewkhzfnb5f27qmuquxwzhyad.onion/elo.lst.zip","pattern":"[url:value = 'http://x7ghos27bltjtfombanecwgynfk4jw53ewkhzfnb5f27qmuquxwzhyad.onion/elo.lst.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--baf901a3-7d2b-d108-480d-0000f232ddd4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x7ghos27bltjtfombanecwgynfk4jw53ewkhzfnb5f27qmuquxwzhyad.onion/","pattern":"[url:value = 'http://x7ghos27bltjtfombanecwgynfk4jw53ewkhzfnb5f27qmuquxwzhyad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f71fce5d-c82e-0615-d4df-000048630f8f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b26gczu5dbhaovnkp5c3ef3vdphqxj64z4nwzvfdabplbptgp56gsdyd.onion/ohtohcho.html","pattern":"[url:value = 'http://b26gczu5dbhaovnkp5c3ef3vdphqxj64z4nwzvfdabplbptgp56gsdyd.onion/ohtohcho.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2aa3c37-efbb-b41b-6400-000090a28570","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://44ga7x7kicz2bbxaohdfw5iw6j7dgg4kyctwtf4kh6gsxifbah4jv4ad.onion/piehixieru.html","pattern":"[url:value = 'http://44ga7x7kicz2bbxaohdfw5iw6j7dgg4kyctwtf4kh6gsxifbah4jv4ad.onion/piehixieru.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adfff505-c757-b195-4bc4-0000b6747d9d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://q37z64a4j7455p6zcdxfpqrrgctmd46vaz2uejsqgxbmrcjbd4w3fqid.onion/aephaaghoa.html","pattern":"[url:value = 'http://q37z64a4j7455p6zcdxfpqrrgctmd46vaz2uejsqgxbmrcjbd4w3fqid.onion/aephaaghoa.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5552723-b502-f452-edbf-00000fb9aafc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ccpgp25zc37xccprbjr46iurz5c5awhqxltm6xn7nef7dxpsyegwncid.onion/fjuk.html","pattern":"[url:value = 'http://ccpgp25zc37xccprbjr46iurz5c5awhqxltm6xn7nef7dxpsyegwncid.onion/fjuk.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31fa19a7-82bd-c752-4a3d-0000ee29bc60","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pptiuraybrwacfl5v2qmzknenqxwt5eojtbh5cxxejaq3oo4bidkv7id.onion/lwp.html","pattern":"[url:value = 'http://pptiuraybrwacfl5v2qmzknenqxwt5eojtbh5cxxejaq3oo4bidkv7id.onion/lwp.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c05ce23c-e84d-fe16-818f-0000d792d52b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wqse4qzvrtbg5o3evt2eexovcilxpvlsopwvpu7toimx64njqekzuqid.onion/hspass.html","pattern":"[url:value = 'http://wqse4qzvrtbg5o3evt2eexovcilxpvlsopwvpu7toimx64njqekzuqid.onion/hspass.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bc63be0-0801-34be-49be-000013211d88","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://eddo6w66t6t4kribwjbxvtehtsny4g6j2a5gj6pzivivcu5nywhegtqd.onion/pass.html","pattern":"[url:value = 'http://eddo6w66t6t4kribwjbxvtehtsny4g6j2a5gj6pzivivcu5nywhegtqd.onion/pass.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9fe3ccd-28c1-dbf9-1f19-000044f7e690","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ejqsesb5cgero35i7ujerpuslbokhuwl3dqgsrg44bzamamccf7fw3ad.onion/","pattern":"[url:value = 'http://ejqsesb5cgero35i7ujerpuslbokhuwl3dqgsrg44bzamamccf7fw3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcf6edd2-8f33-72fc-ad4d-0000c5757ea4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qvqoau7353xe7wm3z6fzxn33q63ck7cys56wsbx25c22fnxyu4fzhnyd.onion/","pattern":"[url:value = 'http://qvqoau7353xe7wm3z6fzxn33q63ck7cys56wsbx25c22fnxyu4fzhnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdea50ef-74f7-2f4f-f8e9-0000acac84bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dhnsppqjaaa22lsqxl2tfhji4ca43743kubltnodvsft3hkvai77p6ad.onion/","pattern":"[url:value = 'http://dhnsppqjaaa22lsqxl2tfhji4ca43743kubltnodvsft3hkvai77p6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48459586-c212-cde8-6cf4-00001b4ee994","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vnsggttwhcofyeh3nxoynxtg5mk5xl4cd7e3c4x62aqb2rj4rfjh3eqd.onion","pattern":"[url:value = 'http://vnsggttwhcofyeh3nxoynxtg5mk5xl4cd7e3c4x62aqb2rj4rfjh3eqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b2edf5a-bf45-981c-2c05-00004f2b3aec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jaawqs6wu56n2adj7qrjg25dhcux2nislvjouffpzldj23e4y72akoid.onion","pattern":"[url:value = 'http://jaawqs6wu56n2adj7qrjg25dhcux2nislvjouffpzldj23e4y72akoid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60131d92-a1f5-d73f-ec25-000071330492","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/buddyransome","pattern":"[url:value = 'https://www.ransomlook.io/group/buddyransome']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--228c491f-d06a-94fa-f3c8-000026b99a86","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/phantom","pattern":"[url:value = 'https://www.ransomlook.io/group/phantom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70af4d23-8edc-3fe8-6715-0000cdc33256","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/paradise","pattern":"[url:value = 'https://www.ransomlook.io/group/paradise']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5488a67c-9112-56e4-4f69-0000b2a3c4b3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zola","pattern":"[url:value = 'https://www.ransomlook.io/group/zola']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ce9e638-3aac-23fb-813f-00000ffcff4c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyclonis.com/remove-crynox-ransomware/","pattern":"[url:value = 'https://www.cyclonis.com/remove-crynox-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8438a731-1a29-697c-5705-0000189b583d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/31766-crynox-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/31766-crynox-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d44b915-6fa4-8a79-8612-0000aa2db4d0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://sensorstechforum.com/crynox-ransomware/","pattern":"[url:value = 'https://sensorstechforum.com/crynox-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--916f18c6-df72-cb3a-e6a3-00003e424b5d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/crynox","pattern":"[url:value = 'https://www.ransomlook.io/group/crynox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a51b936-81ee-1b1e-ef49-0000167b7dcf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: proton.me","pattern":"[domain-name:value = 'proton.me']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65fdc04a-76ee-3cdf-c85d-0000818d1432","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/proxima","pattern":"[url:value = 'https://www.ransomlook.io/group/proxima']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b10405f7-b673-58f0-6502-00003ee71016","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kuza","pattern":"[url:value = 'https://www.ransomlook.io/group/kuza']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f2f990c-f16e-157c-0872-0000f63eb0af","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/g/nefilim-ransomware-shifts-to-double-extortion.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/g/nefilim-ransomware-shifts-to-double-extortion.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67a442ad-d367-d999-f064-00003622c18c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/jsworm-ransomware-rebrands-to-nemty-with-new-encryption-routines/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/jsworm-ransomware-rebrands-to-nemty-with-new-encryption-routines/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4081e240-3e4d-64c8-2232-0000721beaf6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/jsworm-nemty-rebrands-to-avoid-detection/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/jsworm-nemty-rebrands-to-avoid-detection/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8acf54d-620a-a6c3-abbf-00003a9fa1fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/jsworm","pattern":"[url:value = 'https://www.ransomlook.io/group/jsworm']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--383a49c1-b514-0e03-195a-000083ac941f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vandev","pattern":"[url:value = 'https://www.ransomlook.io/group/vandev']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62f01c3a-87cd-2490-7935-000086408acb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/superblack","pattern":"[url:value = 'https://www.ransomlook.io/group/superblack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1fdce9a-f451-51bd-d281-000092870c28","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://heimdalsecurity.com/blog/astralocker-ransomware-goes-offline-and-makes-decryptors-available/","pattern":"[url:value = 'https://heimdalsecurity.com/blog/astralocker-ransomware-goes-offline-and-makes-decryptors-available/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07fed351-10d9-f9aa-657a-0000691848e9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.infosecinstitute.com/resources/malware-analysis/astralocker-releases-the-ransomware-decryptors/","pattern":"[url:value = 'https://www.infosecinstitute.com/resources/malware-analysis/astralocker-releases-the-ransomware-decryptors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ab2e36b-8f18-43e8-4ddb-0000e0c813ba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.emsisoft.com/en/ransomware-decryption/astralocker/","pattern":"[url:value = 'https://www.emsisoft.com/en/ransomware-decryption/astralocker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc58f6c9-86e6-0cc2-f744-00004d5e7720","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs","pattern":"[url:value = 'https://www.reversinglabs.com/blog/smash-and-grab-astralocker-2-pushes-ransomware-direct-from-office-docs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b749b0e-8929-93d3-f1b4-00003b358e3b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/astralocker","pattern":"[url:value = 'https://www.ransomlook.io/group/astralocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b518bbaa-70df-6e30-6f36-000034c47288","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyberpress.org/arkana-ransomware-group-alleges-breach/","pattern":"[url:value = 'https://cyberpress.org/arkana-ransomware-group-alleges-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8765df4f-a288-4098-5d0c-0000b4c8c3d3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securityweek.com/new-ransomware-group-claims-attack-on-us-telecom-firm-wideopenwest/","pattern":"[url:value = 'https://securityweek.com/new-ransomware-group-claims-attack-on-us-telecom-firm-wideopenwest/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eab0d6d-fc47-03b1-c511-000040d3196e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/arkana-security","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/arkana-security']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--047b61c7-cf53-31a2-e870-0000dba7373d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://vectra.ai/modern-attack/threat-actors/arkana-security","pattern":"[url:value = 'https://vectra.ai/modern-attack/threat-actors/arkana-security']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--557d13cd-ec4c-948d-e669-0000225a0cfb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyjax.com/resources/blog/who-broke-the-internet-arkana-security-names-us-broadband-provider-on-new-dls/","pattern":"[url:value = 'https://cyjax.com/resources/blog/who-broke-the-internet-arkana-security-names-us-broadband-provider-on-new-dls/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--509bf865-2e14-6611-df5b-000001d26d4c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/arkana","pattern":"[url:value = 'https://www.ransomlook.io/group/arkana']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e34adf31-ed91-fadf-14a7-00004176bbb4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ransomwvbabemdnwl7lzgeenyfmmhskaed6jcruwhkvapsia76vttzyd.onion/","pattern":"[url:value = 'http://ransomwvbabemdnwl7lzgeenyfmmhskaed6jcruwhkvapsia76vttzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8c26032-2219-acff-67fa-0000c30ebcd3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/paradise2","pattern":"[url:value = 'https://www.ransomlook.io/group/paradise2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af1c2b0d-8a73-aaed-630a-00009edf7774","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cylance","pattern":"[url:value = 'https://www.ransomlook.io/group/cylance']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28621a41-c26d-d97b-576b-000096bf58de","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/thunder","pattern":"[url:value = 'https://www.ransomlook.io/group/thunder']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13a84837-a675-32c7-c131-000035ff587f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/quoter","pattern":"[url:value = 'https://www.ransomlook.io/group/quoter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08e565db-c30b-e50f-9b17-0000bd401662","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/phalcon","pattern":"[url:value = 'https://www.ransomlook.io/group/phalcon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--624afc5c-1b79-f8ff-7305-0000bfd09427","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/j","pattern":"[url:value = 'https://www.ransomlook.io/group/j']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb9b13e0-5fa6-18c9-c85c-00005ba69ebb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://w4d5aqmdxkcsc2xwcz7w7jo6wdmvmakgy3y6mfmdtzmyvxe77cjkfbad.onion/","pattern":"[url:value = 'http://w4d5aqmdxkcsc2xwcz7w7jo6wdmvmakgy3y6mfmdtzmyvxe77cjkfbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fe2729d-2984-7250-2fee-000052b0f6a2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.semperis.com/blog/hospital-cyberattacks-highlight-active-directory-security-importance","pattern":"[url:value = 'https://www.semperis.com/blog/hospital-cyberattacks-highlight-active-directory-security-importance']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e38b004-aa8d-0296-5f70-00003fb8fb1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/32577-crazyhunter-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/32577-crazyhunter-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d0d4cc3-5ded-e4d9-1d18-000045e2114e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/crazyhunter-a-new-prince-ransomware-variant","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/crazyhunter-a-new-prince-ransomware-variant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90aa04ea-5644-c986-ef5c-0000026c9fba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://threats.wiz.io/all-incidents/crazyhunter-ransomware-group-targets-critical-sectors-in-taiwan","pattern":"[url:value = 'https://threats.wiz.io/all-incidents/crazyhunter-ransomware-group-targets-critical-sectors-in-taiwan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65bd5baf-1f73-2b54-7259-0000cacd1438","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://darkreading.com/threat-intelligence/ransomware-gang-crazyhunter-critical-taiwanese-orgs","pattern":"[url:value = 'https://darkreading.com/threat-intelligence/ransomware-gang-crazyhunter-critical-taiwanese-orgs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d51d2e86-a302-3927-54d2-000079cf47bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://labs.withsecure.com/publications/crazyhunter-ransomware","pattern":"[url:value = 'https://labs.withsecure.com/publications/crazyhunter-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e6b2507-df4b-6dca-aaa8-0000c3aa3b52","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/d/crazyhunter-campaign.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/d/crazyhunter-campaign.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9887676-533b-9ea3-412f-00003e0c84c7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/crazyhunter","pattern":"[url:value = 'https://www.ransomlook.io/group/crazyhunter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29d8960e-1cf4-f31d-e469-000051fb1ff7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7i6sfmfvmqfaabjksckwrttu3nsbopl3xev2vbxbkghsivs5lqp4yeqd.onion/","pattern":"[url:value = 'http://7i6sfmfvmqfaabjksckwrttu3nsbopl3xev2vbxbkghsivs5lqp4yeqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8292282b-1e8d-7b13-a62b-00008332b0ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/faust-ransomware-a-phobos-family-variant","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/faust-ransomware-a-phobos-family-variant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e8db1a5-149d-3c82-9628-00004512ba2f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.truesec.com/hub/blog/a-case-of-the-faust-ransomware","pattern":"[url:value = 'https://www.truesec.com/hub/blog/a-case-of-the-faust-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e497a236-5bbc-1b74-0bfd-000026ca04e4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2410a85-6e77-c898-00eb-0000e8bc05bb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/faust","pattern":"[url:value = 'https://www.ransomlook.io/group/faust']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f90e0493-48df-5017-4e7e-000088f7abfd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/polyvice","pattern":"[url:value = 'https://www.ransomlook.io/group/polyvice']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae24e40d-1822-37d2-acc3-0000fabf046a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/spring","pattern":"[url:value = 'https://www.ransomlook.io/group/spring']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4299a6e8-cd13-144c-91a9-00002209f47b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-29th-2022-new-operations-emerge/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-29th-2022-new-operations-emerge/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49669323-dec3-3c51-f0f6-000030c0a0ea","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.hivepro.com/wp-content/uploads/2022/05/New-Ransomware-Group-Axxes-is-on-the-rise_TA2022106.pdf","pattern":"[url:value = 'https://www.hivepro.com/wp-content/uploads/2022/05/New-Ransomware-Group-Axxes-is-on-the-rise_TA2022106.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d42d8b6c-9c92-801f-928e-000028136acb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cloudsek.com/threatintelligence/axxes-ransomware-group-appears-to-be-the-rebranded-version-of-midas-group","pattern":"[url:value = 'https://cloudsek.com/threatintelligence/axxes-ransomware-group-appears-to-be-the-rebranded-version-of-midas-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7547da7-0996-b33d-68ff-0000ded69cfa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/axxes","pattern":"[url:value = 'https://www.ransomlook.io/group/axxes']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4681a58c-c09f-5be5-b37e-000055965c16","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ymnbqd5gmtxc2wepkesq2ktr5qf4uga6wwrsbtktq7n5uvhqmbyaq4qd.onion/","pattern":"[url:value = 'http://ymnbqd5gmtxc2wepkesq2ktr5qf4uga6wwrsbtktq7n5uvhqmbyaq4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6788729e-c075-434e-ed4e-0000fd91c055","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.arcrypter.a","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.arcrypter.a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6aafdc2-03d8-7290-5dfb-0000f14cd250","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blogs.blackberry.com/2022/11/arcrypter-ransomware-expands-its-operations-from-latin-america-to-the-world","pattern":"[url:value = 'https://blogs.blackberry.com/2022/11/arcrypter-ransomware-expands-its-operations-from-latin-america-to-the-world']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7354fbb4-f1ea-23d6-a705-0000ad6fbe8a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/arcrypter","pattern":"[url:value = 'https://www.ransomlook.io/group/arcrypter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f713030b-4b0e-f862-dc7c-000057b0b8a5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/xollam","pattern":"[url:value = 'https://www.ransomlook.io/group/xollam']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--843af347-d657-8788-f771-0000783eb5a3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/proton","pattern":"[url:value = 'https://www.ransomlook.io/group/proton']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77704347-f7a7-9ae1-229c-00000af2b366","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/fakersa","pattern":"[url:value = 'https://www.ransomlook.io/group/fakersa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--feb689e8-7a93-ba2d-2ed9-00009bc4f1f3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/silent","pattern":"[url:value = 'https://www.ransomlook.io/group/silent']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe25a038-f911-a0d3-b2eb-00003b0d99d6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.hhs.gov/sites/default/files/trinity-ransomware-threat-actor-profile.pdf","pattern":"[url:value = 'https://www.hhs.gov/sites/default/files/trinity-ransomware-threat-actor-profile.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--943d458c-f315-e52e-d99d-0000c93f508f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/2023lock-ransomware","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/2023lock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03d048eb-190c-cd07-3fc7-0000efb26d35","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyble.com/blog/in-the-shadow-of-venus-trinity-ransomwares-covert-ties/","pattern":"[url:value = 'https://cyble.com/blog/in-the-shadow-of-venus-trinity-ransomwares-covert-ties/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb4917c5-b227-8839-021a-000069916c1c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/2023lock","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/2023lock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf7d977c-1288-b21e-5120-0000b929c579","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/2023lock","pattern":"[url:value = 'https://www.ransomlook.io/group/2023lock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3cdd963-4b8a-20dd-73e6-00000bc8f07f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ralord","pattern":"[url:value = 'https://www.ransomlook.io/group/ralord']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a032bd36-777d-06f8-7cc5-00004d2c5d59","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://novazzitmugtbjwuttc5hhsemkmvwh3iyt27oeeunu5mkw62qpfeykid.onion/","pattern":"[url:value = 'http://novazzitmugtbjwuttc5hhsemkmvwh3iyt27oeeunu5mkw62qpfeykid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eee1a12b-aa74-7b7c-ab6a-0000a07fb307","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ralordt7gywtkkkkq2suldao6mpibsb7cpjvdfezpzwgltyj2laiuuid.onion/","pattern":"[url:value = 'http://ralordt7gywtkkkkq2suldao6mpibsb7cpjvdfezpzwgltyj2laiuuid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fd1226f-a246-0a57-b1e2-0000e19b6dde","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ralord3htj7v2dkavss2hjzviviwgsf4anfdnihn5qcjl6eb5if3cuqd.onion/","pattern":"[url:value = 'http://ralord3htj7v2dkavss2hjzviviwgsf4anfdnihn5qcjl6eb5if3cuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bc079ee-0f20-586d-e9cf-00003293b860","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ralordqe33mpufkpsr6zkdatktlu3t2uei4ught3sitxgtzfmqmbsuyd.onion/","pattern":"[url:value = 'http://ralordqe33mpufkpsr6zkdatktlu3t2uei4ught3sitxgtzfmqmbsuyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da2b2d9c-4b98-0a84-064b-00008ce9a74f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/xelera","pattern":"[url:value = 'https://www.ransomlook.io/group/xelera']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b0dc766-09e0-432a-5351-00004226cf33","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/core-ransomware-a-new-makop-variant","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/core-ransomware-a-new-makop-variant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aab545af-df3b-0d1f-9ae9-00001057a31a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/core","pattern":"[url:value = 'https://www.ransomlook.io/group/core']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be2ee984-7f39-6b61-793e-00004120b326","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/targetcompany","pattern":"[url:value = 'https://www.ransomlook.io/group/targetcompany']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1b43c9b-e026-85c9-45fb-0000bacf1c24","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/enciphered","pattern":"[url:value = 'https://www.ransomlook.io/group/enciphered']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61ee9eaf-e08b-dfcd-285d-00008e223779","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mimic","pattern":"[url:value = 'https://www.ransomlook.io/group/mimic']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd437425-b86e-d256-562d-00006e766db0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lokilocker","pattern":"[url:value = 'https://www.ransomlook.io/group/lokilocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--738c67c0-e8c7-0b7d-a77b-0000ab6be1f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zeoticus2","pattern":"[url:value = 'https://www.ransomlook.io/group/zeoticus2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c79f4105-684d-980b-a1ec-00007b6f7713","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/gangbang","pattern":"[url:value = 'https://www.ransomlook.io/group/gangbang']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--438cb624-16a1-8288-3b5e-00009da36de4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.resecurity.com/blog/article/cyber-threats-against-energy-sector-surge-global-tensions-mount","pattern":"[url:value = 'https://www.resecurity.com/blog/article/cyber-threats-against-energy-sector-surge-global-tensions-mount']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--455e26ba-3858-4bf0-2f9f-000073b2c1fa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/antibrok3rs","pattern":"[url:value = 'https://www.ransomlook.io/group/antibrok3rs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aac3a2a-93d9-f31d-1872-00003b65b778","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://antibrok3rs.anonblogs.net/","pattern":"[url:value = 'http://antibrok3rs.anonblogs.net/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a01a567b-1214-9e29-84fd-0000bd51c117","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://antibrok3rs.bearblog.dev/","pattern":"[url:value = 'http://antibrok3rs.bearblog.dev/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7b07e7a-1792-f7c1-9056-0000d7cd4f0b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://antibrok3rs.ir/","pattern":"[url:value = 'http://antibrok3rs.ir/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff3ea02d-aea7-457a-3628-0000ab8531a0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.enigmasoftware.com/blackberserkransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/blackberserkransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67a0054c-8d0a-e8a0-15a2-0000265766c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/27387-black-berserk-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/27387-black-berserk-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77547513-1300-4439-66a5-0000d45840ae","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/blackberserk","pattern":"[url:value = 'https://www.ransomlook.io/group/blackberserk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b3bf8e5-588f-4cc4-12c2-0000c2819227","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: 1.jpg.Black","pattern":"[domain-name:value = '1.jpg.Black']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eda416d5-10e6-197a-81e9-0000b21760be","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/fusion","pattern":"[url:value = 'https://www.ransomlook.io/group/fusion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71d47ba9-f120-397d-2f30-00006faa95c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cisa.gov/news-events/analysis-reports/ar22-187a","pattern":"[url:value = 'https://www.cisa.gov/news-events/analysis-reports/ar22-187a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ece09e0c-cdc0-d0e9-ca3f-0000b2a4f9ca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.cyble.com/2023/06/14/anubis-banking-trojan-targets-multiple-countries","pattern":"[url:value = 'https://blog.cyble.com/2023/06/14/anubis-banking-trojan-targets-multiple-countries']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44ab689b-20c7-d8bb-ac6b-0000e9108934","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/19/j/anubis-malware-family-returns-with-new-variants.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/19/j/anubis-malware-family-returns-with-new-variants.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec026217-b7bc-9d64-7d65-000054da98be","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/anubis-android-banking-trojan-analysis","pattern":"[url:value = 'https://www.sentinelone.com/blog/anubis-android-banking-trojan-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51b576ca-76be-1a1c-098a-0000aa20cf1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/anubis-banking-trojan-targets-android-users","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/anubis-banking-trojan-targets-android-users']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbf3fb9c-686b-915a-524a-0000d3839f11","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/anubis","pattern":"[url:value = 'https://www.ransomlook.io/group/anubis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58b7790e-cd54-453d-f299-000055108c6c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://anubisyfkh5rixydjpoo3jqucauajz2juybrbtuglcppjj2y3eg3y6ad.onion/","pattern":"[url:value = 'http://anubisyfkh5rixydjpoo3jqucauajz2juybrbtuglcppjj2y3eg3y6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d60d696-b1f9-d916-ad98-000097388220","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion/","pattern":"[url:value = 'http://om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c5a1ad3-7380-f392-dd3d-0000402a8c6a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mimic-guram","pattern":"[url:value = 'https://www.ransomlook.io/group/mimic-guram']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9314b5e5-2a17-546d-2b79-0000d837d9f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ox","pattern":"[url:value = 'https://www.ransomlook.io/group/ox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6627930f-1fc7-73be-8a62-0000004c6e47","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://oxthiefsvzp3qifmkrpwcllwscyu7jvmdxmd2coz2rxpem6ohut6x5qd.onion/","pattern":"[url:value = 'http://oxthiefsvzp3qifmkrpwcllwscyu7jvmdxmd2coz2rxpem6ohut6x5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3984a19-31f7-21fd-2f2f-000013c3610b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ghost","pattern":"[url:value = 'https://www.ransomlook.io/group/ghost']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d8dcfca-4fa8-9d5f-f085-0000b7256209","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b947d81c-fa76-b8af-72ef-000040138427","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/encrypthub","pattern":"[url:value = 'https://www.ransomlook.io/group/encrypthub']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cfe6bc4-4ea2-b7c2-8afa-0000bedc1629","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/linkc","pattern":"[url:value = 'https://www.ransomlook.io/group/linkc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7fd8032-c791-234a-8a6d-00002b16624d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xs4psqhvekjle3qwyiav7dzccuo4ylw2eylvd3peuqrld74kzzjzhcyd.onion/","pattern":"[url:value = 'http://xs4psqhvekjle3qwyiav7dzccuo4ylw2eylvd3peuqrld74kzzjzhcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf333e71-67be-893d-1282-00005f503d6d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iywqjjaf2zioehzzauys3sktbcdmuzm2fsjkqsblnm7dt6axjfpoxwid.onion/","pattern":"[url:value = 'http://iywqjjaf2zioehzzauys3sktbcdmuzm2fsjkqsblnm7dt6axjfpoxwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09abeffe-046d-37cb-d824-0000d3ce8e3e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/run","pattern":"[url:value = 'https://www.ransomlook.io/group/run']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b931bd8-b7a3-eea8-a1ce-0000b7dc2829","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion","pattern":"[url:value = 'https://lmsxwm6hrd5osuefl6uia3wwnxxnlav2ce4d4nkjvuonb3426pwdmcad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a0deada-d042-9a77-1565-0000ae489289","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vnoa7t4c3wr6himmurl4it3ctvgmm6munjknuztqlu4nbz34367vokyd.onion","pattern":"[url:value = 'http://vnoa7t4c3wr6himmurl4it3ctvgmm6munjknuztqlu4nbz34367vokyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38e253ed-28b8-1692-63f8-00008ade8ba6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cvbu44wmzzslykypqkk3utdvrrdenrf5knvyrshhcvosfxa2un4tqrid.onion/","pattern":"[url:value = 'http://cvbu44wmzzslykypqkk3utdvrrdenrf5knvyrshhcvosfxa2un4tqrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--485bf013-90af-2814-c1a8-00000213310e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://oow7rehrxlzpy6vh3hezl2khstkpa6s7wx3iit74tr6xbjibupld5iad.onion/","pattern":"[url:value = 'http://oow7rehrxlzpy6vh3hezl2khstkpa6s7wx3iit74tr6xbjibupld5iad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51bb628f-83c1-f790-491b-000015677a63","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nidzkoszg57upoq7wcalm2xxeh4i6uumh36axsnqnj3i7lep5uhkehyd.onion/","pattern":"[url:value = 'http://nidzkoszg57upoq7wcalm2xxeh4i6uumh36axsnqnj3i7lep5uhkehyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73df4c9c-a4a5-cd2b-bfcb-00004adfcb05","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rnsmwareartse3m4hjsumjf222pnka6gad26cqxqmbjvevhbnym5p6ad.onion/","pattern":"[url:value = 'http://rnsmwareartse3m4hjsumjf222pnka6gad26cqxqmbjvevhbnym5p6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--355a9f5f-f84b-70a6-2f55-0000eef10229","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/darkhav0c","pattern":"[url:value = 'https://www.ransomlook.io/group/darkhav0c']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb78e2d3-49db-e1b9-4006-0000492fa64c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://afiocd14efgh5hu8ijkl9012m.onion","pattern":"[url:value = 'http://afiocd14efgh5hu8ijkl9012m.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4850459a-e3fb-7119-66ca-0000e2979274","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/robbing","pattern":"[url:value = 'https://www.ransomlook.io/group/robbing']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--088389be-dc90-c908-ca2c-0000a5466724","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fonektibq4fbgergrorw43yawhz3qslkonrwc74j2h2kftcidmf6g6id.onion/","pattern":"[url:value = 'http://fonektibq4fbgergrorw43yawhz3qslkonrwc74j2h2kftcidmf6g6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7151ff8f-7a4f-ae70-c479-000091578572","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/tooda","pattern":"[url:value = 'https://www.ransomlook.io/group/tooda']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8bdd03b-da85-4a52-e464-0000e8a04519","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tooda.sh","pattern":"[url:value = 'http://tooda.sh']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ffae8ac-78c2-3346-3455-0000efdb8373","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/w3crypto","pattern":"[url:value = 'https://www.ransomlook.io/group/w3crypto']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8136c709-d043-e63e-72a4-0000b0a6aab0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fdevb3qh24ak7wujqsf7co4z6fstm5qxvnkkgs62fayztjfjjtqqgsad.onion/","pattern":"[url:value = 'http://fdevb3qh24ak7wujqsf7co4z6fstm5qxvnkkgs62fayztjfjjtqqgsad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9872a74-9eee-259b-5b69-00001a4c8e14","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: late.lol","pattern":"[domain-name:value = 'late.lol']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15abb3d1-8132-a833-6509-0000f6d19da7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/late.lol","pattern":"[url:value = 'https://www.ransomlook.io/group/late.lol']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5540626-d1de-0125-f198-0000f2ea4d42","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://late.lol","pattern":"[url:value = 'https://late.lol']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74917b83-39f6-36b8-b763-00005cc6e3ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://asec.ahnlab.com/en/57154/","pattern":"[url:value = 'https://asec.ahnlab.com/en/57154/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53b5de53-ffc0-9b94-c924-00003e3c7a86","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/d/kuiper-ransomware-targets-multiple-platforms.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/d/kuiper-ransomware-targets-multiple-platforms.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93879eca-674d-704a-a020-0000f450e7bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kuiper","pattern":"[url:value = 'https://www.ransomlook.io/group/kuiper']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--290f82fd-0232-d08a-a2db-0000d060425c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/yashma","pattern":"[url:value = 'https://www.ransomlook.io/group/yashma']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a87cf586-bb6e-cd03-0df2-000021b60adb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.talosintelligence.com/new-threat-actor-using-yashma-ransomware/","pattern":"[url:value = 'https://blog.talosintelligence.com/new-threat-actor-using-yashma-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f4595e9-b73a-2be6-5838-000058089ed3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: nguyenvietphat.nt","pattern":"[domain-name:value = 'nguyenvietphat.nt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95cbe4e7-b6de-2121-c545-0000f769a5b9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"hash_md5: CF2BD8EED988807E19AAB4F3DCB27DC4","pattern":"[file:hashes.'MD5' = 'CF2BD8EED988807E19AAB4F3DCB27DC4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2686d6cc-c25d-4a22-a84c-000033c49988","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: qq.encrypt","pattern":"[domain-name:value = 'qq.encrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea362dbb-ca06-9a20-364a-00009fc0e403","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: qq.decrypt","pattern":"[domain-name:value = 'qq.decrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a72d52d-0146-a5a1-43f7-0000701a0e8b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: fastmsg.info","pattern":"[domain-name:value = 'fastmsg.info']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e374b1b8-893c-b6e1-f0f3-0000336ef785","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: nQq.encrypt","pattern":"[domain-name:value = 'nQq.encrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fc44acf-b4b7-df03-9ab5-00009f6a8a0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: nQq.decrypt","pattern":"[domain-name:value = 'nQq.decrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cf44bcb-27be-b12b-bb03-00009f07cf00","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: SHINRA-Recovery.txt","pattern":"[domain-name:value = 'SHINRA-Recovery.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--971b06cf-9347-0ea1-ca7b-0000b7133921","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: iliken.com","pattern":"[domain-name:value = 'iliken.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5693e0df-ba00-7649-52b2-000045db06e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/chaos-ransomware-hits-optima-tax-relief-leaks-69gb-data/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/chaos-ransomware-hits-optima-tax-relief-leaks-69gb-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3864d97e-3fdf-04aa-839d-0000b03cdbdb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.infosecurity-magazine.com/news/chaos-ransomware-wave-attacks/","pattern":"[url:value = 'https://www.infosecurity-magazine.com/news/chaos-ransomware-wave-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52a961b1-03fd-0c41-e575-0000e3069071","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyble.com/blog/top-ransomware-groups-june-2025-qilin-top-spot-","pattern":"[url:value = 'https://cyble.com/blog/top-ransomware-groups-june-2025-qilin-top-spot-']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36dc5e11-a41f-8108-39d7-000042cf62fa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/chaos-ransomware-group-surfaces-with-aggressive-tactics","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/chaos-ransomware-group-surfaces-with-aggressive-tactics']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2495092d-3cc4-e14f-4f0a-000095444cbb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/chaos","pattern":"[url:value = 'https://www.ransomlook.io/group/chaos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49295273-613e-de33-3f5f-000068fe3454","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://myz2p6mzvbawxggfmakgwshq3ohfk37zmgwjbft7ssggbf2tokonecad.onion/","pattern":"[url:value = 'http://myz2p6mzvbawxggfmakgwshq3ohfk37zmgwjbft7ssggbf2tokonecad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cd6d8a9-c5b6-1e8c-14f5-0000048e1bfb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion/","pattern":"[url:value = 'http://qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52c88857-4ec2-76c1-2b7b-0000fb602508","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion/api/post/list","pattern":"[url:value = 'http://hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion/api/post/list']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a5864df-dd6f-b2cd-651e-0000168240bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://s2godak5cr4bflmcmiqjgow2b7clgs7szgf4h3ofqn7lyh6mdpvei5yd.onion/","pattern":"[url:value = 'http://s2godak5cr4bflmcmiqjgow2b7clgs7szgf4h3ofqn7lyh6mdpvei5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e051c82c-e99a-ee09-b31d-0000da6ec6ee","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://een55qvybeygshxbblvfevk6uzcs6lhpj6num7ymbpw7z6cehozszlad.onion/","pattern":"[url:value = 'http://een55qvybeygshxbblvfevk6uzcs6lhpj6num7ymbpw7z6cehozszlad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15f9a2b6-38d8-e65d-129e-00006df553ca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bna6mhximutqknymisjbp277swmhf7gocambh6y62qmdtup34unjs7yd.onion/","pattern":"[url:value = 'http://bna6mhximutqknymisjbp277swmhf7gocambh6y62qmdtup34unjs7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--482b2217-161b-88f0-180c-0000e6114f73","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cdgi6zjox6zr5epk7k5rg673qduxy7dlkk7ws3n4vusspr5bmhx24aqd.onion/","pattern":"[url:value = 'http://cdgi6zjox6zr5epk7k5rg673qduxy7dlkk7ws3n4vusspr5bmhx24aqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd9b7d7c-cd64-ae89-29b3-000054d19930","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion/goosehead","pattern":"[url:value = 'http://qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion/goosehead']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48fe0717-aab4-af3c-54b7-0000f85bb9cf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onion/","pattern":"[url:value = 'http://2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7bcf468-4bb7-30bc-6fe4-000000b504ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://httj32vkww42kq3kjbsbuuv2izalkvswuyf5hepdodakrjq42ploe6ad.onion/","pattern":"[url:value = 'http://httj32vkww42kq3kjbsbuuv2izalkvswuyf5hepdodakrjq42ploe6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22bec17c-9be3-5944-1c31-000057a5ac3c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion/","pattern":"[url:value = 'http://hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f880f0c6-9f41-51bc-a5ef-00009850cd39","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/27691-magaskosh-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/27691-magaskosh-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67ea2702-5989-8aa5-697b-00006de828a4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202309/magaskosh-ransomware-ransom-note.jpg","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202309/magaskosh-ransomware-ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5139d402-bc53-e6c2-30b1-000076499535","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: WWW.BITCOIN.COM","pattern":"[domain-name:value = 'WWW.BITCOIN.COM']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7938c82f-f442-99f6-5fe2-0000e6898963","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: site.You","pattern":"[domain-name:value = 'site.You']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6ba0dbe-9296-b751-dabe-0000a059aa53","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: buy.bitcoin.com","pattern":"[domain-name:value = 'buy.bitcoin.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df1e8922-a10b-068b-b7c0-000067283a74","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: 666.accidenthappy","pattern":"[domain-name:value = '666.accidenthappy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0841bea-88c9-a658-d91f-000013e09ccb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://research.checkpoint.com/kraken-cryptor-distributed-infected-installer/","pattern":"[url:value = 'https://research.checkpoint.com/kraken-cryptor-distributed-infected-installer/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0e35c06-0103-4dbf-343b-0000dff69876","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/kraken-ransomware-distributed-via-malware-infected-installers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/kraken-ransomware-distributed-via-malware-infected-installers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2676a3c-9623-d602-2225-000095c32e4e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/kraken-cryptor-ransomware-as-a-service/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/kraken-cryptor-ransomware-as-a-service/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0617aeb-3845-38f2-4c18-0000bea4babd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kraken","pattern":"[url:value = 'https://www.ransomlook.io/group/kraken']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f455ef3a-cca4-9ca3-be80-00001f6d6f44","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2teh35rkn63fvigugpqroctxol2yfn745k57jmk23d42fwuujpfpnpid.onion/","pattern":"[url:value = 'http://2teh35rkn63fvigugpqroctxol2yfn745k57jmk23d42fwuujpfpnpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fae41b4d-f804-6cb9-248d-00008265b63c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://74fwiwaeqvtuf6uddankq5pzq637zpput3qxzq36fcxkhltq5plcxdqd.onion/","pattern":"[url:value = 'http://74fwiwaeqvtuf6uddankq5pzq637zpput3qxzq36fcxkhltq5plcxdqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41190dcf-6335-b687-6bbd-0000bf40421f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2lqlecl4q4hkrb3rl5p27b4hptnz7lqaaux5uca3g6pylpqlhqyafvad.onion/","pattern":"[url:value = 'http://2lqlecl4q4hkrb3rl5p27b4hptnz7lqaaux5uca3g6pylpqlhqyafvad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd7969f7-ee44-bcce-4794-0000d91b3940","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ebcbyeua65jtsnbsqsjahurkfj6yndhcwnnfxvwwg4yegb5h7fxjc5ad.onion/","pattern":"[url:value = 'http://ebcbyeua65jtsnbsqsjahurkfj6yndhcwnnfxvwwg4yegb5h7fxjc5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55f88393-524c-65bb-4381-0000a8ebf2f4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2puszzzqvfv2eco7idbt2fznn2iwlsw27ns5xq3ad257mui2keakacqd.onion/","pattern":"[url:value = 'http://2puszzzqvfv2eco7idbt2fznn2iwlsw27ns5xq3ad257mui2keakacqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af432ad6-7fe9-6679-c623-0000fdccd081","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kxntyq6yyfomjoqqya6px7pgc6mbfcbaejryxhiwpntcnlr7hopqj3yd.onion/","pattern":"[url:value = 'http://kxntyq6yyfomjoqqya6px7pgc6mbfcbaejryxhiwpntcnlr7hopqj3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e0301dc-4f3b-69dc-f381-0000f0f7e96f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yjsknaecbmhvrsagrcwqelpojnbcllt6v27vxebxhnotd3wu67onc5qd.onion/","pattern":"[url:value = 'http://yjsknaecbmhvrsagrcwqelpojnbcllt6v27vxebxhnotd3wu67onc5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cad5c0c-dbf4-b191-26f2-00004305714b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fk5c3gxraixjl3p7zacchn4jvew35vxo5xpedqf2qtlynsheqymampid.onion/","pattern":"[url:value = 'http://fk5c3gxraixjl3p7zacchn4jvew35vxo5xpedqf2qtlynsheqymampid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b71f0e9-63dd-987d-cf56-000061fb0e1d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ab2v4xzffr24pdmswqzrbg45pwsget4h7eyd4swxewuqbxmlwcju7lad.onion/","pattern":"[url:value = 'http://ab2v4xzffr24pdmswqzrbg45pwsget4h7eyd4swxewuqbxmlwcju7lad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ea9221e-91d4-cbfb-eb74-0000ea7696a6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3cxvgnwvbzzfm2abzxidi76uib53vsjudsavgzm4viaj26drkcdl6wad.onion/","pattern":"[url:value = 'http://3cxvgnwvbzzfm2abzxidi76uib53vsjudsavgzm4viaj26drkcdl6wad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fe4eb6e-a7d8-c712-1e54-0000acd2af8d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cjhuttkivmtrf6itrmyoqnxw55isy3dh6u5ifc3fnhajp7lwn5deflid.onion/","pattern":"[url:value = 'http://cjhuttkivmtrf6itrmyoqnxw55isy3dh6u5ifc3fnhajp7lwn5deflid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfaba6f1-7993-8b4e-91e6-0000f9293d89","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wkqvktnmr2slazl76opbkdli4ia6gznhxln2z5wny54hf4kzjwgqvxyd.onion/","pattern":"[url:value = 'http://wkqvktnmr2slazl76opbkdli4ia6gznhxln2z5wny54hf4kzjwgqvxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7068aba6-1851-12b7-4a05-00002719e844","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ko3lwb6glib74kmol5ov5cphabwqmifb5lnjw4bvj75jpfigrfbn7gid.onion/","pattern":"[url:value = 'http://ko3lwb6glib74kmol5ov5cphabwqmifb5lnjw4bvj75jpfigrfbn7gid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9640e6e6-9264-d05b-f3ba-000027e1fcd0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vmnnrqf3gs3kl2kfnxatughwmnlyq6qxzyx24ylyh2w36vw3gqwqjpqd.onion/","pattern":"[url:value = 'http://vmnnrqf3gs3kl2kfnxatughwmnlyq6qxzyx24ylyh2w36vw3gqwqjpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec7c134e-9e5a-4ab5-0db0-0000b62e990d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mvr2bidstp52pkaybzccjueux4hqbkukuqiss6vhn72qwqruzc7awsid.onion/","pattern":"[url:value = 'http://mvr2bidstp52pkaybzccjueux4hqbkukuqiss6vhn72qwqruzc7awsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9df454bf-c86b-f2a7-5759-00005e73524b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xbupelqsy7lubogl6kdtdqguxoleehbxnuuqm2dos6bbmdwablpqckad.onion/","pattern":"[url:value = 'http://xbupelqsy7lubogl6kdtdqguxoleehbxnuuqm2dos6bbmdwablpqckad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af0ae239-a797-0cd5-48f3-00005351e36e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://t3uouzfvsaqurb2rzoe2mkpetp54d7lgtl45ply34v5lugsnzysmkhid.onion/","pattern":"[url:value = 'http://t3uouzfvsaqurb2rzoe2mkpetp54d7lgtl45ply34v5lugsnzysmkhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--def81e87-cd45-2119-a436-0000772b0d84","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zq3k4odlfpbzc5y4sxqgolivelxepceaakru3xqo4ll2czmvvtek2ryd.onion/","pattern":"[url:value = 'http://zq3k4odlfpbzc5y4sxqgolivelxepceaakru3xqo4ll2czmvvtek2ryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b238035-b31e-e277-a261-00004f328b97","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://krakenccj3wr23452a4ibkbkuph4d6soyx2xgjoogtuamc3m7u7wemad.onion/","pattern":"[url:value = 'http://krakenccj3wr23452a4ibkbkuph4d6soyx2xgjoogtuamc3m7u7wemad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a6c4b3d-ef50-3a63-9be2-00008f4c88ea","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/malphas","pattern":"[url:value = 'https://www.ransomlook.io/group/malphas']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4528ec4f-0436-2cc9-f0f5-000048ce9b0c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://[redacted].onion.chat\\nIf","pattern":"[url:value = 'http://[redacted].onion.chat\\\\nIf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b40c76b-151d-b017-36cd-00004293614d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.torproject.org/\\nIf","pattern":"[url:value = 'https://www.torproject.org/\\\\nIf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--691b09db-1d92-c1cb-7a5a-00002e0dedb3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.intellinews.com/hacker-targets-indonesian-banks-with-ransomware-threats-366102/","pattern":"[url:value = 'https://www.intellinews.com/hacker-targets-indonesian-banks-with-ransomware-threats-366102/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd7db417-5a25-19b0-bde8-0000430296ab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.rapid7.com/blog/post/2025/04/02/a-rebirth-of-a-cursed-existence-the-babuk-locker-2-0/","pattern":"[url:value = 'https://www.rapid7.com/blog/post/2025/04/02/a-rebirth-of-a-cursed-existence-the-babuk-locker-2-0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7ea72c4-c5ad-cebb-f623-00003f066bc7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.socradar.io/dark-web-profile-babuk-babuk2/","pattern":"[url:value = 'https://www.socradar.io/dark-web-profile-babuk-babuk2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9301ee63-7738-83e6-fd14-0000091ddeb0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/babuk2-bjorka-the-evolution-of-ransomware-for-data-commoditization/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/babuk2-bjorka-the-evolution-of-ransomware-for-data-commoditization/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aea28b3-5247-482e-b757-00002eeca041","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bjorka","pattern":"[url:value = 'https://www.ransomlook.io/group/bjorka']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b456cc1a-36dd-2769-fe39-000000800f3f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://netleaks.net/contact/","pattern":"[url:value = 'https://netleaks.net/contact/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6ec2a0d-554c-ed2b-c079-00003a79b460","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3lce6cov7sj7vovrr3cbanqoolhgfgqqcvjrtlzlqnex7esdz33mdoqd.onion/","pattern":"[url:value = 'http://3lce6cov7sj7vovrr3cbanqoolhgfgqqcvjrtlzlqnex7esdz33mdoqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22e88a85-98d4-1c15-ccc8-00007c35866c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://netleaks.net/databases/","pattern":"[url:value = 'https://netleaks.net/databases/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fe6e5ce-e0fb-ff4e-5b29-00000527be6f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://netleaks.net/","pattern":"[url:value = 'https://netleaks.net/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--934ea03c-1962-202f-1eac-0000e66489b7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://bjork.ai/","pattern":"[url:value = 'https://bjork.ai/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f206bde2-6d90-428b-7ea9-0000e6183452","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wki2kiikvycnowcygyz7p4svefhgwcu57ae7brd5waitbsgoi6yrfvid.onion/","pattern":"[url:value = 'http://wki2kiikvycnowcygyz7p4svefhgwcu57ae7brd5waitbsgoi6yrfvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc706867-7767-8a6b-865e-000044cf0824","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ymir","pattern":"[url:value = 'https://www.ransomlook.io/group/ymir']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d521cf72-e492-7491-447c-0000a308229a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cs.beta.fletch.ai/p/d0glun","pattern":"[url:value = 'https://cs.beta.fletch.ai/p/d0glun']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63ef320d-c584-2ae1-8804-0000216b7d06","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://bazaar.abuse.ch/browse/signature/D0glun/","pattern":"[url:value = 'https://bazaar.abuse.ch/browse/signature/D0glun/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2418443-6e05-4db8-18a0-0000d89e5a9c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/31986-d0glun-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/31986-d0glun-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a5e345c-1f72-8e65-66b7-0000a6291d54","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/d0glun","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/d0glun']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59e2981f-9a23-2ce0-b8f3-0000149022fc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/d0glun","pattern":"[url:value = 'https://www.ransomlook.io/group/d0glun']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26ff5371-ecb5-7891-2408-00001dd1a6f5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://33333333h45xwqlf3s3eu4bkd6y6bjswva75ys7j6satex5ctf4pyfad.onion","pattern":"[url:value = 'http://33333333h45xwqlf3s3eu4bkd6y6bjswva75ys7j6satex5ctf4pyfad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1ed5a28-feac-cc6b-111c-00005cc7790c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hxxp://33333333h45xwqlf3s3eu4bkd6y6bjswva75ys7j6satex5ctf4pyfad.onion","pattern":"[url:value = 'http://hxxp://33333333h45xwqlf3s3eu4bkd6y6bjswva75ys7j6satex5ctf4pyfad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c80dcddd-5fa5-e317-5bb0-0000755a22b5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: Desktopcxl.txt","pattern":"[domain-name:value = 'Desktopcxl.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b0f7047-32ac-325f-0262-00003e23ba87","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sugar","pattern":"[url:value = 'https://www.ransomlook.io/group/sugar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd2e27df-3178-bdd6-0c66-000074b088d4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sugarpanel.space/advauth_ffma","pattern":"[url:value = 'http://sugarpanel.space/advauth_ffma']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--752cc570-3520-14f2-64e3-000024d26263","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion/","pattern":"[url:value = 'http://chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fcc63a2-c151-fb1b-fc33-0000f2887a10","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/gd","pattern":"[url:value = 'https://www.ransomlook.io/group/gd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea27b251-d8cd-d3a8-a217-0000eaf17892","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/darkrypt","pattern":"[url:value = 'https://www.ransomlook.io/group/darkrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be1cf306-afd7-d5b6-0982-0000db6bd793","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://darkrypt.io","pattern":"[url:value = 'https://darkrypt.io']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f884c53-51eb-08d6-5b7b-00002523de53","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/babuk-bjorka","pattern":"[url:value = 'https://www.ransomlook.io/group/babuk-bjorka']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33907a9a-8a36-aa29-f8e5-0000212d7a83","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion","pattern":"[url:value = 'http://bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8888c041-71eb-a75b-8eec-0000adb77e8d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://57mphyfkxoj5lph2unswd23akewz3jtj7mb6wignwmyto32ghp2visid.onion/","pattern":"[url:value = 'http://57mphyfkxoj5lph2unswd23akewz3jtj7mb6wignwmyto32ghp2visid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a9ffb7f-c4d5-b2dc-b1dd-00003c23dc1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.onion/","pattern":"[url:value = 'http://fpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33d5f0b8-a430-0389-b804-0000dd3e2dd3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gtmx56k4hutn3ikv.onion/","pattern":"[url:value = 'http://gtmx56k4hutn3ikv.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dce20b2-eb55-562b-e894-0000dbf4a4c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onion","pattern":"[url:value = 'http://7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0a9a6c4-c8ae-bff1-5af6-000035877be1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/a1project","pattern":"[url:value = 'https://www.ransomlook.io/group/a1project']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c2b7dad-5a17-d58d-6fcd-00009c75f29e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: info-hunt.txt","pattern":"[domain-name:value = 'info-hunt.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c405ed30-3422-7381-1906-0000d2efd466","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: tr.heisler","pattern":"[domain-name:value = 'tr.heisler']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af4df736-bea5-dee5-e1db-000034c4ec4b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: skiff.com","pattern":"[domain-name:value = 'skiff.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--816de33e-3024-5fe6-f679-0000df169bb0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: m9SRob-README.txt","pattern":"[domain-name:value = 'm9SRob-README.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3420469a-e176-9f10-8a6d-00004fb764b5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: README-WANING.txt","pattern":"[domain-name:value = 'README-WANING.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92b251e6-5a17-e579-a6f5-0000dfd6579b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/deadbydawn","pattern":"[url:value = 'https://www.ransomlook.io/group/deadbydawn']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7becf8bd-fd7b-9974-d495-00004c29ed70","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/morpheus","pattern":"[url:value = 'https://www.ransomlook.io/group/morpheus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf9d195a-a2fa-5cba-8d4e-000080e3a896","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.tinextacyber.com/wp-content/uploads/2025/06/Dissecting-a-Python-Ransomware-distributed-through-GitHub-repositories-1.pdf","pattern":"[url:value = 'https://www.tinextacyber.com/wp-content/uploads/2025/06/Dissecting-a-Python-Ransomware-distributed-through-GitHub-repositories-1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2ec1526-daae-6484-7360-000056bf3709","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/balletspistol","pattern":"[url:value = 'https://www.ransomlook.io/group/balletspistol']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69b64d6c-261e-29ae-74e0-0000d26e5072","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/providence","pattern":"[url:value = 'https://www.ransomlook.io/group/providence']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00d0dbe0-91e1-363d-ba6f-0000b98b5b0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/satancd","pattern":"[url:value = 'https://www.ransomlook.io/group/satancd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a1583d0-01ca-09a6-845f-0000048c5fc7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion/satancd-room","pattern":"[url:value = 'http://mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion/satancd-room']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a89f5eb-c0c8-f8dc-fec0-0000ac6e54a9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securityweek.com/are-threat-groups-belsen-and-zerosevengroup-related/","pattern":"[url:value = 'https://securityweek.com/are-threat-groups-belsen-and-zerosevengroup-related/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cafd1bc6-4a38-0a30-bb2a-00000b6eeaad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://kela.com/blog/could-the-belsen-group-be-associated-with-zerosevengroup/","pattern":"[url:value = 'https://kela.com/blog/could-the-belsen-group-be-associated-with-zerosevengroup/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d700eb2-4d89-6162-c200-0000fc2a333f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://watchguard.com/wgrd-security-hub/ransomware-tracker/belsen-group","pattern":"[url:value = 'https://watchguard.com/wgrd-security-hub/ransomware-tracker/belsen-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72216246-cfe4-62ba-a497-00009bc3add5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://rapid7.com/blog/post/2025/01/16/etr-fortinet-firewalls-hit-with-new-zero-day-attack-older-data-leak","pattern":"[url:value = 'https://rapid7.com/blog/post/2025/01/16/etr-fortinet-firewalls-hit-with-new-zero-day-attack-older-data-leak']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55c494c5-ced6-6530-1556-0000ea3658e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-data-posting","pattern":"[url:value = 'https://fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-data-posting']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--289881f9-ee46-8379-4dd1-0000922fbfa5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://outpost24.com/blog/belsen-group-threat-group/","pattern":"[url:value = 'https://outpost24.com/blog/belsen-group-threat-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5f14aa4-13b4-6243-7237-0000ea2bd5e2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/belsen","pattern":"[url:value = 'https://www.ransomlook.io/group/belsen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2083db03-5383-f361-682d-0000e04d3599","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://belsenacdodoy3nsmmyjfmtgjen6ipaqkti7dm2q57vabjx2vzq6tnad.onion/","pattern":"[url:value = 'http://belsenacdodoy3nsmmyjfmtgjen6ipaqkti7dm2q57vabjx2vzq6tnad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c512214-1961-095d-c498-00005487694c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/cs-137","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/cs-137']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fed8e57-6a15-6845-f3ed-0000e63e56e4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cs-137","pattern":"[url:value = 'https://www.ransomlook.io/group/cs-137']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f76f04f0-9fae-ffa9-520e-0000947523d2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: ABCDEF-README.txt","pattern":"[domain-name:value = 'ABCDEF-README.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e2d60a9-c8fc-38ca-3fcb-000002fd140d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.anvilogic.com/threat-reports/iranian-cyber-groups-ransomware","pattern":"[url:value = 'https://www.anvilogic.com/threat-reports/iranian-cyber-groups-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86df3f7b-3b47-54ae-e172-0000e26027e0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.helpnetsecurity.com/2024/08/28/pioneer-kitten-iranian-hackers-partnering-with-ransomware-affiliates/","pattern":"[url:value = 'https://www.helpnetsecurity.com/2024/08/28/pioneer-kitten-iranian-hackers-partnering-with-ransomware-affiliates/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54018f92-728d-6bdc-3e27-0000c1fd9d76","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c3fe579-9529-28b5-7681-00003a393ca9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/br0k3r","pattern":"[url:value = 'https://www.ransomlook.io/group/br0k3r']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4914e52a-e620-69b2-8e76-0000f87f5505","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://brok3r7bhcblynwpoymgarr6zwcy4ttfbhkhcmotz4lw2gcsuojgaeqd.onion/","pattern":"[url:value = 'http://brok3r7bhcblynwpoymgarr6zwcy4ttfbhkhcmotz4lw2gcsuojgaeqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fff873fc-ee9e-0804-e67c-0000ffdc9ffe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lockbit4","pattern":"[url:value = 'https://www.ransomlook.io/group/lockbit4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2966403-83fc-72dc-2919-0000eecd63d7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion/","pattern":"[url:value = 'http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac42316f-f594-ba8f-db27-0000e972ee11","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion/","pattern":"[url:value = 'http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--001fa5f0-b6c2-4acd-29d1-00001fca7327","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion/","pattern":"[url:value = 'http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2eb5fe01-3326-a5e5-c41e-0000c480a487","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion/","pattern":"[url:value = 'http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b9ca2a1-06f3-1f9b-372b-0000494473b6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion/","pattern":"[url:value = 'http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--345c4545-27c1-68ed-191b-00006df4ac2e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/funksec","pattern":"[url:value = 'https://www.ransomlook.io/group/funksec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cf7d905-2bca-f290-b88c-0000819e9e30","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funk45xqgrkrtej4743evcgv65oi3w4shwvjx3cvrdtqwul7gzkxuxqd.onion/","pattern":"[url:value = 'http://funk45xqgrkrtej4743evcgv65oi3w4shwvjx3cvrdtqwul7gzkxuxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b69062d1-8d3b-2085-a54b-0000dff9807e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funksec7vgdojepkipvhfpul3bvsxzyxn66ogp7q4pptvujxtpyjttad.onion/","pattern":"[url:value = 'http://funksec7vgdojepkipvhfpul3bvsxzyxn66ogp7q4pptvujxtpyjttad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cf62831-c6cc-2b46-1b24-0000d85c33e6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funksecsekgasgjqlzzkmcnutrrrafavpszijoilbd6z3dkbzvqu43id.onion/","pattern":"[url:value = 'http://funksecsekgasgjqlzzkmcnutrrrafavpszijoilbd6z3dkbzvqu43id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef1895e0-07ae-f89b-4deb-000042ce73e8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funksec53xh7j5t6ysgwnaidj5vkh3aqajanplix533kwxdz3qrwugid.onion/","pattern":"[url:value = 'http://funksec53xh7j5t6ysgwnaidj5vkh3aqajanplix533kwxdz3qrwugid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6793232e-e106-150a-75f8-0000110a9bbc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funksec.top/","pattern":"[url:value = 'http://funksec.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03bebace-8a6e-e280-ad4b-00005db4265e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funkyiazgfsrxrib6rnxbhkgfqi7isisfbqnwk2ycf7tpgfhtevlamad.onion/","pattern":"[url:value = 'http://funkyiazgfsrxrib6rnxbhkgfqi7isisfbqnwk2ycf7tpgfhtevlamad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70146049-352c-ce81-eedf-0000f41a4c4b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funk4ph7igelwpgadmus4n4moyhh22cib723hllneen7g2qkklml4sqd.onion/","pattern":"[url:value = 'http://funk4ph7igelwpgadmus4n4moyhh22cib723hllneen7g2qkklml4sqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b0cc6f8-9b25-9c3b-0a72-0000dbb75b4e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion/","pattern":"[url:value = 'http://funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4557c33d-c8c4-4ad3-46dd-0000cd1d73f2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion/","pattern":"[url:value = 'http://funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be10694c-c6ab-05a1-f6c0-0000247ef13e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion/","pattern":"[url:value = 'http://funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01627d1a-b99d-d8db-c6be-0000dcea64c6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ykqjcrptcai76ru5u7jhvspkeizfsvpgovton4jmreawj4zdwe4qnlid.onion/","pattern":"[url:value = 'http://ykqjcrptcai76ru5u7jhvspkeizfsvpgovton4jmreawj4zdwe4qnlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44444aab-d360-623b-0d9f-00005a7cd56d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pke2vht5jdeninupk7i2thcfvxegsue6oraswpka35breuj7xxz2erid.onion/","pattern":"[url:value = 'http://pke2vht5jdeninupk7i2thcfvxegsue6oraswpka35breuj7xxz2erid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45ce06da-5fbc-e88e-e583-00005eeebd3c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7ixfdvqb4eaju5lzj4gg76kwlrxg4ugqpuog5oqkkmgfyn33h527oyyd.onion/","pattern":"[url:value = 'http://7ixfdvqb4eaju5lzj4gg76kwlrxg4ugqpuog5oqkkmgfyn33h527oyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cb67be7-d6c1-ca48-d12b-0000b6123543","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/25442-dataf-locker-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/25442-dataf-locker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--020e3249-ee8b-6b16-a166-000081f58a95","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/dataf","pattern":"[url:value = 'https://www.ransomlook.io/group/dataf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47db96b1-42b1-9481-f831-000006f0f70e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pg3n5bteiatjf6rt7oa4xhzo4sj736rifjmk4gtowxjljuwwdv6mccyd.onion/","pattern":"[url:value = 'http://pg3n5bteiatjf6rt7oa4xhzo4sj736rifjmk4gtowxjljuwwdv6mccyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff7cc581-c2a7-95bf-d972-0000fbbf2afa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/schoolboys","pattern":"[url:value = 'https://www.ransomlook.io/group/schoolboys']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61545953-55c1-bbae-b755-00009df3a6d6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pnanlicgxkku2aonwsg2fwid3maycsso7joqnzp66wkfemzdk7ahsdid.onion/","pattern":"[url:value = 'http://pnanlicgxkku2aonwsg2fwid3maycsso7joqnzp66wkfemzdk7ahsdid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b63b5a75-f0ec-8752-115f-00005713b359","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/weaxor","pattern":"[url:value = 'https://www.ransomlook.io/group/weaxor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2bc29e1-6dcf-0658-ef27-0000dac79fc7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/","pattern":"[url:value = 'http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a3ad723-6583-bdbf-68dd-0000c6083727","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/crypt","pattern":"[url:value = 'https://www.ransomlook.io/group/crypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13000e92-8539-3c3d-afce-0000946204ad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://lhwhi2kmewfas6tk47psgvqyluz5iwgdll5g6jyknq6rvxxg6soqooqd.onion/","pattern":"[url:value = 'https://lhwhi2kmewfas6tk47psgvqyluz5iwgdll5g6jyknq6rvxxg6soqooqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9a60b3e-e561-9e17-552f-0000cb685773","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"hash_md5: 54EFAC23D7B524D56BEDBCE887E11849","pattern":"[file:hashes.'MD5' = '54EFAC23D7B524D56BEDBCE887E11849']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3398551b-d787-6656-49ce-0000dd1dbb6b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/toxic","pattern":"[url:value = 'https://www.ransomlook.io/group/toxic']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ff615a1-f892-377c-ed71-00004fa7c39b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cwybfdfhstmmoaxmnz4os7qxdcomnp5qleslqb55vt24vh3kmyl6jmad.onion/","pattern":"[url:value = 'http://cwybfdfhstmmoaxmnz4os7qxdcomnp5qleslqb55vt24vh3kmyl6jmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49ca4c22-ccd1-ecdb-9668-0000e8c2fcce","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/leakeddata","pattern":"[url:value = 'https://www.ransomlook.io/group/leakeddata']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e547b18-1917-03ae-6d06-0000468e82d8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ep6pheij.com/","pattern":"[url:value = 'http://ep6pheij.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59293856-c767-5c2b-a4a7-0000c96a3362","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://business-data-leaks.com","pattern":"[url:value = 'http://business-data-leaks.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e4b0b84-e1ef-9635-b8a4-000010b0b75f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/bluebox","pattern":"[url:value = 'https://www.ransomlook.io/group/bluebox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--334f19a2-2f3d-045a-5afb-000053e9398a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zu3wfrmrkl4ltqqnpt3owp3cwa33rqwod4gpe3ttb5o4vf2is2gzm6qd.onion/","pattern":"[url:value = 'http://zu3wfrmrkl4ltqqnpt3owp3cwa33rqwod4gpe3ttb5o4vf2is2gzm6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84202fc7-82c3-bd70-9c08-000049e4dd4a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://twitter.com/PaduckLee/status/1866748855053848886","pattern":"[url:value = 'https://twitter.com/PaduckLee/status/1866748855053848886']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ca8f5fa-a5c7-98ba-93b8-0000fde38dd6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://twitter.com/pcrisk/status/1866752818939564347","pattern":"[url:value = 'https://twitter.com/pcrisk/status/1866752818939564347']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--616c8caa-9e11-39d7-5d39-0000f3ab674d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyfirma.com/news/weekly-intelligence-report-20-dec-2024/","pattern":"[url:value = 'https://www.cyfirma.com/news/weekly-intelligence-report-20-dec-2024/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--438842f6-f95a-10a4-f9cf-000064136c1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyclonis.com/remove-help_restoremydata-ransomware/","pattern":"[url:value = 'https://www.cyclonis.com/remove-help_restoremydata-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa41dba9-3ef9-2855-b198-000041c84e69","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/31727-help-restoremydata-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/31727-help-restoremydata-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1324447e-4755-aeef-d948-0000020f6e37","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/help_restoremydata","pattern":"[url:value = 'https://www.ransomlook.io/group/help_restoremydata']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--294a590a-4396-4ba6-bcd9-000004918ec2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gzdn6yjvmrujiqzz4wwuykrta7jtkv2fupb7aozwx7yxnxhj737v2qad.onion/","pattern":"[url:value = 'http://gzdn6yjvmrujiqzz4wwuykrta7jtkv2fupb7aozwx7yxnxhj737v2qad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--307c4360-bd0a-4cb9-e57d-00009393f7b1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"hash_md5: b1e8b6c2b65d51893bbe61d46cbdb4af","pattern":"[file:hashes.'MD5' = 'b1e8b6c2b65d51893bbe61d46cbdb4af']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ce6091f-ba0e-0926-dd1e-0000be1188c4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: restoremydata.pw","pattern":"[domain-name:value = 'restoremydata.pw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a4a9ce2-307b-71a6-35c4-000015ed2c92","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/krypt","pattern":"[url:value = 'https://www.ransomlook.io/group/krypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91369660-7bf9-c651-d7be-00005400361a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://decryptrrx2fojgfcof3aesrklj5obq7nmizyokq7ohzqxtwfcvtmwad.onion/chat","pattern":"[url:value = 'http://decryptrrx2fojgfcof3aesrklj5obq7nmizyokq7ohzqxtwfcvtmwad.onion/chat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33ea326b-f4c7-4c62-63f8-00001d5b3e4b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://decryptjhpol6zezc72xb2mofmi6o7xlvacnrpbuiczz2sz5ljurg4id.onion/chat","pattern":"[url:value = 'http://decryptjhpol6zezc72xb2mofmi6o7xlvacnrpbuiczz2sz5ljurg4id.onion/chat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c57d9cb7-dcef-3b21-3c04-0000c7276569","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.eset.com/afr/about/newsroom/press-releases-afr/company/ctb-locker-ransomware-striking-in-europe-and-latin-america10/","pattern":"[url:value = 'https://www.eset.com/afr/about/newsroom/press-releases-afr/company/ctb-locker-ransomware-striking-in-europe-and-latin-america10/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4100e81f-c2e1-a4e8-2654-000075abd846","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/advanced-threat-research/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/advanced-threat-research/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e42ecfb3-03e5-c34d-1db5-0000a3dac34d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://heimdalsecurity.com/blog/ctb-locker-ransomware/","pattern":"[url:value = 'https://heimdalsecurity.com/blog/ctb-locker-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d2f3944-a9da-6433-a6f5-000026b0d01c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cert.gov.az/en/articles/ctb-locker-and-critroni-ransomware-information-guide-and-faq","pattern":"[url:value = 'https://cert.gov.az/en/articles/ctb-locker-and-critroni-ransomware-information-guide-and-faq']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be10ccf4-ba99-1bea-6392-00003c43163a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ctblocker","pattern":"[url:value = 'https://www.ransomlook.io/group/ctblocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b99e1e0-77b6-9761-eb98-000093227cd8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tmc2ybfqzgkaeilm.onion","pattern":"[url:value = 'http://tmc2ybfqzgkaeilm.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0adbd56-dd1a-94b3-40b0-0000654b18ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ohmva4gbywokzqso.onion/","pattern":"[url:value = 'http://ohmva4gbywokzqso.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a3edd36-1c1a-ca55-0414-000021677a2f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/luckbit","pattern":"[url:value = 'https://www.ransomlook.io/group/luckbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48113978-88eb-d663-a3fa-0000caa0d146","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://luckbit53sdne5yd5vdekadhwnbzjyqlbjkc4g33hs6faphfkvivaeid.onion/","pattern":"[url:value = 'http://luckbit53sdne5yd5vdekadhwnbzjyqlbjkc4g33hs6faphfkvivaeid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--921a133d-5046-1dec-32e1-000044488b17","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-gwisin-ransomware-targets-south-korean-healthcare-manufacturing/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-gwisin-ransomware-targets-south-korean-healthcare-manufacturing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3246288-5340-c0c8-76f3-00007098e291","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.securityweek.com/gwisin-ransomware-attacks-target-korean-healthcare-firms/","pattern":"[url:value = 'https://www.securityweek.com/gwisin-ransomware-attacks-target-korean-healthcare-firms/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db1f62db-4c26-1ff9-81e0-0000af699b74","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://asec.ahnlab.com/en/45115/","pattern":"[url:value = 'https://asec.ahnlab.com/en/45115/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2477a0cb-064d-9b51-09f3-000009ea645d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/gwisin","pattern":"[url:value = 'https://www.ransomlook.io/group/gwisin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4d8cb5a-282c-00ca-0956-0000355bba7f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gwisin4yznpdtzq424i3la6oqy5evublod4zbhddzuxcnr34kgfokwad.onion/","pattern":"[url:value = 'http://gwisin4yznpdtzq424i3la6oqy5evublod4zbhddzuxcnr34kgfokwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ed9b647-14ce-d32e-5b53-0000cc33bdbb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/tommyleaks","pattern":"[url:value = 'https://www.ransomlook.io/group/tommyleaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71834a54-66ac-703e-5b7b-0000e1e4b6a6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xir242nunyist4d7ksfnfmhnjx4gvqbuzo7eax4o3abqjesbxjshh4qd.onion/","pattern":"[url:value = 'http://xir242nunyist4d7ksfnfmhnjx4gvqbuzo7eax4o3abqjesbxjshh4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37bf21f9-519a-ba8a-6f6d-00009922b638","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cybereason.com/blog/threat-analysis-beast-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/threat-analysis-beast-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6324afe6-f1e4-378b-e453-00004c85ad28","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyberint.com/blog/research/the-nature-of-the-beast-ransomware/","pattern":"[url:value = 'https://cyberint.com/blog/research/the-nature-of-the-beast-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--938c30be-01bf-9a57-f943-000000fe6fdf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/beast","pattern":"[url:value = 'https://www.ransomlook.io/group/beast']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f6c10dd-3636-40bb-7965-00007fe1dca0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://brt2oxyj3pj5lwdyztcnhjuv3ufqisaw4osup4zzzfmvchxm4vya56id.onion/","pattern":"[url:value = 'http://brt2oxyj3pj5lwdyztcnhjuv3ufqisaw4osup4zzzfmvchxm4vya56id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e3e47ce-7c14-475e-e797-0000111e3a83","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iipl7n3txrysjnclu24deu2pbrkse5y5oiwqyvs6mjdxlisilqpssiad.onion/","pattern":"[url:value = 'http://iipl7n3txrysjnclu24deu2pbrkse5y5oiwqyvs6mjdxlisilqpssiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a00bf39a-b1fb-8774-1a98-0000acb113de","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gutatzqnumcmlfhq3txzz47gkhf7opozw2potunt2d7d2vne3apfuqqd.onion/","pattern":"[url:value = 'http://gutatzqnumcmlfhq3txzz47gkhf7opozw2potunt2d7d2vne3apfuqqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98382580-0288-c0b8-71a6-0000d5b236cf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sxsjteplangjoknelabsjdw6lqdq2g7ak5fkmlbhmj7sztrk2ono24yd.onion/","pattern":"[url:value = 'http://sxsjteplangjoknelabsjdw6lqdq2g7ak5fkmlbhmj7sztrk2ono24yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8d52ea7-8601-29f3-5c33-0000d5ff21c4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://isnunjmt7nvxwe2q2xvynntrqfjga7qpywiwtol4rmyoycwrccjezcad.onion/","pattern":"[url:value = 'http://isnunjmt7nvxwe2q2xvynntrqfjga7qpywiwtol4rmyoycwrccjezcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b305600-55ff-2375-ea36-00003e4e8fab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mq2yz7rgz6twml5tcmno23rlgp5v6gzqlxucalkgu2ssghsswz75xkyd.onion/","pattern":"[url:value = 'http://mq2yz7rgz6twml5tcmno23rlgp5v6gzqlxucalkgu2ssghsswz75xkyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebbaca60-604b-a7ca-a840-0000a600eb33","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://inqqzxkjfronl3fb5uazmveq4txxatykoadg4gtga3euzi2ffobsyxqd.onion/","pattern":"[url:value = 'http://inqqzxkjfronl3fb5uazmveq4txxatykoadg4gtga3euzi2ffobsyxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfed490d-27ba-2733-c469-000003aebcab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xzxvf4x2hxivr3q2ffzultcqiun5flwfp6fyoqtvbx3p4an4smefmjqd.onion/","pattern":"[url:value = 'http://xzxvf4x2hxivr3q2ffzultcqiun5flwfp6fyoqtvbx3p4an4smefmjqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b20a385d-39d0-d000-e30a-00006758ad1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd.onion/","pattern":"[url:value = 'http://beast6azu4f7fxjakiayhnssybibsgjnmy77a6duufqw5afjzfjhzuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d85f120-a1ab-5ef9-bb6e-00005c4ea410","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/invaderx","pattern":"[url:value = 'https://www.ransomlook.io/group/invaderx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d21a0874-f886-1b3d-437b-00009235f682","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/safepay","pattern":"[url:value = 'https://www.ransomlook.io/group/safepay']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddc32d61-e497-652d-d6d7-00009f242d81","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://duslj3vgel72rilqlvvlo2qw6jybmvbcdmcm4n63kyivveeif6u2xrad.onion/","pattern":"[url:value = 'http://duslj3vgel72rilqlvvlo2qw6jybmvbcdmcm4n63kyivveeif6u2xrad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5f1cb97-d520-57d3-29e2-0000ee9e2731","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/","pattern":"[url:value = 'http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0568117d-4503-6fb6-9e3c-0000b5cca321","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: safepay.ton","pattern":"[domain-name:value = 'safepay.ton']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c13c07a9-6287-a40b-6052-000042f1c9c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion","pattern":"[url:value = 'http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d180ef3-3ac0-3d83-7bd7-0000ce1b3de2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion","pattern":"[url:value = 'http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--329bfe89-cf74-8015-d040-0000f770e36c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wmgres25e43uwgebctgofo2qe23kf5vqevixiulubpovdglyizfugryd.onion/","pattern":"[url:value = 'http://wmgres25e43uwgebctgofo2qe23kf5vqevixiulubpovdglyizfugryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df2da5c8-0a5b-943a-7924-0000fd659650","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion/","pattern":"[url:value = 'http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06f5dd88-7b56-546e-ec2c-0000e211b251","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://crmbcdcdwoex6dzajbicgzrsuw2t76pomajwdpi2mb2babbfdgcc6xid.onion/","pattern":"[url:value = 'http://crmbcdcdwoex6dzajbicgzrsuw2t76pomajwdpi2mb2babbfdgcc6xid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d22e354-681f-2588-d8e5-00003ff02274","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fcde4o7iquaspdbo5yetwqn3rfueet2zfy3wjosrc5dznyccwbiz6oyd.onion/","pattern":"[url:value = 'http://fcde4o7iquaspdbo5yetwqn3rfueet2zfy3wjosrc5dznyccwbiz6oyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9309ce84-2df3-fd9d-d2f3-00003eefb405","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iieavvi4wtiuijas3zw4w54a5n2srnccm2fcb3jcrvbb7ap5tfphw6ad.onion/","pattern":"[url:value = 'http://iieavvi4wtiuijas3zw4w54a5n2srnccm2fcb3jcrvbb7ap5tfphw6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de8ea168-5f7c-6043-2099-00000faefc67","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qkzxzeabulbbaevqkoy2ew4nukakbi4etnnkcyo3avhwu7ih7cql4gyd.onion/","pattern":"[url:value = 'http://qkzxzeabulbbaevqkoy2ew4nukakbi4etnnkcyo3avhwu7ih7cql4gyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecbb4fe5-7e8d-dcf1-32da-0000700d6ec7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/termite","pattern":"[url:value = 'https://www.ransomlook.io/group/termite']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fc9288c-db16-dfb4-240e-0000a3bc73fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://y4bdg56uaznmbptf7dgp5xn3sjyyh4qodqjrsbziqatnyapmiqqctgid.onion/","pattern":"[url:value = 'http://y4bdg56uaznmbptf7dgp5xn3sjyyh4qodqjrsbziqatnyapmiqqctgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5bcc918-01d9-1893-ff12-00003eac2413","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wc4mc3oupskb2c3q4ba6tlf6tq5mdfoevsgfcotbnbsr4tbqoaomftid.onion/","pattern":"[url:value = 'http://wc4mc3oupskb2c3q4ba6tlf6tq5mdfoevsgfcotbnbsr4tbqoaomftid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c527b03-5b24-0959-d411-0000bf9e6b1e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4xklh64cl2lymm6n5xywinfq4wlchgugvv5a77pm3pta34svnohwl2id.onion/","pattern":"[url:value = 'http://4xklh64cl2lymm6n5xywinfq4wlchgugvv5a77pm3pta34svnohwl2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b792006-3ade-ae95-fa7a-00004ca6d41d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pqw3hepvky2pgyyv6dupvx47cm2gxzwop6dfei3i67dj76tdj6alplqd.onion/","pattern":"[url:value = 'http://pqw3hepvky2pgyyv6dupvx47cm2gxzwop6dfei3i67dj76tdj6alplqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14778516-d445-3a23-53a7-0000644812e9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyjax.com/resources/blog/new-argonauts-extortion-group-emerges/","pattern":"[url:value = 'https://www.cyjax.com/resources/blog/new-argonauts-extortion-group-emerges/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61597ea2-a957-e8bd-846c-00008d8171e9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/argonauts-group","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/argonauts-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--272acc3b-9aea-aff1-4920-000060bc1e6c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/argonauts","pattern":"[url:value = 'https://www.ransomlook.io/group/argonauts']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4198e6a7-0825-ab88-fe3c-0000deb14116","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4xi5jklauqmjfkwxhs2a6q2d26v2465zfnccacqpz75exv2kzu5aeiad.onion:18080/chat/startchat","pattern":"[url:value = 'http://4xi5jklauqmjfkwxhs2a6q2d26v2465zfnccacqpz75exv2kzu5aeiad.onion:18080/chat/startchat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fec5fff0-e537-0896-5af0-00003998fdcd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jbmk7h6xlkedn2gg5yi76zca6y3jgdlp5wchlsrd7735tlnrmmvqe5ad.onion/","pattern":"[url:value = 'http://jbmk7h6xlkedn2gg5yi76zca6y3jgdlp5wchlsrd7735tlnrmmvqe5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--480fa12d-e102-bfa9-e4ea-0000e340006c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyjax.com/resources/blog/contfraversy-in-ransomland-tor-based-site-emerges-for-new-french-speaking-raas-operation-contfr/","pattern":"[url:value = 'https://www.cyjax.com/resources/blog/contfraversy-in-ransomland-tor-based-site-emerges-for-new-french-speaking-raas-operation-contfr/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4775022-4be9-ad7a-5ced-0000bb656e0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/contfr","pattern":"[url:value = 'https://www.ransomlook.io/group/contfr']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa02e8c9-a270-35c6-d688-000012a1f003","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zprxx7sfc26rufggreanowmme5qqouqegr2efnko6erycquwvpq5egid.onion/","pattern":"[url:value = 'http://zprxx7sfc26rufggreanowmme5qqouqegr2efnko6erycquwvpq5egid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--888ba3fa-73f7-d839-2f2a-0000b36506a2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/kairos","pattern":"[url:value = 'https://www.ransomlook.io/group/kairos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--762bd7b4-e9df-ae47-9bae-000054e4b98c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cvfgzmrcam5efoqx4lkdejv5nb6icocsla2tn2dzw4b7wlyf4luz7fyd.onion","pattern":"[url:value = 'http://cvfgzmrcam5efoqx4lkdejv5nb6icocsla2tn2dzw4b7wlyf4luz7fyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2eebbf1b-aae2-2a48-0e21-0000b0808096","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.onion/services/","pattern":"[url:value = 'http://nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.onion/services/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1daeb362-3ec5-0ac4-d591-000041a32969","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://khom5v7vmc2nomkze64dsbyenn3wlxkewg6dbsvt5sujl2rmrtfy4oid.onion/","pattern":"[url:value = 'http://khom5v7vmc2nomkze64dsbyenn3wlxkewg6dbsvt5sujl2rmrtfy4oid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2650361c-7d7a-a509-f95a-0000033ddf1d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://whodusp3s2z6rnenxhv7scc2w5fzsse5cmijll2vl7fo6ezk45zssjqd.onion/","pattern":"[url:value = 'http://whodusp3s2z6rnenxhv7scc2w5fzsse5cmijll2vl7fo6ezk45zssjqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bc79265-1583-648a-a51f-0000fc1df385","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vpj6dzqat4n4hwb625a4qjpuzd3bzrjgw5zlwa3l6uiazdwjcib3y6ad.onion/","pattern":"[url:value = 'http://vpj6dzqat4n4hwb625a4qjpuzd3bzrjgw5zlwa3l6uiazdwjcib3y6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73686ffd-a692-f250-6ca9-0000e8663b5c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pj6dzqat4n4hwb625a4qjpuzd3bzrjgw5zlwa3l6uiazdwjcib3y6ad.onion/","pattern":"[url:value = 'http://pj6dzqat4n4hwb625a4qjpuzd3bzrjgw5zlwa3l6uiazdwjcib3y6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5b0e4cf-8040-559e-c188-00009ff61152","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2msn5sp3af3iy2ozj4235ccsb7pnpp4tkzyxdpzutyc2sxb3mujicfyd.onion/","pattern":"[url:value = 'http://2msn5sp3af3iy2ozj4235ccsb7pnpp4tkzyxdpzutyc2sxb3mujicfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e89b923-7898-61d0-2d65-00006f1e933c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://esmhbczpio7umfnxog6bk23q3nok5fjuik2dttegvezqngg2oqklo7yd.onion/","pattern":"[url:value = 'http://esmhbczpio7umfnxog6bk23q3nok5fjuik2dttegvezqngg2oqklo7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64f67bae-8a0a-7294-4b84-0000bf85c2b4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://usqa5b33yyc2u6kqf5au64cgj64acl2umtll76qutlmu7fckw6kh6wqd.onion/files/","pattern":"[url:value = 'http://usqa5b33yyc2u6kqf5au64cgj64acl2umtll76qutlmu7fckw6kh6wqd.onion/files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfefbf29-e2f3-8671-d6fd-0000900275e0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dngqgtcqcz5hgjvk4encs4vfyzucx3gtmov5a4eltvovux4nvazbx6ad.onion/files/","pattern":"[url:value = 'http://dngqgtcqcz5hgjvk4encs4vfyzucx3gtmov5a4eltvovux4nvazbx6ad.onion/files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c2847c5-6811-282a-1701-0000e99f6041","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dwgxeoaqykd3zdkhol5xpgsqabp4lys4ea7qpl3f2b75b2sdsex644id.onion/files/","pattern":"[url:value = 'http://dwgxeoaqykd3zdkhol5xpgsqabp4lys4ea7qpl3f2b75b2sdsex644id.onion/files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33b2a20f-6293-5d98-75de-000046740e6b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://therecord.media/ransomware-sheboygan-breach-notice","pattern":"[url:value = 'https://therecord.media/ransomware-sheboygan-breach-notice']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fb91d1f-77e6-feaa-c734-0000aeddc6f8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/chort","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/chort']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af7df8b3-5a8e-22ce-6861-0000c1bf637c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyjax.com/resources/blog/the-devil-and-the-termite-data-leak-sites-emerge-for-chort-and-termite-extortion-groups/","pattern":"[url:value = 'https://www.cyjax.com/resources/blog/the-devil-and-the-termite-data-leak-sites-emerge-for-chort-and-termite-extortion-groups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f03dd98-156f-1bd4-d3d6-0000aae94641","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/chort","pattern":"[url:value = 'https://www.ransomlook.io/group/chort']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afc3f9b1-8789-cf40-8880-0000f7f918d8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/killsec3","pattern":"[url:value = 'https://www.ransomlook.io/group/killsec3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21072e07-3251-7477-496c-0000645acf85","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xo4o2o2ezgydykywn6zkyqx7toio6z5rzvmjyakgtgkk22vv7223jmqd.onion/","pattern":"[url:value = 'http://xo4o2o2ezgydykywn6zkyqx7toio6z5rzvmjyakgtgkk22vv7223jmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f98ceeea-6336-d3aa-35d3-000074f00148","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion","pattern":"[url:value = 'http://ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f3ebe36-6943-3b26-d505-00006fb7424e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.infostealers.com/article/schneider-electric-hacked-and-blackmailed-due-to-lumma-infostealer-infection/","pattern":"[url:value = 'https://www.infostealers.com/article/schneider-electric-hacked-and-blackmailed-due-to-lumma-infostealer-infection/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45bb6069-f612-8331-31a5-00008a3eb4e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securityboulevard.com/2024/11/schneider-electric-hellcat-richixbw/","pattern":"[url:value = 'https://securityboulevard.com/2024/11/schneider-electric-hellcat-richixbw/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bae21088-d056-901b-7ea2-00001f969e29","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/schneider-electric-confirms-dev-platform-breach-after-hacker-steals-data/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/schneider-electric-confirms-dev-platform-breach-after-hacker-steals-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b3bb4e9-87ac-146b-c553-000063e72c62","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/hellcat","pattern":"[url:value = 'https://www.ransomlook.io/group/hellcat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c9efccc-b5ab-f5e3-f736-0000c37d3a14","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hcatxn4ppkgmakaatrq6bsbhqk5ouhviygyx57gljjt5iseul5nvpayd.onion","pattern":"[url:value = 'http://hcatxn4ppkgmakaatrq6bsbhqk5ouhviygyx57gljjt5iseul5nvpayd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43a73d61-9895-efb7-0c76-00009f399a0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hellcat.rw","pattern":"[url:value = 'http://hellcat.rw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f752e9a0-1ede-f5be-d728-000027d76044","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r7i4vprxr2vznmhnnxj36264ofwx6extopdz535f5v357nqacifymbad.onion/","pattern":"[url:value = 'http://r7i4vprxr2vznmhnnxj36264ofwx6extopdz535f5v357nqacifymbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cab9e77-c0d3-9981-2ece-00000b0ee603","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion","pattern":"[url:value = 'http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76a26f90-e93e-c153-3051-0000d3d84884","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/playboy","pattern":"[url:value = 'https://www.ransomlook.io/group/playboy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57526514-0138-6561-e146-000072b6e16f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ovcbyl77wplz67mdcilq6yq67eg56milg3xjehoiklbxrs4mondbklyd.onion/","pattern":"[url:value = 'http://ovcbyl77wplz67mdcilq6yq67eg56milg3xjehoiklbxrs4mondbklyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abbb3c95-38e0-aa31-3b32-000020ee2ce5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vlofmq2u3f5amxmnblvxaghy73aedwta74fyceywr6eeguw3cn6h6uad.onion/","pattern":"[url:value = 'http://vlofmq2u3f5amxmnblvxaghy73aedwta74fyceywr6eeguw3cn6h6uad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--106f774a-e5b0-dc83-b284-00003408de50","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/interlock","pattern":"[url:value = 'https://www.ransomlook.io/group/interlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38f46761-2e22-b531-1c40-00002d0f2fe4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://stqeg2wjdbt55cb2iwppgvxw4zzjht65ebh5o5jxg6j4d5cojh6ofayd.onion/","pattern":"[url:value = 'http://stqeg2wjdbt55cb2iwppgvxw4zzjht65ebh5o5jxg6j4d5cojh6ofayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef9e4131-094c-e865-79fa-00002f0a0ae1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dpzt5br7627qhzh2uumvgawf22nwdc2bqxzwwmxo44qsl6k4bqylgcyd.onion/","pattern":"[url:value = 'http://dpzt5br7627qhzh2uumvgawf22nwdc2bqxzwwmxo44qsl6k4bqylgcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0db7b05d-e584-ef12-8aca-000021d270d7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ujsgp44cddhfqhd332kbhe5g25ydsffdws7znd2kzub57qje6puxtaad.onion/","pattern":"[url:value = 'http://ujsgp44cddhfqhd332kbhe5g25ydsffdws7znd2kzub57qje6puxtaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26b8bfcb-2db5-181c-bdf2-0000cf6bb5e0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://aclcin5dix2zxnravkhxmdn65z72s6fuz7kvfunvvzbk2vhcusbc4iqd.onion/","pattern":"[url:value = 'http://aclcin5dix2zxnravkhxmdn65z72s6fuz7kvfunvvzbk2vhcusbc4iqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--682b367e-587d-a48d-18d2-00008fb968a9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qd64buovx475ebnhgzfxkrw6acdjyh6xvcjrzs6dolm6vyrfrugjeeid.onion/","pattern":"[url:value = 'http://qd64buovx475ebnhgzfxkrw6acdjyh6xvcjrzs6dolm6vyrfrugjeeid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73d850f4-422c-a23a-f108-000074089963","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cw3vtldn5uyvnxsqxyw4yp26di2stbjtaefdamogxj6shll5qhywhayd.onion/","pattern":"[url:value = 'http://cw3vtldn5uyvnxsqxyw4yp26di2stbjtaefdamogxj6shll5qhywhayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c21138a-2d34-d8b5-f2c5-000035528a68","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jmpskyo5updruqhmzonlkgwylzzkjm6vc3275fqwvskm5ky4rsdrwkad.onion/","pattern":"[url:value = 'http://jmpskyo5updruqhmzonlkgwylzzkjm6vc3275fqwvskm5ky4rsdrwkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bb4c096-0e29-c4fe-3799-00000a1e215c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b52ol5cbixgaqqfk5omdh7lol6spbtjujk7wmeqvqn6hqgxgg57hbayd.onion/","pattern":"[url:value = 'http://b52ol5cbixgaqqfk5omdh7lol6spbtjujk7wmeqvqn6hqgxgg57hbayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66444b24-59d6-84c6-9413-0000a90eb8b3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6cc3dxzg7x6cdev6pqhguslywzwy736fqd5cvuofpvkbnixcnt6vv3id.onion/","pattern":"[url:value = 'http://6cc3dxzg7x6cdev6pqhguslywzwy736fqd5cvuofpvkbnixcnt6vv3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8398fa36-d220-dc9c-14aa-0000c417ce4e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://e7uwqmk5zxn7nbi2nidna4zxq5gbzrr3dlijo52gqawstm4uo2ry5qyd.onion/","pattern":"[url:value = 'http://e7uwqmk5zxn7nbi2nidna4zxq5gbzrr3dlijo52gqawstm4uo2ry5qyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c14b76d-270e-a34b-0937-00000527f193","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7y5shgihgmnmdw2w775ql4ehjou7ohcvodpqftvv7njbw7gquzzgypad.onion/","pattern":"[url:value = 'http://7y5shgihgmnmdw2w775ql4ehjou7ohcvodpqftvv7njbw7gquzzgypad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12a3eef0-074e-81e7-9b64-0000ce901a5c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c2aekaij2khpuwifyeozvopddroh6odjnpu76i7vofb3reav6cqnyead.onion/","pattern":"[url:value = 'http://c2aekaij2khpuwifyeozvopddroh6odjnpu76i7vofb3reav6cqnyead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1452832-5a46-ae75-80ec-000088726f24","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://moyaddrnerilo5hij4ipmawoueewraqqvohpxjhqa6pxc4xrinqvjtad.onion/","pattern":"[url:value = 'http://moyaddrnerilo5hij4ipmawoueewraqqvohpxjhqa6pxc4xrinqvjtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e8ec4f5-0aa2-c6a3-fe47-0000e2ef4886","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bmec5qflyyin4jj4zd4mjsvad7jmnba7bogku47bdzipyn2ixbc6qbqd.onion/","pattern":"[url:value = 'http://bmec5qflyyin4jj4zd4mjsvad7jmnba7bogku47bdzipyn2ixbc6qbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88cb6c12-e27e-3fec-3d9c-00002e2a0dab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2aeo5xsw4bpus2k7nkbb3hbcq6omha55nf6b7t4ee2e72rawl7zs6tyd.onion/","pattern":"[url:value = 'http://2aeo5xsw4bpus2k7nkbb3hbcq6omha55nf6b7t4ee2e72rawl7zs6tyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c89dbbd1-47ab-948f-f750-0000f1b282eb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lt3zyc6nxy5lstx4ug3h6p5nisme2pizl2trdrfgvjjfu3qiebie67id.onion/","pattern":"[url:value = 'http://lt3zyc6nxy5lstx4ug3h6p5nisme2pizl2trdrfgvjjfu3qiebie67id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d92f6b0e-cde8-a132-04af-0000d330e748","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jkuznpm776w65vltha2khrr46rogu7a35ervkatn53ia46ao6bnsttid.onion/","pattern":"[url:value = 'http://jkuznpm776w65vltha2khrr46rogu7a35ervkatn53ia46ao6bnsttid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f9e42cb-d37a-3da2-d065-0000bc74afd4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3co4y4cmh7c2wxuo5q3df3pzstqe3p4d6dbgiku6ulbsvjjqvtnrmpad.onion/","pattern":"[url:value = 'http://3co4y4cmh7c2wxuo5q3df3pzstqe3p4d6dbgiku6ulbsvjjqvtnrmpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--463c9a3c-f949-4077-2d31-00007dc6470b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ccnneb7ydlbepaxzeqpztmtu74lklmwhcayo3wf4wlgexz7hfkmdplqd.onion/","pattern":"[url:value = 'http://ccnneb7ydlbepaxzeqpztmtu74lklmwhcayo3wf4wlgexz7hfkmdplqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c93a47f-aee0-f70d-9785-000008b6d14c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3xv4xxg2ljqvj3wcyzogktfmdusvusqdkapi476k3prt2q7basoejjid.onion/","pattern":"[url:value = 'http://3xv4xxg2ljqvj3wcyzogktfmdusvusqdkapi476k3prt2q7basoejjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a37a9339-459b-6a47-3b6c-00003570dae9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4lippfsmsdhcv5z7w57gpimjaxbbrvd6rlsebaxn44mwwd7ck2vik3yd.onion/","pattern":"[url:value = 'http://4lippfsmsdhcv5z7w57gpimjaxbbrvd6rlsebaxn44mwwd7ck2vik3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31274b2e-fd99-32d6-aa02-000070220dd0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://q5st6sooi4b6puqs7bahmqmep3ct4o3tei5eqwoo7sos46gqzqmdrmqd.onion/","pattern":"[url:value = 'http://q5st6sooi4b6puqs7bahmqmep3ct4o3tei5eqwoo7sos46gqzqmdrmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1dca54f-5cd9-e322-bad1-0000d3a559f1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zouuiplz37jxpu75gjdh73rlrgfsspjmq6s5366r3lw3s2re64wlaiyd.onion/","pattern":"[url:value = 'http://zouuiplz37jxpu75gjdh73rlrgfsspjmq6s5366r3lw3s2re64wlaiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e32c757b-acdb-c9be-39d7-0000cc4223ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://adx22qbq6sqqtxhhkan2ohzvf7xzrqhqxmgqxnrr2qgzdmntmw2turqd.onion/","pattern":"[url:value = 'http://adx22qbq6sqqtxhhkan2ohzvf7xzrqhqxmgqxnrr2qgzdmntmw2turqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2caa899-5f33-ea15-d336-00001bdbdb5c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3iw4b5sjfvttxp4m23vouzirdjfcnteztz6louulc7qzzzmxdevlarad.onion/","pattern":"[url:value = 'http://3iw4b5sjfvttxp4m23vouzirdjfcnteztz6louulc7qzzzmxdevlarad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebe483a6-ee7b-057e-3927-00009e4a897e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qh3dfeepsedjcointe2p3wmfrm7rvmpkc5cske726r5hzwm7g2daxzad.onion/","pattern":"[url:value = 'http://qh3dfeepsedjcointe2p3wmfrm7rvmpkc5cske726r5hzwm7g2daxzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acea6f99-cad3-6b93-44de-0000a40eba73","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6dzghkscfds7uege2auedn7chtni7c3op6mlwfxeufzph7yebudeyxqd.onion/","pattern":"[url:value = 'http://6dzghkscfds7uege2auedn7chtni7c3op6mlwfxeufzph7yebudeyxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad3581c2-e732-8392-6c3b-000012766a04","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://efs3fkrjyvqsk7nugzteelo5i5jxoch5ziqhf37dzmmlmzzlymhawmid.onion/","pattern":"[url:value = 'http://efs3fkrjyvqsk7nugzteelo5i5jxoch5ziqhf37dzmmlmzzlymhawmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ad1e8ff-0f29-0534-0200-00002d9deaaf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3cpc3v57l7rstjtaelxgnlrzsolz7pd6ltsygjo2tjuonxteyaba2pid.onion/","pattern":"[url:value = 'http://3cpc3v57l7rstjtaelxgnlrzsolz7pd6ltsygjo2tjuonxteyaba2pid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2baf4445-a2ab-1a06-2af7-0000505b3ed6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ex55if4jgsdyi6do4gtyzpishq2tvwatjrhoclqcihxcsipam3uxrryd.onion/","pattern":"[url:value = 'http://ex55if4jgsdyi6do4gtyzpishq2tvwatjrhoclqcihxcsipam3uxrryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72525c20-486c-a962-e440-00005f5021bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k6aw4if6phmqcdp5wzfdjfb3plmybzpkcssmgvv5nltv23tndvh4ewid.onion/","pattern":"[url:value = 'http://k6aw4if6phmqcdp5wzfdjfb3plmybzpkcssmgvv5nltv23tndvh4ewid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--860a5d5f-1dd4-8b85-dbfd-00007c56e6a2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pcixe2pw5ho6qpkjwbrsscvdcpzfj7vt3stvyde5ii5wdlqgvtyr4vad.onion/","pattern":"[url:value = 'http://pcixe2pw5ho6qpkjwbrsscvdcpzfj7vt3stvyde5ii5wdlqgvtyr4vad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e49d44b6-fda9-6c07-c1ad-00002f0ea210","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://awlcpawkphkrrhg6jhwoz5nnrhzz5kfwq2tuzmteyrosgfcpbkisarqd.onion/","pattern":"[url:value = 'http://awlcpawkphkrrhg6jhwoz5nnrhzz5kfwq2tuzmteyrosgfcpbkisarqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82ba9957-01fb-5694-c465-000016b216d8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ixybueqla5otlp5qfud5bcri2qoyxxhujwtrae5dkxnuo2eof3oliiyd.onion/","pattern":"[url:value = 'http://ixybueqla5otlp5qfud5bcri2qoyxxhujwtrae5dkxnuo2eof3oliiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d2ba16a-d92d-5ea2-c14b-0000aa967f3d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nh2kwgilfzi5mngiiqtcuoueh2oy4dkjq5cnfnjymueoj654fi7qtpid.onion/","pattern":"[url:value = 'http://nh2kwgilfzi5mngiiqtcuoueh2oy4dkjq5cnfnjymueoj654fi7qtpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0431ddf-1758-b7fc-7b20-0000621a4b75","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pal3f65j4qj7b2hz2mlmimu4vhl4wz7sfdlvp3g2ry3qwk5nc6pbakid.onion/","pattern":"[url:value = 'http://pal3f65j4qj7b2hz2mlmimu4vhl4wz7sfdlvp3g2ry3qwk5nc6pbakid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f23efff5-d25b-c51f-19ea-0000153c14be","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://eeguyk3ypl4afd4hqjg6hsb2wq2lg6wdesdbmdglrmnpx3qhnxuacbad.onion/","pattern":"[url:value = 'http://eeguyk3ypl4afd4hqjg6hsb2wq2lg6wdesdbmdglrmnpx3qhnxuacbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--931d3345-9787-5f4d-4be4-0000154a03ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ihbpu7nworzao2klqeeahnz7wcuavltny3p2cmfkhe5tko3vl3zcowyd.onion/","pattern":"[url:value = 'http://ihbpu7nworzao2klqeeahnz7wcuavltny3p2cmfkhe5tko3vl3zcowyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e950ab68-4a1f-97ee-bdf6-0000942aeb09","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2tlkuy2qn7bfxyvbfpxqaqveoezctbrnk6yvbvin6dueiuk4rdoosyqd.onion/","pattern":"[url:value = 'http://2tlkuy2qn7bfxyvbfpxqaqveoezctbrnk6yvbvin6dueiuk4rdoosyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e567a7cd-4125-3d7e-3d27-00005f919e8d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3ssy6kepkwajapmra262il4tnufgbujf2boz7odgigc3e46dzdqd6wad.onion/","pattern":"[url:value = 'http://3ssy6kepkwajapmra262il4tnufgbujf2boz7odgigc3e46dzdqd6wad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c6995f4-8292-63af-866f-00007ee3396d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hz7krqig75lgdzl7rtxynw26m3vornjl24ikeyqb5vagbae2iectorqd.onion/","pattern":"[url:value = 'http://hz7krqig75lgdzl7rtxynw26m3vornjl24ikeyqb5vagbae2iectorqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e556aec0-18cc-7bf6-73e9-0000d755b6ad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hu5zd7ek6glyoke5kfc4mvt6s3cmia6ebtqptumvbogzdo2vrn5e7bid.onion/","pattern":"[url:value = 'http://hu5zd7ek6glyoke5kfc4mvt6s3cmia6ebtqptumvbogzdo2vrn5e7bid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--899e81d2-2173-22e0-452c-00004f54b330","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x2ol75zago3z2nrp7lnmbcwoq3okiexuwi456oe6jqurbprg6lljz3yd.onion/","pattern":"[url:value = 'http://x2ol75zago3z2nrp7lnmbcwoq3okiexuwi456oe6jqurbprg6lljz3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5792135b-a366-5241-f696-0000eb713752","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pgjf3dfkamnprahggbw4yojyb7sot3no2glnbfwyzbzqbnaislpv52yd.onion/","pattern":"[url:value = 'http://pgjf3dfkamnprahggbw4yojyb7sot3no2glnbfwyzbzqbnaislpv52yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8cece76-4b0f-0e11-4dd4-00008daf44f3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://efgmr2vxwynrn7vlemidwf4ffwl4vljsb4eusaz3bplwk3apthpkpsad.onion/","pattern":"[url:value = 'http://efgmr2vxwynrn7vlemidwf4ffwl4vljsb4eusaz3bplwk3apthpkpsad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3262cb22-fbeb-324c-73c8-0000440dd9e3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c7bgta4watnqu64jnfgp4tzvhfhxgwveqnes65q3mcu4f34xvn7rumad.onion/","pattern":"[url:value = 'http://c7bgta4watnqu64jnfgp4tzvhfhxgwveqnes65q3mcu4f34xvn7rumad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f78a6083-5a58-9e1d-9a73-00007f95e119","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://f53mekzwvscxejfqxtikrzcmqnd3bt5i4d7odvh62sir7eqhdwwjntad.onion/","pattern":"[url:value = 'http://f53mekzwvscxejfqxtikrzcmqnd3bt5i4d7odvh62sir7eqhdwwjntad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66968540-4c49-f971-718a-0000db749277","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fbvrolfvadyhigunc5hfw5hextwqn4lvq7d5ieeivcizsxh3avn6dryd.onion/","pattern":"[url:value = 'http://fbvrolfvadyhigunc5hfw5hextwqn4lvq7d5ieeivcizsxh3avn6dryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--807e86d5-a593-e45b-1879-0000a550d103","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x6obl6pfmqsasvwj72hr22s2mpsdaklwkoa46zk3h7kbkcznu6whdmad.onion/","pattern":"[url:value = 'http://x6obl6pfmqsasvwj72hr22s2mpsdaklwkoa46zk3h7kbkcznu6whdmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d3f1724-9aac-46e4-6603-000078d70224","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3y5p4cq7bke5exre4smsgueqzfwdy7u4z3rp7o3dgxm27lhsx6vqraid.onion/","pattern":"[url:value = 'http://3y5p4cq7bke5exre4smsgueqzfwdy7u4z3rp7o3dgxm27lhsx6vqraid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b61c052-18ad-f582-7f2c-00006a0139db","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://24nmjyf6g5otaydjtintzmqv3qme3fnrt62ui2anqdz2hmxnwps4e2ad.onion/","pattern":"[url:value = 'http://24nmjyf6g5otaydjtintzmqv3qme3fnrt62ui2anqdz2hmxnwps4e2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9138715-e36e-ac41-7a43-00001ee76bbe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qfxx5gxyh53a32itguxez6dqcsm3vkrron3nmxhzkn3g64qld5lijoyd.onion/","pattern":"[url:value = 'http://qfxx5gxyh53a32itguxez6dqcsm3vkrron3nmxhzkn3g64qld5lijoyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fd520eb-2ded-e717-eeb5-000032fc7899","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mpyeixjqjufjki2qg7dutvxk6tjjzv2jf7qc63bljzfqrtbjcdktziqd.onion/","pattern":"[url:value = 'http://mpyeixjqjufjki2qg7dutvxk6tjjzv2jf7qc63bljzfqrtbjcdktziqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbf3e695-63e1-d8d3-6c0c-0000233ec8a2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vhs6omcvvqdtmgae5cvpy4jfxfrw2l4b7e64j7fn7xeaqeppzab67oad.onion/","pattern":"[url:value = 'http://vhs6omcvvqdtmgae5cvpy4jfxfrw2l4b7e64j7fn7xeaqeppzab67oad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e00446e6-2f4c-1668-cf8d-0000f857c5c6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zsjvoqymwx5gdwntsrrk3pvnkfyoxy3knhoxitpdaobxznwc5iwcj4id.onion/","pattern":"[url:value = 'http://zsjvoqymwx5gdwntsrrk3pvnkfyoxy3knhoxitpdaobxznwc5iwcj4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b2b4cb3-7d57-5636-4022-0000c31efcd5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gobj3ph5sj332iithgescrsejiszhaey5l4ffwnou4nwanbcf37phdqd.onion/","pattern":"[url:value = 'http://gobj3ph5sj332iithgescrsejiszhaey5l4ffwnou4nwanbcf37phdqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d351808-a404-5db3-3f28-00002ecd4821","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://f4fjja74gn766x5fwxqepl4aa7wyzuu3tj6fllt6oy6j5e27zxwskeid.onion/","pattern":"[url:value = 'http://f4fjja74gn766x5fwxqepl4aa7wyzuu3tj6fllt6oy6j5e27zxwskeid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64936a6f-2435-32aa-db2a-000041e98804","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6rv6jkdw762q7md7ryqi2ooqmv54ajlnevxl4ozgdvo7p6e2msndyxid.onion/","pattern":"[url:value = 'http://6rv6jkdw762q7md7ryqi2ooqmv54ajlnevxl4ozgdvo7p6e2msndyxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ddd7ab2-8b31-4839-33d3-00001f1e50f8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wp5yyng6znkcsijil5w4bug7b6uww573ut3czz3amjpfdusnuu4u5kad.onion/","pattern":"[url:value = 'http://wp5yyng6znkcsijil5w4bug7b6uww573ut3czz3amjpfdusnuu4u5kad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--459ef657-ad6d-0342-64cf-0000c8d485a6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pzbd27cw7pkctovnmfaoeldjf32bc63mwqwhcxcftkqntest2bkkuaid.onion/","pattern":"[url:value = 'http://pzbd27cw7pkctovnmfaoeldjf32bc63mwqwhcxcftkqntest2bkkuaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c657c37-bc2a-a2ae-4f39-00006b0015da","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://glsvddrnd4qu56uhx65mrepgaoer6vtfr6q6qgsbpnml3b3fm2h7lcid.onion/","pattern":"[url:value = 'http://glsvddrnd4qu56uhx65mrepgaoer6vtfr6q6qgsbpnml3b3fm2h7lcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eab7414a-5bae-5fc9-e672-0000351c1539","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hhzt3me6rtxg5rwjbikojbxioosmiprsjrd25ovjhxirx4ocjdwuoqad.onion/","pattern":"[url:value = 'http://hhzt3me6rtxg5rwjbikojbxioosmiprsjrd25ovjhxirx4ocjdwuoqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0d19eb1-b0d4-0e47-77bd-00002efc94af","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://d55ahmrs2mbfcmframropdz4epz3is77ex2fbkbowhrqtxv7knunkxqd.onion/","pattern":"[url:value = 'http://d55ahmrs2mbfcmframropdz4epz3is77ex2fbkbowhrqtxv7knunkxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76a4a3d8-f004-cc29-2d46-0000237da98b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://viqh6qmehdkpn7jrfhthyejxtg3gd5hg4bch7sjetvkdaipeu3k6anad.onion/","pattern":"[url:value = 'http://viqh6qmehdkpn7jrfhthyejxtg3gd5hg4bch7sjetvkdaipeu3k6anad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fcb2034-640c-ba13-d53c-00004e263727","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ycgykop5f4te6yaptg57ze75kgnqo6u2e3yyeo3hkjgjxakjx2g5ksqd.onion/","pattern":"[url:value = 'http://ycgykop5f4te6yaptg57ze75kgnqo6u2e3yyeo3hkjgjxakjx2g5ksqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcea7c9a-abb1-b931-c231-0000c7a745c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vecdwhichsjnv3x7t5b4o2hk23iwjurmcp2wrwd25jp3smvsth6e6nid.onion/","pattern":"[url:value = 'http://vecdwhichsjnv3x7t5b4o2hk23iwjurmcp2wrwd25jp3smvsth6e6nid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--240f29ab-19ae-7327-8bfc-0000f5a27571","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://u2q76zahlrpgvktr3i2j6o2emzcre67et2kvz43kj2gbrhokc2othqyd.onion/","pattern":"[url:value = 'http://u2q76zahlrpgvktr3i2j6o2emzcre67et2kvz43kj2gbrhokc2othqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f72c0deb-b9ea-5654-a131-0000d6b768b6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5s2rv76limdt3eelmoh2vw6xovckjl563tjdifplvyxezdchcyn5xxyd.onion/","pattern":"[url:value = 'http://5s2rv76limdt3eelmoh2vw6xovckjl563tjdifplvyxezdchcyn5xxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f51d099d-3bb8-72f9-cebe-0000b379b968","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sogw6fz6swsg42esmor63wj3iijpmoydt7sizwgzf2k6na6nglqt52ad.onion/","pattern":"[url:value = 'http://sogw6fz6swsg42esmor63wj3iijpmoydt7sizwgzf2k6na6nglqt52ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e3ee4c-0a24-63a1-f872-000074085c5f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://si5km7k55oggbea5xwls3bbypmsmuaamr3ejttmjnodcb3v4r766uzid.onion/","pattern":"[url:value = 'http://si5km7k55oggbea5xwls3bbypmsmuaamr3ejttmjnodcb3v4r766uzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04d7f297-0dff-7135-6ee6-000032172f97","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://siveyggnpoei2ehkmov6jri265tlaeyxfvlqnwrsgawgwmia44pmvcqd.onion/","pattern":"[url:value = 'http://siveyggnpoei2ehkmov6jri265tlaeyxfvlqnwrsgawgwmia44pmvcqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a69592c-3908-28df-da44-00009a36c591","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sv3tk3wcdkwednk5rxpz5ejxe4n2cvwx62rct66qjaukkpmpuovgwhid.onion/","pattern":"[url:value = 'http://sv3tk3wcdkwednk5rxpz5ejxe4n2cvwx62rct66qjaukkpmpuovgwhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be63632c-87a8-d433-e81f-00005f4af212","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cavpp4bldfjrk42bb3ter532fnfp3qjtnizn7xh62b3j3zat6jmuluqd.onion/","pattern":"[url:value = 'http://cavpp4bldfjrk42bb3ter532fnfp3qjtnizn7xh62b3j3zat6jmuluqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--add0ad00-f3ef-4252-1446-0000690c5573","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zvcj6cc6qs3zxk25uq4wq22cxu7gwu5zsevn7jdizinoomem34vmvbid.onion/","pattern":"[url:value = 'http://zvcj6cc6qs3zxk25uq4wq22cxu7gwu5zsevn7jdizinoomem34vmvbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0145180-1cbb-858a-d2e6-0000ac39e6b6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://u4d4ep4azlkdl3yexoe3dqdod4be3coupi6ksvdjhvisyx5imeec2nqd.onion/","pattern":"[url:value = 'http://u4d4ep4azlkdl3yexoe3dqdod4be3coupi6ksvdjhvisyx5imeec2nqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e9610dd-5d64-2130-f4d6-00002289c7b3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://h3am4jted6s4r7ksbpdhlh7576oyfqrg5vz6ekgjqxt23gbnnwqj3uid.onion/","pattern":"[url:value = 'http://h3am4jted6s4r7ksbpdhlh7576oyfqrg5vz6ekgjqxt23gbnnwqj3uid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cb518a6-cea2-1b24-1bf2-00001093bb0a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2pkcf4khxmekivwcdaciw745cgwjzvmsubv5itijvwlgi6koesvsimyd.onion/","pattern":"[url:value = 'http://2pkcf4khxmekivwcdaciw745cgwjzvmsubv5itijvwlgi6koesvsimyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26077190-fa61-0ed3-7215-0000a125206c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xkx3mnwnnq7pxv3n7aj73ks3ktsrd2cbizkdakh4kcwz4um3cqgb7lad.onion/","pattern":"[url:value = 'http://xkx3mnwnnq7pxv3n7aj73ks3ktsrd2cbizkdakh4kcwz4um3cqgb7lad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7309e012-53b7-e6f3-4538-0000cc76798b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ojzzeir4smqznsfsrg6xu5vcpsx4z2ue7yfgk7zf3tiqe3cp65mxe7yd.onion/","pattern":"[url:value = 'http://ojzzeir4smqznsfsrg6xu5vcpsx4z2ue7yfgk7zf3tiqe3cp65mxe7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba116310-801d-a677-7015-0000cc30fef2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://of5rslzmymbsdny4iyq23xp476s5i4wgxnq3dkasq4ttorpk4isf4bqd.onion/","pattern":"[url:value = 'http://of5rslzmymbsdny4iyq23xp476s5i4wgxnq3dkasq4ttorpk4isf4bqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e422ab6d-b32a-5a7c-73ed-00002cea39ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zgqemwdpqhfcykdanocr3ietnribz66mvot7xjbjc3flz7x577los4yd.onion/","pattern":"[url:value = 'http://zgqemwdpqhfcykdanocr3ietnribz66mvot7xjbjc3flz7x577los4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a5c4855-c511-fd37-a4cd-0000c47c71bd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bb2cul7lhepsndibwkjn2ngabetiwtisx3ctcrdq5hpr54oqu66vjeqd.onion/","pattern":"[url:value = 'http://bb2cul7lhepsndibwkjn2ngabetiwtisx3ctcrdq5hpr54oqu66vjeqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2021a813-a41b-cd5f-2399-0000c0a17e18","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://77tolkryntdehobn6ewnykd3cdbd5vkaf7v4mbycwnlykxxv6holl4id.onion/","pattern":"[url:value = 'http://77tolkryntdehobn6ewnykd3cdbd5vkaf7v4mbycwnlykxxv6holl4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4be74fb5-6168-bd5b-7cdb-00007e6c5d0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4uc4rp7p6u4qsizcjpiyif4r5jxt54rejvs2qcljtnqfogiovtpfdpyd.onion/","pattern":"[url:value = 'http://4uc4rp7p6u4qsizcjpiyif4r5jxt54rejvs2qcljtnqfogiovtpfdpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9f75c82-685b-149b-83ae-00002310ff0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kjmofzzu4mhhuprggcdfex2zdgzwrtkn6d4ead7zgfh36vjrm56zskad.onion/","pattern":"[url:value = 'http://kjmofzzu4mhhuprggcdfex2zdgzwrtkn6d4ead7zgfh36vjrm56zskad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3d99dfd-ca36-7045-8b5d-0000728a3bf9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vnka63n2nkyrsiigq5mvvvum6ch6czbb4liumk2gvicw5pts3a2ffwyd.onion/","pattern":"[url:value = 'http://vnka63n2nkyrsiigq5mvvvum6ch6czbb4liumk2gvicw5pts3a2ffwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ee480fc-50ea-51be-7e18-0000d44c716e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zwvr7nt32hari3532hmqp6eh65ajiytpqjn6iyfby3relsnebdhurcyd.onion/","pattern":"[url:value = 'http://zwvr7nt32hari3532hmqp6eh65ajiytpqjn6iyfby3relsnebdhurcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bd13bc7-7030-1f5f-7f7e-0000adf0c81a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pqb54aeitnoiikcsourdmnpawuk55pa7w3a37dyyii2yrqh2nrx6qfid.onion/","pattern":"[url:value = 'http://pqb54aeitnoiikcsourdmnpawuk55pa7w3a37dyyii2yrqh2nrx6qfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffc8e0d2-7df9-c43c-6d93-0000b1ba1d61","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mdwmuf62db2xmuwsfdfsu54dek5amtuig74rvhvgyysh3tbjocq72pqd.onion/","pattern":"[url:value = 'http://mdwmuf62db2xmuwsfdfsu54dek5amtuig74rvhvgyysh3tbjocq72pqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddc0317e-0bad-986c-ff96-0000f720c52b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://v64ygsm7lhc6atz5tbm2xubb5qxzt22abdkceanirbavjqvkximxbeyd.onion/","pattern":"[url:value = 'http://v64ygsm7lhc6atz5tbm2xubb5qxzt22abdkceanirbavjqvkximxbeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8bd58a3-9eff-2bed-a8c7-0000e8fabe32","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nfx5jpjpyzshisp2kerg23h5vyckzca7nt7psfbp7oo5jlfbbbqthtad.onion/","pattern":"[url:value = 'http://nfx5jpjpyzshisp2kerg23h5vyckzca7nt7psfbp7oo5jlfbbbqthtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1db5cf2-0ac1-2ebc-87f9-00004539fbf5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xg6f26wud5ah7dirviynwjd2r6ue6d2qgxur6lhva4heh4od26cnqmid.onion/","pattern":"[url:value = 'http://xg6f26wud5ah7dirviynwjd2r6ue6d2qgxur6lhva4heh4od26cnqmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae4c896a-c5da-09ee-cb1e-0000241d254f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tb7u2kklhck3j4wlf7d32p5s7dbiear34rew4dpebljyl3xomkce4yyd.onion/","pattern":"[url:value = 'http://tb7u2kklhck3j4wlf7d32p5s7dbiear34rew4dpebljyl3xomkce4yyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2fbaeb8-0a95-67c1-1de5-000025d05017","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r6bldqhpune45yj6eeafxmrhszjzgijtoxgw256zpe44tqnj5popbaqd.onion/","pattern":"[url:value = 'http://r6bldqhpune45yj6eeafxmrhszjzgijtoxgw256zpe44tqnj5popbaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66a0a277-d8fa-8652-bcbc-0000ef2f469e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qj7qf42blj4a26uf5irazkxbivtutvg4vgkd4zbzbtu4nkipwkdtcsid.onion/","pattern":"[url:value = 'http://qj7qf42blj4a26uf5irazkxbivtutvg4vgkd4zbzbtu4nkipwkdtcsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e771bae-651a-61a6-589a-000040c71a8f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jqtid6srueyxf6vwllcjdqip34usp2pulacs32wdo3moayl7r7mexjid.onion/","pattern":"[url:value = 'http://jqtid6srueyxf6vwllcjdqip34usp2pulacs32wdo3moayl7r7mexjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0aca3db4-28db-51c0-58b1-000027787078","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rz7tnory6tdtd6jtyav7giryrvitrzryt36qjpb3fznoy6qbo44i3yqd.onion/","pattern":"[url:value = 'http://rz7tnory6tdtd6jtyav7giryrvitrzryt36qjpb3fznoy6qbo44i3yqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9adc1ab3-b239-2101-aeb6-00000c266159","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://socqxduah5lbzgyuhg2qn5nikufg2taerdjzxx3scwxbng2haw4nyiid.onion/","pattern":"[url:value = 'http://socqxduah5lbzgyuhg2qn5nikufg2taerdjzxx3scwxbng2haw4nyiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a95f14a5-964d-59c2-47e5-0000febf41bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c2ru4ewkanyqud25xp3i4jctkw3pdmo4kosceyzwzwx6dfkj43oqq6id.onion/","pattern":"[url:value = 'http://c2ru4ewkanyqud25xp3i4jctkw3pdmo4kosceyzwzwx6dfkj43oqq6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68d103f6-9c92-7388-0880-00009fc6fb25","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ff3sx2vy5bpyiso756gndde6bt7i2diqzlwz5augagvkyykevy4326qd.onion/","pattern":"[url:value = 'http://ff3sx2vy5bpyiso756gndde6bt7i2diqzlwz5augagvkyykevy4326qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a62380b5-dba4-e49c-e276-0000ae0790ca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://a6lkcqjlxnlnik2h2dy747mnhz6vlnpzwdgy3k64zmbhu7h4l5xdq6yd.onion/","pattern":"[url:value = 'http://a6lkcqjlxnlnik2h2dy747mnhz6vlnpzwdgy3k64zmbhu7h4l5xdq6yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ee363bc-bd37-4240-c3bf-00004fe1c942","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4e44wmx75wmu4s4w362udyi62shlwf4i3svoqyarnnwcnnbs5x45h4yd.onion/","pattern":"[url:value = 'http://4e44wmx75wmu4s4w362udyi62shlwf4i3svoqyarnnwcnnbs5x45h4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07359c8d-e8e7-b772-9987-000096dccc4f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dnwvgf7jzohu4exrokw4wphxtd77wueiswgvtgzhqihvituzzjw4coyd.onion/","pattern":"[url:value = 'http://dnwvgf7jzohu4exrokw4wphxtd77wueiswgvtgzhqihvituzzjw4coyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fec621b1-f0b5-1af2-7580-0000ce72a311","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://smfqmccqa5go2vm4ern426rcc2med7einerpt5unpv5zr222fwmz6jid.onion/","pattern":"[url:value = 'http://smfqmccqa5go2vm4ern426rcc2med7einerpt5unpv5zr222fwmz6jid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e98f62-ac7b-c402-d5c6-0000dae884dc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5nfm2urc2cwnr6ydie2airqozhggno3dagswnndb4efh4d4w7adapcid.onion/","pattern":"[url:value = 'http://5nfm2urc2cwnr6ydie2airqozhggno3dagswnndb4efh4d4w7adapcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fa213c7-ac87-dd4f-53f1-000039a14632","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2yhjemwks5pkrev5mzwo6cgfqvz2xnrvka2nxursjadn26p3o2k64ryd.onion/","pattern":"[url:value = 'http://2yhjemwks5pkrev5mzwo6cgfqvz2xnrvka2nxursjadn26p3o2k64ryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d86a482-e917-1524-8f02-0000d877d5b5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yzyeh2yjj3ku7lgricfbg7vbhc4fy3s6icoccb7272tsoz3pggrek7qd.onion/","pattern":"[url:value = 'http://yzyeh2yjj3ku7lgricfbg7vbhc4fy3s6icoccb7272tsoz3pggrek7qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--959a6754-b2e0-6087-5d6d-0000a5a5446d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dzdzs6kv75adyeowpztwaih5t3fuwtccgdgvdv3mmhkh2lbxuznaldyd.onion/","pattern":"[url:value = 'http://dzdzs6kv75adyeowpztwaih5t3fuwtccgdgvdv3mmhkh2lbxuznaldyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--367e6f30-9cda-0172-ed42-000085c58b5b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mt6vixiaaupvpbqfft6r7kyvumlpiim5k4j26j2mpvoskar4keanuhad.onion/","pattern":"[url:value = 'http://mt6vixiaaupvpbqfft6r7kyvumlpiim5k4j26j2mpvoskar4keanuhad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5ff174-5aa3-4413-e632-000051fd1986","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://if6cf3llwqht3bs2glotrlsj4ayowc4pipadzbf7bkztln5ykifkjpyd.onion/","pattern":"[url:value = 'http://if6cf3llwqht3bs2glotrlsj4ayowc4pipadzbf7bkztln5ykifkjpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f34f1721-b385-d7f3-db55-00002e19b11d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hm5c4dgtsiieuxnbaieinkokhcwryspk5xzqknm53ocahyxaddlfwsad.onion/","pattern":"[url:value = 'http://hm5c4dgtsiieuxnbaieinkokhcwryspk5xzqknm53ocahyxaddlfwsad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--687d6601-5161-6465-d9b5-0000e8a7ee51","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vubcpscmz2hveptwsv3voi6l3blgior6jk4kxe5zwnz23siofqwvw7yd.onion/","pattern":"[url:value = 'http://vubcpscmz2hveptwsv3voi6l3blgior6jk4kxe5zwnz23siofqwvw7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--856a1416-96aa-5951-6bfd-00006f14c5fa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sexquqf4dcwtgv2spjguu4msvawaxrmlmjfiyciuthhtjmwim7i6b4id.onion/","pattern":"[url:value = 'http://sexquqf4dcwtgv2spjguu4msvawaxrmlmjfiyciuthhtjmwim7i6b4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cfa9fbd-f1c1-093c-b741-00009241a506","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://soyjfzmmhadt7v4xugqhhl55kiebrjprjypwwbcun5nehmdabquumiqd.onion/","pattern":"[url:value = 'http://soyjfzmmhadt7v4xugqhhl55kiebrjprjypwwbcun5nehmdabquumiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7761a03-cef5-ea26-c36e-0000ff7bd5c2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://y3zfr23ubg7zvzdlo2incm55ro2ybtmzth67eklxpxo55aux2jiqpbid.onion/","pattern":"[url:value = 'http://y3zfr23ubg7zvzdlo2incm55ro2ybtmzth67eklxpxo55aux2jiqpbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--595ab5f7-13f2-41df-9342-000056f1c2b5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4k6hj4ash2oo5svymxxrsycex3mdv5dqzom5rlyoojpe6map2lqgmqad.onion/","pattern":"[url:value = 'http://4k6hj4ash2oo5svymxxrsycex3mdv5dqzom5rlyoojpe6map2lqgmqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59553f58-c741-094c-a899-0000d506b5b8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ph2ilpfayyumhbetpdu6zovwy4vvm7qz3puh7k4zbre7bsf4e4ym5lqd.onion/","pattern":"[url:value = 'http://ph2ilpfayyumhbetpdu6zovwy4vvm7qz3puh7k4zbre7bsf4e4ym5lqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44b7313e-e5a7-8225-c07f-000049dbaced","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b5yuydwoxorp2qvirovzavbhpj72lcisv5unwblohkb6443u7m2mzuad.onion/","pattern":"[url:value = 'http://b5yuydwoxorp2qvirovzavbhpj72lcisv5unwblohkb6443u7m2mzuad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--219f1ece-d714-1c49-cb7e-0000dbb64fcf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6oqw2koek4nbmbb7ic3y4jr6scqsypg5en4h6mcqyrgg3jkny4sgaiyd.onion/","pattern":"[url:value = 'http://6oqw2koek4nbmbb7ic3y4jr6scqsypg5en4h6mcqyrgg3jkny4sgaiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8217495e-8201-5c8a-8e26-0000303c371d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c4xaaynebochyp6ccvxi2bzbvncosdhqcb65cjuqwgqcljlul5gbrhyd.onion/","pattern":"[url:value = 'http://c4xaaynebochyp6ccvxi2bzbvncosdhqcb65cjuqwgqcljlul5gbrhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45ebc087-6fb9-ff5f-1172-0000ec2ea450","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dnyyuk3nevegj37tnv3xav57c5twomc7uqsfbjlkwto3p4spzfop47qd.onion/","pattern":"[url:value = 'http://dnyyuk3nevegj37tnv3xav57c5twomc7uqsfbjlkwto3p4spzfop47qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b6bd852-7c94-dcd1-6116-000008cf488c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xqcx7b57dd5vrqllokebwuvub4hk3viktn4lsgyt2bg67oujd42xolqd.onion/","pattern":"[url:value = 'http://xqcx7b57dd5vrqllokebwuvub4hk3viktn4lsgyt2bg67oujd42xolqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6398d601-bdb0-3e79-5ed7-0000dc025615","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vdnoyjrxieoikuqu3rpathtejvgl4xc6laihepyoyhw7tmuyxxhtvrqd.onion/","pattern":"[url:value = 'http://vdnoyjrxieoikuqu3rpathtejvgl4xc6laihepyoyhw7tmuyxxhtvrqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c136b0be-c351-144b-53c2-000010c9ad54","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ir3oqafizlapipdyrebrfuk5bxd56zqjemljvfkeb42nzpxvkxwmqpqd.onion/","pattern":"[url:value = 'http://ir3oqafizlapipdyrebrfuk5bxd56zqjemljvfkeb42nzpxvkxwmqpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--394d29cb-195d-f1b7-76ce-000025a79ef0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bt52afulf6zsk3xhzceam6ukipw2wrzpfsizlizdcootn5bc4ewzr7ad.onion/","pattern":"[url:value = 'http://bt52afulf6zsk3xhzceam6ukipw2wrzpfsizlizdcootn5bc4ewzr7ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--789cead1-e2c3-d5aa-013f-00002515ded8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lbqgjosup47uopyrlvbylzixcp7l5rsrxcdv3y4vy23cczcftsr6imad.onion/","pattern":"[url:value = 'http://lbqgjosup47uopyrlvbylzixcp7l5rsrxcdv3y4vy23cczcftsr6imad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c504aff8-b3ef-a955-b058-00006153033c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://u2qvcxl65guk4lxi2lyxq5zwlgnq7ojahihr4ipl7a3wcui6pvff7dyd.onion/","pattern":"[url:value = 'http://u2qvcxl65guk4lxi2lyxq5zwlgnq7ojahihr4ipl7a3wcui6pvff7dyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46b3be1b-37e2-4c82-10c2-0000cc2b6879","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nz5rdh2alikmxiyojqx52yhzxdqfty3jwtvcybqajxrkbtsk36jy4aqd.onion/","pattern":"[url:value = 'http://nz5rdh2alikmxiyojqx52yhzxdqfty3jwtvcybqajxrkbtsk36jy4aqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abba6902-feab-f805-e3fe-000068791b17","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fe3klmmbb7upoybd45ayjkxebqxaxukleu2w56kgo67rcnrxlalrxdad.onion/","pattern":"[url:value = 'http://fe3klmmbb7upoybd45ayjkxebqxaxukleu2w56kgo67rcnrxlalrxdad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6f761df-198d-c227-0853-00002d9c0a1c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rqkmahiz55v6bgogfgyni5h7v4sq3bgayycpa6u4c7if7kpvrylcrmad.onion/","pattern":"[url:value = 'http://rqkmahiz55v6bgogfgyni5h7v4sq3bgayycpa6u4c7if7kpvrylcrmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37eb57f3-a973-3b90-568d-000081d67873","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://63dxcqyjooi55s2x25aqsvrykywmmaaoxj4kc23kdboyxyng2zqtkbyd.onion/","pattern":"[url:value = 'http://63dxcqyjooi55s2x25aqsvrykywmmaaoxj4kc23kdboyxyng2zqtkbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a281bf68-4815-8305-adda-00004b50de55","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zdn5uv663oiffbrloxalsdl4v3lg73elrnuso47rbuavu6bmhqvd2wqd.onion/","pattern":"[url:value = 'http://zdn5uv663oiffbrloxalsdl4v3lg73elrnuso47rbuavu6bmhqvd2wqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30d0d53e-26ae-a1fa-19a2-0000a01f6e8a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5hiynrduugrjbzxluostnxmitaer62obvfyrfxnqkdeog2ejpxhzuqid.onion/","pattern":"[url:value = 'http://5hiynrduugrjbzxluostnxmitaer62obvfyrfxnqkdeog2ejpxhzuqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--296918cd-b25e-e9fe-4f4a-0000db740131","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://key55aknlvgxs57kapodjw55ww23ryxbwfgwki5334gs5ok73wntdmyd.onion/","pattern":"[url:value = 'http://key55aknlvgxs57kapodjw55ww23ryxbwfgwki5334gs5ok73wntdmyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1067a6cb-da72-eca9-5853-00004207d38b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://af2o3nw2txv3u2vfwntytytw73cgplcsaf7zccrg3xxcwzapu3sgydad.onion/","pattern":"[url:value = 'http://af2o3nw2txv3u2vfwntytytw73cgplcsaf7zccrg3xxcwzapu3sgydad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df205de0-8e62-d9b9-dcdf-000069ef9600","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gd2cx4zvobqui6ssbbroferiv6oxlqyyy447aqpp2socxvvdu5rooyid.onion/","pattern":"[url:value = 'http://gd2cx4zvobqui6ssbbroferiv6oxlqyyy447aqpp2socxvvdu5rooyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1a171d8-b188-0533-794b-0000e019fa4e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vdo2l4ujgxfcucbhnzdd4745sbbd2vnnkj4csyf5blds2qomguubx5yd.onion/","pattern":"[url:value = 'http://vdo2l4ujgxfcucbhnzdd4745sbbd2vnnkj4csyf5blds2qomguubx5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f2a7288-e840-3b07-99dd-0000dde2dd5b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iwdzb7nnphh2rffdygryptldmr5ip3lk6dejfwn6qlbtvyipqxzbwdyd.onion/","pattern":"[url:value = 'http://iwdzb7nnphh2rffdygryptldmr5ip3lk6dejfwn6qlbtvyipqxzbwdyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c68ab684-d326-dcdb-18b4-0000adb89534","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cbmeu74emtvhqr7cwbq4aaui4qw4f2kui674fuoeowwd6oem33bzf7yd.onion/","pattern":"[url:value = 'http://cbmeu74emtvhqr7cwbq4aaui4qw4f2kui674fuoeowwd6oem33bzf7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--126dece1-7e20-0ead-e0e6-00009d9e5e2e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6476eeaclqfjhnlusdwcui7i5mqxmo6i4evxi7jhqxemx2s6rtucxead.onion/","pattern":"[url:value = 'http://6476eeaclqfjhnlusdwcui7i5mqxmo6i4evxi7jhqxemx2s6rtucxead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db56471f-c435-0c44-f6f0-0000de3c8c3b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3zzis52fvjbhoo2i5gyrmoeofqdr3m45jyvltuamxzktt77grsuczxid.onion/","pattern":"[url:value = 'http://3zzis52fvjbhoo2i5gyrmoeofqdr3m45jyvltuamxzktt77grsuczxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1069a801-a317-2536-998e-0000a704c094","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ernx4wj3gzhlqxhlrsrsfxe3hd275uny7w3yorhbgwp7jlsxv23rolqd.onion/","pattern":"[url:value = 'http://ernx4wj3gzhlqxhlrsrsfxe3hd275uny7w3yorhbgwp7jlsxv23rolqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--830ce205-6856-f1d0-4177-000097435a83","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5eyzyzb6boe4dud4pwcuyigd54k262xf53z6zqkxs6gyzcfhoj2utcqd.onion/","pattern":"[url:value = 'http://5eyzyzb6boe4dud4pwcuyigd54k262xf53z6zqkxs6gyzcfhoj2utcqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c6bce6b-3cf9-6f83-e483-00003fed23e3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ivaoowg6juugqyn4tfpt2ilmwx3ea47c6ijxwlvgvrc6pemuwdywn6yd.onion/","pattern":"[url:value = 'http://ivaoowg6juugqyn4tfpt2ilmwx3ea47c6ijxwlvgvrc6pemuwdywn6yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a79efc42-4eae-2ee8-84bd-000028d60c55","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6mwjyc64rnkht3qc4bv7svpufmbvm3k73vekxgdlsbqzx5toueq3ndyd.onion/","pattern":"[url:value = 'http://6mwjyc64rnkht3qc4bv7svpufmbvm3k73vekxgdlsbqzx5toueq3ndyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0490780f-2406-4b9d-6fd0-0000e8c3622d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yp7yctliltdy3mdrdd2lfvcjx2xgcxrbvycje47jn6fbceurgznnapqd.onion/","pattern":"[url:value = 'http://yp7yctliltdy3mdrdd2lfvcjx2xgcxrbvycje47jn6fbceurgznnapqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e76d66f-41d8-985a-36a8-0000d9f97f5d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://523gzulwswe5tfevqlrxvqqh2fxo2mwrs2irnjel4mtu7qodgdu2ccyd.onion/","pattern":"[url:value = 'http://523gzulwswe5tfevqlrxvqqh2fxo2mwrs2irnjel4mtu7qodgdu2ccyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d7aeecb-d094-14cb-32a5-000019a17ac2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xbgiykmt3v25qkspndphfdktiezfeesq6t45ewsrizid5s37ljgs25ad.onion/","pattern":"[url:value = 'http://xbgiykmt3v25qkspndphfdktiezfeesq6t45ewsrizid5s37ljgs25ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40912006-51c5-8146-9198-0000e277be2c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z6xr75yrgbry3a7zxc734sac2u6libikshm2j5tsbrh5geq7ilik3nad.onion/","pattern":"[url:value = 'http://z6xr75yrgbry3a7zxc734sac2u6libikshm2j5tsbrh5geq7ilik3nad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e45bb60a-6aab-4569-6536-0000b7c741de","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ad7tx2oyln5g6yk7turvhjxhqvunfucuiq5iwzc5odlomft7tvysxvqd.onion/","pattern":"[url:value = 'http://ad7tx2oyln5g6yk7turvhjxhqvunfucuiq5iwzc5odlomft7tvysxvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa0a660d-f4fe-b49e-5d16-00002fdcf338","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k5nuvkinhjd3nf75zb452xl5oxtdhg4hucmui5n72fou3frw6e25v5id.onion/","pattern":"[url:value = 'http://k5nuvkinhjd3nf75zb452xl5oxtdhg4hucmui5n72fou3frw6e25v5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91c25cf9-30e4-c2ec-e3e1-00002d07bca4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://e762chqol5savlrfqljepxwtozrxxwarkuyhqps2n34tm3rliff4beqd.onion/","pattern":"[url:value = 'http://e762chqol5savlrfqljepxwtozrxxwarkuyhqps2n34tm3rliff4beqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb94c542-f0c9-b8c3-cd1b-0000c68768ed","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5f7erlowczufe5cntt37ljhibswckyyxj4wrtuepdyygvooozkqpciid.onion/","pattern":"[url:value = 'http://5f7erlowczufe5cntt37ljhibswckyyxj4wrtuepdyygvooozkqpciid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef91841c-363f-f160-0e78-000039ade1c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gxtrbmin7uses7lo6ryg6zdik6pevsjhk42zzlos7dbwpsfrqd6osjad.onion/","pattern":"[url:value = 'http://gxtrbmin7uses7lo6ryg6zdik6pevsjhk42zzlos7dbwpsfrqd6osjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf2f454d-b53f-41fe-00dd-0000aaebddeb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5mk7t3hpdjei4ezymeog3kfsjmfxghvwr5ekerdilitafolstou5vpid.onion/","pattern":"[url:value = 'http://5mk7t3hpdjei4ezymeog3kfsjmfxghvwr5ekerdilitafolstou5vpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ea20c95-5559-6aee-6c4d-00009bc3b2f3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gmgcrvr2piu5wl7eh7vuw3cyrunksox5d4zhvdkgd3kbnwbgvrglkjad.onion/","pattern":"[url:value = 'http://gmgcrvr2piu5wl7eh7vuw3cyrunksox5d4zhvdkgd3kbnwbgvrglkjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5df64750-ace6-5f07-cf7f-0000732ce5a8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hhmbi4q4sy7m7oyfrpjkxparnrrwijna3ncucu3vwc24v7xhjvst7nqd.onion/","pattern":"[url:value = 'http://hhmbi4q4sy7m7oyfrpjkxparnrrwijna3ncucu3vwc24v7xhjvst7nqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bc82e60-7c63-cb41-ed35-00002219cd7b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ljurl2gqwtgfqzk6pkz5ggtdrdrpzpzzkdvf4jhpkk33dnwkcsmdi4ad.onion/","pattern":"[url:value = 'http://ljurl2gqwtgfqzk6pkz5ggtdrdrpzpzzkdvf4jhpkk33dnwkcsmdi4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5eff1241-ecd0-cf0c-1e0b-0000d0d83d59","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7hhhjnxeps222bydmavgawgw5mzkdnduuzifpobycjwsdryix2szlnqd.onion/","pattern":"[url:value = 'http://7hhhjnxeps222bydmavgawgw5mzkdnduuzifpobycjwsdryix2szlnqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0195116d-d4c7-5c51-d510-000067c55907","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tpwgxrocjvlonhrfjm4jx3dore2u4brxfj4ikt7iba36c23svthhf7ad.onion/","pattern":"[url:value = 'http://tpwgxrocjvlonhrfjm4jx3dore2u4brxfj4ikt7iba36c23svthhf7ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1cf0bd8-9e41-9aa0-4095-00009fc3272d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k6oor2g5bfvdxhxr2g6fczu3iqldbzyavydk56lh6z7ex7n7wqg4eryd.onion/","pattern":"[url:value = 'http://k6oor2g5bfvdxhxr2g6fczu3iqldbzyavydk56lh6z7ex7n7wqg4eryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--097d1bee-2b8e-87ec-af12-0000d0887e16","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://65bhkrfbqnfjgcsr7456luzjauw5nikuwxradlysivy5wbttjikdhxid.onion/","pattern":"[url:value = 'http://65bhkrfbqnfjgcsr7456luzjauw5nikuwxradlysivy5wbttjikdhxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9092b419-38b6-0ec2-66b6-000079294415","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k5pmfzuqwxr2uhnskktjicbnzr633zejupe54yginljj3mgoysfwe4id.onion/","pattern":"[url:value = 'http://k5pmfzuqwxr2uhnskktjicbnzr633zejupe54yginljj3mgoysfwe4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--253a0435-dc25-8483-0d75-000074b67e46","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tyrvuuh5tvrvk4x6lfxrvgabqmzpnxehelmdqztu3vekujcknvl2ufad.onion/","pattern":"[url:value = 'http://tyrvuuh5tvrvk4x6lfxrvgabqmzpnxehelmdqztu3vekujcknvl2ufad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8616c43-6abd-99b7-016f-0000755703ba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zmdmlidqqrxbkyqkqttbsbticjbofjs5uzwecqvdxfadvsjw7mp5kjyd.onion","pattern":"[url:value = 'http://zmdmlidqqrxbkyqkqttbsbticjbofjs5uzwecqvdxfadvsjw7mp5kjyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d7220f1-da5f-5c92-886c-00006bff68f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sjd7ssbiptl62jktrwc5yffsh4llljx7hswfltnfkttq47gdjlpknxid.onion","pattern":"[url:value = 'http://sjd7ssbiptl62jktrwc5yffsh4llljx7hswfltnfkttq47gdjlpknxid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fbea702-f0da-feec-3980-00003a6d25fa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hvhidyqcyj4dozqdxuongpcs2yffjs2ojhazrncqi5cr4hhx3ljopiqd.onion","pattern":"[url:value = 'http://hvhidyqcyj4dozqdxuongpcs2yffjs2ojhazrncqi5cr4hhx3ljopiqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36aad810-ec34-c8b2-09f9-000097b2e309","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hmrr2zllzzxxrdqi5ktjflpga4skdnxm4wvzgkkl72apofvczmsno2ad.onion","pattern":"[url:value = 'http://hmrr2zllzzxxrdqi5ktjflpga4skdnxm4wvzgkkl72apofvczmsno2ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ce27fb6-c1f4-b560-9694-0000d306212d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fkdhvlseh3xyeugsu54frnui62zjrfpeb2v5rm44b53iopcr3h4flxyd.onion","pattern":"[url:value = 'http://fkdhvlseh3xyeugsu54frnui62zjrfpeb2v5rm44b53iopcr3h4flxyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18b88f7f-a2bb-49ea-1e97-0000d27ad5e1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7baltffgfltbjh26fd62h2ieeomdcpro44xwkdqipbn5dtuklgkigkyd.onion","pattern":"[url:value = 'http://7baltffgfltbjh26fd62h2ieeomdcpro44xwkdqipbn5dtuklgkigkyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3bd6dd8-0835-8e03-97ae-0000126ffb1e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://74yeft3x7wvqnscbzfdljnvnmflnlib2b6mhu6a3arc3vvpi4qbrt2qd.onion","pattern":"[url:value = 'http://74yeft3x7wvqnscbzfdljnvnmflnlib2b6mhu6a3arc3vvpi4qbrt2qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c547388-090d-8100-5864-00007344b002","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://53pkw34sr5aohkkpg4w3nz4wpsqod5mxdqer3hijrz2btv2pe3vncgad.onion","pattern":"[url:value = 'http://53pkw34sr5aohkkpg4w3nz4wpsqod5mxdqer3hijrz2btv2pe3vncgad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc665124-12aa-c40d-00c8-0000cc430326","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z7yjie5fejolxvscc3lralybnhynajewnqinjfdasoqa2mt2ixjnelqd.onion/index.php?p=","pattern":"[url:value = 'http://z7yjie5fejolxvscc3lralybnhynajewnqinjfdasoqa2mt2ixjnelqd.onion/index.php?p=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--100fbad3-b19e-78d5-7ea0-0000f52c9574","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hsthebgwlp6xxnhgmvmgukyzxuyaqkx5uqncg56wib7byonddo5k6myd.onion/index.php?p=","pattern":"[url:value = 'http://hsthebgwlp6xxnhgmvmgukyzxuyaqkx5uqncg56wib7byonddo5k6myd.onion/index.php?p=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--583b2b02-3b89-2518-f21d-0000308985d5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4ep4zkhqqg3kihqlbpsppld4qvg7c7llotilezqr6evbazqbmcwu6fyd.onion/index.php?p=","pattern":"[url:value = 'http://4ep4zkhqqg3kihqlbpsppld4qvg7c7llotilezqr6evbazqbmcwu6fyd.onion/index.php?p=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b1efd49-f351-971b-eb7c-0000d0205179","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sya5wcoyib7rozq6cjrdmrrunucqehkuzxs6rkrkffukkn5urq6bv7yd.onion/index.php?p=","pattern":"[url:value = 'http://sya5wcoyib7rozq6cjrdmrrunucqehkuzxs6rkrkffukkn5urq6bv7yd.onion/index.php?p=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ddf14a4-994d-26b5-ccd5-000012c5a82f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://soqdfmnocwg47ixineyzlhyem5tx3fju4hadydwob7fk4oyldxhju4ad.onion/index.php?p=","pattern":"[url:value = 'http://soqdfmnocwg47ixineyzlhyem5tx3fju4hadydwob7fk4oyldxhju4ad.onion/index.php?p=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--610559b2-babd-6d55-03d5-000029bf7d23","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hp4fxytyky26q3kpgqlhewhrazaag5wg4jsaiwxlv3lkd7r7rmsamqyd.onion/index.php?p=","pattern":"[url:value = 'http://hp4fxytyky26q3kpgqlhewhrazaag5wg4jsaiwxlv3lkd7r7rmsamqyd.onion/index.php?p=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7f1b08e-0d09-d2da-c951-000031a21ff1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4awnzgndu5u3bb6vne2vixizdftkc4mdlz45lnrhjgelzm5ujywxmuqd.onion/index.php?p=","pattern":"[url:value = 'http://4awnzgndu5u3bb6vne2vixizdftkc4mdlz45lnrhjgelzm5ujywxmuqd.onion/index.php?p=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26363a5c-7863-b14a-45c4-00007bc3d9bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zmqolc6yrdgn24w7eaaf4pfm235x65zbeggr4byk7og3crhcwn7sqeyd.onion","pattern":"[url:value = 'http://zmqolc6yrdgn24w7eaaf4pfm235x65zbeggr4byk7og3crhcwn7sqeyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3df5ae81-94d8-2e6d-8fd5-0000e9d2a3d0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/","pattern":"[url:value = 'http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e168edf-56a7-428e-5b7b-000023773779","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://australiancybersecuritymagazine.com.au/new-ransomware-group-sarcoma-targets-australian-companies/","pattern":"[url:value = 'https://australiancybersecuritymagazine.com.au/new-ransomware-group-sarcoma-targets-australian-companies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a328cdd3-b606-26bc-4458-00003058cf9d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyberpress.org/sarcoma-ransomware/","pattern":"[url:value = 'https://cyberpress.org/sarcoma-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d09e573-ea1e-4e5c-aac5-0000f8142c37","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.securityweek.com/circuit-board-maker-unimicron-targeted-in-ransomware-attack/","pattern":"[url:value = 'https://www.securityweek.com/circuit-board-maker-unimicron-targeted-in-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cab255fd-9b97-179b-8e31-0000abc9de56","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sarcoma","pattern":"[url:value = 'https://www.ransomlook.io/group/sarcoma']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66ed49c8-2af5-9fa6-c7d6-000094cae8b9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wrzwt7o2e7p6ziag7aq2yy2o45sd75re4rpnbelpkhtj2dpka63c5fyd.onion/","pattern":"[url:value = 'http://wrzwt7o2e7p6ziag7aq2yy2o45sd75re4rpnbelpkhtj2dpka63c5fyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b28777c-f918-7e6d-91ca-0000fc56935a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://skicexsnlbspjnbfxgcvjvzmlrgz2aaxexxoy3stfw4klrwnimrofnyd.onion/","pattern":"[url:value = 'http://skicexsnlbspjnbfxgcvjvzmlrgz2aaxexxoy3stfw4klrwnimrofnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fb4e0fb-34cb-44f9-5bcc-0000df955df9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dqf6l7fvqkqbwxqncznnxojdjm5bvnnqxxfnktgdgrpfbm5b2nyteaqd.onion/","pattern":"[url:value = 'http://dqf6l7fvqkqbwxqncznnxojdjm5bvnnqxxfnktgdgrpfbm5b2nyteaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a4bc999-451d-ced0-c296-0000fd8232f4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mdliyoqm37i6ze4grykoa7mc6tltrjfvr5mffhvotrf6hsi5mwsx3myd.onion/","pattern":"[url:value = 'http://mdliyoqm37i6ze4grykoa7mc6tltrjfvr5mffhvotrf6hsi5mwsx3myd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--350a3297-d409-fb33-5885-0000018f5681","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ob4kfkvgqxbiddrhzlq2yhlyfpdmnro4yptt24drsjvcekczjjaf5myd.onion/","pattern":"[url:value = 'http://ob4kfkvgqxbiddrhzlq2yhlyfpdmnro4yptt24drsjvcekczjjaf5myd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7f4717e-d57a-c4fb-04e5-000026ed7ef1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lo52rld4cl2ezr4cd73yxn7ru2fh3dtqtmjzjuraquv7bdubhabvkkad.onion/","pattern":"[url:value = 'http://lo52rld4cl2ezr4cd73yxn7ru2fh3dtqtmjzjuraquv7bdubhabvkkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fb5348f-b1b5-5cf7-e620-00001e3ead98","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xcvwsc3suebephhxxffjp5odqwspdaylgsyoxc3pdwjmnnl4yhtjrkad.onion/","pattern":"[url:value = 'http://xcvwsc3suebephhxxffjp5odqwspdaylgsyoxc3pdwjmnnl4yhtjrkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--277ddf23-f5a7-ab92-6db9-0000e6696961","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://obqwjnaur6r4lpwjbgmalazy6j5d6fgliimdlipjvdomhbodm2lmidqd.onion/","pattern":"[url:value = 'http://obqwjnaur6r4lpwjbgmalazy6j5d6fgliimdlipjvdomhbodm2lmidqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23f268f7-50e0-f23d-1dac-0000ba6a5247","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yjri5fg3bw7gqw2c7qgx2ytccmfrghwqyuavsneih34tph7ywuwj2did.onion/","pattern":"[url:value = 'http://yjri5fg3bw7gqw2c7qgx2ytccmfrghwqyuavsneih34tph7ywuwj2did.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2276f3a-b8ed-af59-8f32-00009ae5e759","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zncifh3szqf6awg3o33qyoi43tzjaakcjmmhuytii5bsl33wwblt7yid.onion/","pattern":"[url:value = 'http://zncifh3szqf6awg3o33qyoi43tzjaakcjmmhuytii5bsl33wwblt7yid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bbe9a59-a5c7-01ab-155a-0000306cacb1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sfhvr7ecppro35ch6vhrzgwtdtv3ehxem6p2thnwlgursr5vdre2nhid.onion/","pattern":"[url:value = 'http://sfhvr7ecppro35ch6vhrzgwtdtv3ehxem6p2thnwlgursr5vdre2nhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bda5bab9-3897-51c4-34c3-0000866f91d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dj3t7qdgyopmjnvjvni7kdfne36zlq4uic5ajqrh45stquvxcwtdc3qd.onion/","pattern":"[url:value = 'http://dj3t7qdgyopmjnvjvni7kdfne36zlq4uic5ajqrh45stquvxcwtdc3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4d2b1cf-7cac-b325-5681-0000fb86b876","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://f6cwflfjehjl6hosqy7jnkefhddnk7u3eyqn4bjrufmkle53tptxr3ad.onion/","pattern":"[url:value = 'http://f6cwflfjehjl6hosqy7jnkefhddnk7u3eyqn4bjrufmkle53tptxr3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b48ed03-a8b1-4dfc-47c8-000065e7bf7f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rzsqkmwfyprkqslslcf4lscqk7x24xzbxamm5jcsqqhj3vrvkdtp4did.onion/","pattern":"[url:value = 'http://rzsqkmwfyprkqslslcf4lscqk7x24xzbxamm5jcsqqhj3vrvkdtp4did.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccff7abe-fefa-b2c0-a14c-0000c364e889","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b2frnffyioow5tbiqvehe2ncaxdss2tmw7bvt34cwbdzsx2upbfhbzid.onion/","pattern":"[url:value = 'http://b2frnffyioow5tbiqvehe2ncaxdss2tmw7bvt34cwbdzsx2upbfhbzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22b29d42-6247-3614-6684-000066e83ad5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rup34myhoxqzm5m2jcstdwxl2wgjvournnyiysghyef6wjdyk3ets6qd.onion/","pattern":"[url:value = 'http://rup34myhoxqzm5m2jcstdwxl2wgjvournnyiysghyef6wjdyk3ets6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b25cd7b1-2a15-3214-5976-00009c4e9f3c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://45k4wju2hwdywn3bsgs6mb6izppx6ghq5w3abcp77jz36xnu7sirltid.onion/","pattern":"[url:value = 'http://45k4wju2hwdywn3bsgs6mb6izppx6ghq5w3abcp77jz36xnu7sirltid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bd262b4-7d02-ed69-4f1f-00000937a9c4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zp6bziy6wljpkg6i3uxzzcxyajodxzoc7acf5egb2vhzzrot23y3mpyd.onion/","pattern":"[url:value = 'http://zp6bziy6wljpkg6i3uxzzcxyajodxzoc7acf5egb2vhzzrot23y3mpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc528d59-f986-d25c-097a-00009c538683","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5q3lywcjrujw3vao7cz3ruqd57ugfdcu3qiisklpqillvuidl5wiqlqd.onion/","pattern":"[url:value = 'http://5q3lywcjrujw3vao7cz3ruqd57ugfdcu3qiisklpqillvuidl5wiqlqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16bfc9cb-4f0e-c9e0-4b20-0000286afe03","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nfh5wuh4gvbai237npdu672xmx2di2lo7pcwu6th2a7kzgue2fnhhdad.onion/","pattern":"[url:value = 'http://nfh5wuh4gvbai237npdu672xmx2di2lo7pcwu6th2a7kzgue2fnhhdad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5734c78-0e28-b6fa-356f-00003b545c6c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hqzjmm4qg2q2utn2e3yqt5lsnrabjmi5m4o547v4jp3pi2hwp2tkunid.onion/","pattern":"[url:value = 'http://hqzjmm4qg2q2utn2e3yqt5lsnrabjmi5m4o547v4jp3pi2hwp2tkunid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b34a3f9-695a-57cb-eef1-0000eafd1675","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4tgkspsiob5zg7vwqmmbquymoj3sacpx4x4qixvgzukjfen4ck4s6mad.onion/","pattern":"[url:value = 'http://4tgkspsiob5zg7vwqmmbquymoj3sacpx4x4qixvgzukjfen4ck4s6mad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--057dcc23-c517-c7f2-1f83-0000878628d1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://enfxn727mx4ue55zgbjkogn3lnb57e5ed7bcooodxsajzsp3dyo5xeyd.onion/","pattern":"[url:value = 'http://enfxn727mx4ue55zgbjkogn3lnb57e5ed7bcooodxsajzsp3dyo5xeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea66176c-ed19-4e42-335b-000014e937fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://73jrahivyj7cydl3qeiauwm4fkz4f7e4d3deny6qt3cgtwxmkj2vmiyd.onion/","pattern":"[url:value = 'http://73jrahivyj7cydl3qeiauwm4fkz4f7e4d3deny6qt3cgtwxmkj2vmiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--054e085c-0d23-b234-d506-0000c86d74e0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qccbb75hak6ze6rsm344rx73lh7rk6caha2hvleyopejhtgagxjyioqd.onion/","pattern":"[url:value = 'http://qccbb75hak6ze6rsm344rx73lh7rk6caha2hvleyopejhtgagxjyioqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e91aad34-af80-5224-2977-000031df33d5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sbgsnuet6t7kle4tfmgsvgebaqgxab3lrslg6vjeabphzq7jx5232byd.onion/","pattern":"[url:value = 'http://sbgsnuet6t7kle4tfmgsvgebaqgxab3lrslg6vjeabphzq7jx5232byd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51ac8cd6-fa4c-f139-4b57-0000352434f9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lq4acyymyobtq7tafyspo7zlm4bwnmpyyknbtb3zefq2zdy3xxiu5nad.onion/","pattern":"[url:value = 'http://lq4acyymyobtq7tafyspo7zlm4bwnmpyyknbtb3zefq2zdy3xxiu5nad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80fb0d45-eb43-db39-9878-00001de65fdc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cgewcqt4x7kb7xgkfu2r3yv5wifzvpx6tojonay3kdgs5tqpjvkd5bqd.onion/","pattern":"[url:value = 'http://cgewcqt4x7kb7xgkfu2r3yv5wifzvpx6tojonay3kdgs5tqpjvkd5bqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab2b8ae9-6d32-2b47-320e-00003f9527ab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://m7k6jgadomd3nd2mor5sefnuowtwktfjvzihydx6zy2tkohv6aatr3ad.onion/","pattern":"[url:value = 'http://m7k6jgadomd3nd2mor5sefnuowtwktfjvzihydx6zy2tkohv6aatr3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12f1bd3d-e72f-a638-5e60-000043142100","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://isxttzwtr7havmbj2qmyb7stwmrds32ye42iwc7kxj55adbexdnbfoqd.onion/","pattern":"[url:value = 'http://isxttzwtr7havmbj2qmyb7stwmrds32ye42iwc7kxj55adbexdnbfoqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b601db5-3ff6-4e1c-ed1f-0000853d746a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nzqvpyyznsn4c3ubidcpywr5iqtnjn3lkcsafnjtsmozowmbjforgeqd.onion/","pattern":"[url:value = 'http://nzqvpyyznsn4c3ubidcpywr5iqtnjn3lkcsafnjtsmozowmbjforgeqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d3a9ba0-73a8-1a29-75e3-000079b792b0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tbkqp6pbl7uq2ymiii2jqzbre5igk2xtaruzm7fcdtstmufsssekukid.onion/","pattern":"[url:value = 'http://tbkqp6pbl7uq2ymiii2jqzbre5igk2xtaruzm7fcdtstmufsssekukid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c9fec1d-9ee9-fd19-7d97-000072f34784","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vysjfhy5gpr2f4p6amiamjo36emgbyh3xelsxg6sudisdfwtfor4rjqd.onion/","pattern":"[url:value = 'http://vysjfhy5gpr2f4p6amiamjo36emgbyh3xelsxg6sudisdfwtfor4rjqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80684e6a-b9e5-f040-3845-00009ca58039","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3fdy7qukqwts2j7w7lks75tueaokjsmotcshzmxjqeojca26s3doocad.onion/","pattern":"[url:value = 'http://3fdy7qukqwts2j7w7lks75tueaokjsmotcshzmxjqeojca26s3doocad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--002996f7-14ca-fb59-7bea-00002154950b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xik5pf7gejiffbapos223f4q7l5pdwv6xwag6irgkltx2lu6wfnglaqd.onion/","pattern":"[url:value = 'http://xik5pf7gejiffbapos223f4q7l5pdwv6xwag6irgkltx2lu6wfnglaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22062abe-260d-2679-ce01-0000bdbeff8b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zgu66qoreyw4tx7bmtus6gcz7at5ufiqhgyswfnprbwvpcjw4mows7id.onion/","pattern":"[url:value = 'http://zgu66qoreyw4tx7bmtus6gcz7at5ufiqhgyswfnprbwvpcjw4mows7id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2104e6fd-4c2f-bf6d-f3d4-00004623357f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lm7o3nfplejz7jibisw7wwrivlmske4rq6vofvbncl7g7jflvd3ubqid.onion/","pattern":"[url:value = 'http://lm7o3nfplejz7jibisw7wwrivlmske4rq6vofvbncl7g7jflvd3ubqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a346be5-71d4-b5e8-5de0-0000fce211b6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3mwyz2wt6b6zuah5y3eyjmsjkhaowiv6ejqodt2ly4y4rpwcggii65id.onion/","pattern":"[url:value = 'http://3mwyz2wt6b6zuah5y3eyjmsjkhaowiv6ejqodt2ly4y4rpwcggii65id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a002d93-a512-476a-7469-00002b091982","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://krxmjef2yd7dwmxbgghooskep4kcecxtqqs3iu33evi7dvr5oc3dpkid.onion/","pattern":"[url:value = 'http://krxmjef2yd7dwmxbgghooskep4kcecxtqqs3iu33evi7dvr5oc3dpkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cff9ba40-a685-1e64-e433-00005ea7c42b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rlwqssdty3mmlxla2h4iviv32qtig54nxw7ww3wt2bmxp74a3qmo75ad.onion/","pattern":"[url:value = 'http://rlwqssdty3mmlxla2h4iviv32qtig54nxw7ww3wt2bmxp74a3qmo75ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c873e01-df73-f304-fb3d-0000c7ad221b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://f22licvnajbisahwc73y55se6mgmvxuups2mp7t43jgs4yj7dp6igqad.onion/","pattern":"[url:value = 'http://f22licvnajbisahwc73y55se6mgmvxuups2mp7t43jgs4yj7dp6igqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--416a8535-1a62-7eb3-792c-00003d4586dc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2fcn6dfc4li6kdt7dhqv4rpnmao64txxwcniostcvw6obdw74hiqtkqd.onion/","pattern":"[url:value = 'http://2fcn6dfc4li6kdt7dhqv4rpnmao64txxwcniostcvw6obdw74hiqtkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3816bf6-15cc-eb5d-eee2-000059894bb5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://areaucod7knfvyl2xbnezcucezcwr4iku5psrt74zthoyqegdzqsxzad.onion/","pattern":"[url:value = 'http://areaucod7knfvyl2xbnezcucezcwr4iku5psrt74zthoyqegdzqsxzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db430718-d878-ef73-236c-000046d73150","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://y2vv2zvegnvv7uwr5saye4enthgq3ghlhomu5a3nshgwih4phn6qusyd.onion/","pattern":"[url:value = 'http://y2vv2zvegnvv7uwr5saye4enthgq3ghlhomu5a3nshgwih4phn6qusyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--912ffbec-6935-73f9-b8b5-0000081769d4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qxbuog46z72pycrwfaedafqy5dodyrt46ucfs4p5vaaigxtudtwerpyd.onion/","pattern":"[url:value = 'http://qxbuog46z72pycrwfaedafqy5dodyrt46ucfs4p5vaaigxtudtwerpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e642a51-f329-80aa-9e2e-0000bcbc681e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hpugjgammwixig4kpti5r67ofjd4qrgkjohbth2irq4nvcv3m7s76tyd.onion/","pattern":"[url:value = 'http://hpugjgammwixig4kpti5r67ofjd4qrgkjohbth2irq4nvcv3m7s76tyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d34019e-91f2-45dd-4b79-00003b54152d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lhc2ghpebf2d5w3qroiphzjnwwbi6oyigt3aztgghy43q7j2vnu3bcad.onion/","pattern":"[url:value = 'http://lhc2ghpebf2d5w3qroiphzjnwwbi6oyigt3aztgghy43q7j2vnu3bcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4496bb63-07ac-fc83-d4ef-0000a0ba7191","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://g3adubh3fjsy5ezrmxmy4wxt7dvkhxnkd5deaac47mryvkzvzcf2tvid.onion/","pattern":"[url:value = 'http://g3adubh3fjsy5ezrmxmy4wxt7dvkhxnkd5deaac47mryvkzvzcf2tvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1954bb02-7a23-4e8c-4008-00009cc57347","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2pxacmry7fqmbhkuseo2l3rxmyw24ctmengat7hlavlgrcixbepz6aqd.onion/","pattern":"[url:value = 'http://2pxacmry7fqmbhkuseo2l3rxmyw24ctmengat7hlavlgrcixbepz6aqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cab9abc-7b7e-6b88-e496-0000f2985ab6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mjlfzles4bszxnxcjktdu6iujjc7bhui62fc6s5z736jjsaq4zcq4cad.onion/","pattern":"[url:value = 'http://mjlfzles4bszxnxcjktdu6iujjc7bhui62fc6s5z736jjsaq4zcq4cad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00951493-f115-d8bc-91d5-0000a5e8f399","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sarcomabwgzv7ogiulwqfmlul6mjcxy6o3owuld4lqguvevf4kgp3lqd.onion/","pattern":"[url:value = 'http://sarcomabwgzv7ogiulwqfmlul6mjcxy6o3owuld4lqguvevf4kgp3lqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e4eb992-6952-8a4b-84da-0000ae8250c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p6b2xarot2rng6v6unlb72jtydw7tklqtyrsrhg6jdr5gaass5uk2vad.onion/","pattern":"[url:value = 'http://p6b2xarot2rng6v6unlb72jtydw7tklqtyrsrhg6jdr5gaass5uk2vad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--735da750-b015-216f-f513-00006c566c0a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mx5a6zo2vzhnnuazxz5fqwacwd7wnkbxziwty3gedipkbvfn3ngdniid.onion/","pattern":"[url:value = 'http://mx5a6zo2vzhnnuazxz5fqwacwd7wnkbxziwty3gedipkbvfn3ngdniid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81a2ba01-0370-a457-fb51-0000d346abee","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://amffvuxv5qyi7fwh5cfoehkr4yrp3ushi4qzxm76ahiwro7dequcoxyd.onion/","pattern":"[url:value = 'http://amffvuxv5qyi7fwh5cfoehkr4yrp3ushi4qzxm76ahiwro7dequcoxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96ecf64f-5e44-6f92-e6c3-000064ea67ad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r33gr3wmjrsyo3t5tc6j3yzdtsjhmyzd6xielw6ceu2zr3najset5iad.onion/","pattern":"[url:value = 'http://r33gr3wmjrsyo3t5tc6j3yzdtsjhmyzd6xielw6ceu2zr3najset5iad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd804406-0434-ac5a-4534-0000895630c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dyr566jtgcsyk7si5gn7unygj3pnzgxfwvlureyn3dfi7g7r2ve54zad.onion/","pattern":"[url:value = 'http://dyr566jtgcsyk7si5gn7unygj3pnzgxfwvlureyn3dfi7g7r2ve54zad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ed89157-2f86-a983-9311-00007dd79c38","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://j4swv3longylj4ljjdny4yino4xwvrbis5ouxg4anlg4el6kjku7dbqd.onion/","pattern":"[url:value = 'http://j4swv3longylj4ljjdny4yino4xwvrbis5ouxg4anlg4el6kjku7dbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11d4beea-f1e1-8622-228e-0000abfb8532","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uhf6vmrgiqsvytiunb3tustswyhc2nz5aiax3viusb6i2v427pncylqd.onion/","pattern":"[url:value = 'http://uhf6vmrgiqsvytiunb3tustswyhc2nz5aiax3viusb6i2v427pncylqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3250d06d-80ce-cd23-4d9b-00005e2a8904","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tszizx6qdi4uva2jbfg5z2mhdaqh3iduk57obi7hg4m6omta3aymrzad.onion/","pattern":"[url:value = 'http://tszizx6qdi4uva2jbfg5z2mhdaqh3iduk57obi7hg4m6omta3aymrzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e79d606-d4c5-579a-4e78-00000e409223","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://67f7qjjoez6fnnrjuqzg4yqjiowvjbe5y2dhmjkiwubtqzj3isc5joid.onion/","pattern":"[url:value = 'http://67f7qjjoez6fnnrjuqzg4yqjiowvjbe5y2dhmjkiwubtqzj3isc5joid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb7b070c-2ada-3d35-36b3-000075fa8242","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sgwmhbj7y2hehzzkt6fwvj23gjkzsvvhae2f3haavxjbi35tibnhpayd.onion/","pattern":"[url:value = 'http://sgwmhbj7y2hehzzkt6fwvj23gjkzsvvhae2f3haavxjbi35tibnhpayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e6b5586-49d9-360f-bd18-00000c623343","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://plvvaggo6jjl2wy5dixn2knj4kuypquxfauijigke6qtx3ixjfitglid.onion/","pattern":"[url:value = 'http://plvvaggo6jjl2wy5dixn2knj4kuypquxfauijigke6qtx3ixjfitglid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9bb0bc3-ce61-dedb-f025-0000d8d8de81","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ykg6a32ed546jveyot236w6cst5xahji4bhnxx4qv6b7wdqrwa3rhmqd.onion/","pattern":"[url:value = 'http://ykg6a32ed546jveyot236w6cst5xahji4bhnxx4qv6b7wdqrwa3rhmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abe71336-9e23-dfd3-6d3b-00008b11ea6e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pgyarykjxofanc7x37qx6am6me4geeebiqh76fslda5jshhup4yljvyd.onion/","pattern":"[url:value = 'http://pgyarykjxofanc7x37qx6am6me4geeebiqh76fslda5jshhup4yljvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8786cd4-5790-5df9-be36-0000e960051f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zrqe3dtolmluwzbwgktss4habzra3yv67kc35zhoccyj57xf5kuo4ead.onion/","pattern":"[url:value = 'http://zrqe3dtolmluwzbwgktss4habzra3yv67kc35zhoccyj57xf5kuo4ead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--520c254f-a5d9-f988-b7a3-00006ef513cd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://riuxxxbufgx5z53gww432mf5jvh2o7mfh22hvmpdw4ksutd6dflj7byd.onion/","pattern":"[url:value = 'http://riuxxxbufgx5z53gww432mf5jvh2o7mfh22hvmpdw4ksutd6dflj7byd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd3d069b-c065-1e41-b1ef-00000b02f9e5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iz62i5obz6mwixyjwxggbw7fk6wdgmmy4ancvynpbqqmgwpnghv3rdid.onion/","pattern":"[url:value = 'http://iz62i5obz6mwixyjwxggbw7fk6wdgmmy4ancvynpbqqmgwpnghv3rdid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--122e04c3-300d-1880-4335-0000df25a56e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://igqsxlg2ndj7xmaepxtvkisacskrb3mbhlcgymis42h6l6qyfyjyg7id.onion/","pattern":"[url:value = 'http://igqsxlg2ndj7xmaepxtvkisacskrb3mbhlcgymis42h6l6qyfyjyg7id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a94ede9c-0ea2-575c-1a68-00008ea08095","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6hfobqn3vj2yyjgvgkklftppf3una73dn6am7gpieohkryzg6avr5dqd.onion/","pattern":"[url:value = 'http://6hfobqn3vj2yyjgvgkklftppf3una73dn6am7gpieohkryzg6avr5dqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95b757a0-8540-85be-3006-00008df1f5e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bpcxhnyo4rvobiiapjksmzog4lr7gchwfoygqtphzfspbsxdp2lutcad.onion/","pattern":"[url:value = 'http://bpcxhnyo4rvobiiapjksmzog4lr7gchwfoygqtphzfspbsxdp2lutcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ff0c410-fdec-d96e-b1de-0000fa7b06e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wphvg3uizhfblnuuwyz35nhfpgz254lj3iwd2jrtl2oce6qvmlwpl2id.onion/","pattern":"[url:value = 'http://wphvg3uizhfblnuuwyz35nhfpgz254lj3iwd2jrtl2oce6qvmlwpl2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80e4a551-5738-4620-332d-0000ed1f6f64","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jdphsfcjuyog5cgtjdfsxluarkvqy5rw75kasoj6kuihga3bs3fwgfyd.onion/","pattern":"[url:value = 'http://jdphsfcjuyog5cgtjdfsxluarkvqy5rw75kasoj6kuihga3bs3fwgfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--639fee12-efd9-f30b-3af5-00004b996264","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tzmfdwducfvlh6ie4juo6ovgft3qwxgf5q7dxca57fqalpn6zsed3lad.onion/","pattern":"[url:value = 'http://tzmfdwducfvlh6ie4juo6ovgft3qwxgf5q7dxca57fqalpn6zsed3lad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db13c5ef-19e2-0942-d7b3-000064fbb03d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qhzy4ur5atch5orjkd2h3x34kwqbswqzqnllaij4crl3v2mnrj7aouyd.onion/","pattern":"[url:value = 'http://qhzy4ur5atch5orjkd2h3x34kwqbswqzqnllaij4crl3v2mnrj7aouyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aeb1fdef-5603-5e49-06b1-00004bbcce77","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jq6vxgpnjfs3ue2wn7ve4bnga4ewkcetpvkmz324se7mlqjtnrenkqad.onion/","pattern":"[url:value = 'http://jq6vxgpnjfs3ue2wn7ve4bnga4ewkcetpvkmz324se7mlqjtnrenkqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0396fc86-091b-9e00-11e6-0000b0abba5f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lqlkfdi2ydpzibk4xpikfvae3bjdd4lsodgwtpunxfc6abkexsg5a2ad.onion/","pattern":"[url:value = 'http://lqlkfdi2ydpzibk4xpikfvae3bjdd4lsodgwtpunxfc6abkexsg5a2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03b750c6-fe05-112d-94d7-00008eead424","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://n4axoeoemdqamjhicytqnebburiwbmvviqyltoqtljoancodgijw32yd.onion/","pattern":"[url:value = 'http://n4axoeoemdqamjhicytqnebburiwbmvviqyltoqtljoancodgijw32yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3c9a52f-de56-6e85-689a-0000f6af7678","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wsl6ouwdqk62yhddt2rvy6i7jzdegbufklfp6hdpgxn6vmwqlsqy23id.onion/","pattern":"[url:value = 'http://wsl6ouwdqk62yhddt2rvy6i7jzdegbufklfp6hdpgxn6vmwqlsqy23id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--039af1b6-1caf-5da6-d244-000028d86da9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mtd2ltbdnsudzaneia6i6xgwkpn7adxfuesqstrreyqxlgxbxejpojid.onion/","pattern":"[url:value = 'http://mtd2ltbdnsudzaneia6i6xgwkpn7adxfuesqstrreyqxlgxbxejpojid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41c891ae-d612-acc2-f9c8-0000da75c45c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cqjqlbmmfqanj6ctywkmgzi7iythgc6atu2xgjbkk2ccr465gizolqqd.onion/","pattern":"[url:value = 'http://cqjqlbmmfqanj6ctywkmgzi7iythgc6atu2xgjbkk2ccr465gizolqqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--feec2033-5a7b-2fd7-9280-0000ee639468","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://63qnrvuxwl3jkzqik33ppgvktytzy5vasmp5yyhkv4mzbv5enuc5pqqd.onion/","pattern":"[url:value = 'http://63qnrvuxwl3jkzqik33ppgvktytzy5vasmp5yyhkv4mzbv5enuc5pqqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acb34e30-2525-2fbe-60c1-0000ec8f202f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://herbgxwb46z3pikyy6h6wckbjebg4ytuoijqceu2wsse4nh5tyuqqxqd.onion/","pattern":"[url:value = 'http://herbgxwb46z3pikyy6h6wckbjebg4ytuoijqceu2wsse4nh5tyuqqxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82576f2e-f62d-643a-22d1-0000d1cf9df9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4eahz4i6cjqychvmiyqjducmhu3pep6l52vaw3ik3nizzpt5writuryd.onion/","pattern":"[url:value = 'http://4eahz4i6cjqychvmiyqjducmhu3pep6l52vaw3ik3nizzpt5writuryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42faf109-d913-1f94-b0e8-0000ab68b59d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zaie6jcetdtqhi5epab45wzginog4kuo4sx4nwr4ydkdby76b5ri3xqd.onion/","pattern":"[url:value = 'http://zaie6jcetdtqhi5epab45wzginog4kuo4sx4nwr4ydkdby76b5ri3xqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f6790a9-e95d-19c7-830d-000080485d3f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://g7vfmyo2xvt4uwoypgb675rcgxokwdxqevmx5ie5qojqnkuvnuudemqd.onion/","pattern":"[url:value = 'http://g7vfmyo2xvt4uwoypgb675rcgxokwdxqevmx5ie5qojqnkuvnuudemqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--151a9a12-fbff-02dd-94ea-00009d18a94f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pcgkekcyyzl465rqt4mpezjkjdkoxgb7c4j6nbb6rn4gnw7zme24lrad.onion/","pattern":"[url:value = 'http://pcgkekcyyzl465rqt4mpezjkjdkoxgb7c4j6nbb6rn4gnw7zme24lrad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--713ee2ad-6517-dea3-7498-000088ff0729","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rsrcywwt7b53kw2lsioilnfrrs2lixt4nttzpcli74fjvfk4kqbfh5qd.onion/","pattern":"[url:value = 'http://rsrcywwt7b53kw2lsioilnfrrs2lixt4nttzpcli74fjvfk4kqbfh5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50630840-0b4c-f720-e384-0000988e72d4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ibrdo3v56w6veyp6moi7iaadtk6o4qa6eyppc3svinph4vx5qrllpzid.onion/","pattern":"[url:value = 'http://ibrdo3v56w6veyp6moi7iaadtk6o4qa6eyppc3svinph4vx5qrllpzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92139705-f959-ee20-3448-00004803dad4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5ka4wjkv3qulsn6gtfzyhumafgupipu6rkfezf2tw2doveamaqqmxvyd.onion/","pattern":"[url:value = 'http://5ka4wjkv3qulsn6gtfzyhumafgupipu6rkfezf2tw2doveamaqqmxvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d70a7db3-2833-a386-be28-0000492aeb95","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hh4ueveki3serlpuvt63lp557z5qhlfwlc32bclw4x53dmt3ijoewmqd.onion/","pattern":"[url:value = 'http://hh4ueveki3serlpuvt63lp557z5qhlfwlc32bclw4x53dmt3ijoewmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54c68f23-9b93-127e-4a2c-000000615e42","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://t3ym2cemf625rd5slz5ifp2jz2ldntmlbn74i5joebg6c74fmnpmuyqd.onion/","pattern":"[url:value = 'http://t3ym2cemf625rd5slz5ifp2jz2ldntmlbn74i5joebg6c74fmnpmuyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a6ccace-496a-0c02-16ab-00001a56ec69","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://i44esri5nzpdcanpgflcrlxk4tmf7yfpxkcysha3gblsuiswyyxmi3qd.onion/","pattern":"[url:value = 'http://i44esri5nzpdcanpgflcrlxk4tmf7yfpxkcysha3gblsuiswyyxmi3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8030bac1-6665-8f73-f454-00005ce8cfc7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lq72f4y2gbujxypmicycfpmmtv74tazt4h6szumrniuvgxwkwi4ykcyd.onion/","pattern":"[url:value = 'http://lq72f4y2gbujxypmicycfpmmtv74tazt4h6szumrniuvgxwkwi4ykcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f5d30e6-5a6f-b3b8-b024-00009385f289","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zyzmgujsdh4xjmxjf4j6riqn4s52jfpiurcpabk5uxfitmz4pusaueqd.onion/","pattern":"[url:value = 'http://zyzmgujsdh4xjmxjf4j6riqn4s52jfpiurcpabk5uxfitmz4pusaueqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19277a80-7d95-3584-1979-000065997a20","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cth3pse7mszuess3jeiftdawcqcm7cvwrrx7hiwi7zxzh55jvh6f42id.onion/","pattern":"[url:value = 'http://cth3pse7mszuess3jeiftdawcqcm7cvwrrx7hiwi7zxzh55jvh6f42id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45f35453-6811-bf59-9e22-000060efeef4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tfeijfoxmvqcoqjz2nvgfblxge27fyiy2k2fshiiccyrdz4kfiwaziid.onion/","pattern":"[url:value = 'http://tfeijfoxmvqcoqjz2nvgfblxge27fyiy2k2fshiiccyrdz4kfiwaziid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5035f987-8b62-90bc-ff05-000083c1d62c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ufwlfce4qkiqsda7e2mhaibgyyi6jfjhu55j7uoq6bh3kmue7pc34iid.onion/","pattern":"[url:value = 'http://ufwlfce4qkiqsda7e2mhaibgyyi6jfjhu55j7uoq6bh3kmue7pc34iid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab74849b-00e9-f253-7f67-00000db7fa7e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4x2dnydjwfpa4zgutwqaeqxd7tmdz452ttvvq5pga5eqgppi2uu5chyd.onion/","pattern":"[url:value = 'http://4x2dnydjwfpa4zgutwqaeqxd7tmdz452ttvvq5pga5eqgppi2uu5chyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10bc339c-7a0a-569c-bb81-000036c39ebd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7h422j3rpt7dxoeijbzn6xo7t43dmaisl5t44mcsf6ulbj3weg6doqyd.onion/","pattern":"[url:value = 'http://7h422j3rpt7dxoeijbzn6xo7t43dmaisl5t44mcsf6ulbj3weg6doqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a03027a2-f1b6-744b-9b4c-0000d2964ec9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yry66r4til42vxubkqpy5wo75mshv7pcaqtbg4rzl55bs55yzav73uyd.onion/","pattern":"[url:value = 'http://yry66r4til42vxubkqpy5wo75mshv7pcaqtbg4rzl55bs55yzav73uyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--769c2a80-01a3-2b09-fb17-000083914d1f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l2atrqqwpmgdr4vzae7ufgulirsklfk4xmierg4ihdxborjkpyuz5lyd.onion/","pattern":"[url:value = 'http://l2atrqqwpmgdr4vzae7ufgulirsklfk4xmierg4ihdxborjkpyuz5lyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82d43b7f-ebbc-b8de-8085-000016d793b4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6v3lslpnsfae4rfghnl473u4hp7j6yyu74pipyks54norp4filkzjgid.onion/","pattern":"[url:value = 'http://6v3lslpnsfae4rfghnl473u4hp7j6yyu74pipyks54norp4filkzjgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--740b03e2-2fdb-b9a9-dcae-0000e2efcb5f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fbrmzvj2c6a5soanvuw3qi4dpnt3rcgte32nae4qegd4vqpnjtrwbqid.onion/","pattern":"[url:value = 'http://fbrmzvj2c6a5soanvuw3qi4dpnt3rcgte32nae4qegd4vqpnjtrwbqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c71f3bf-7a9a-4e0a-eef5-000022e70f0b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qysbb5qdwpxsimtrsbehqc75q4b2lw6m4imtnswgmbsq2mw4ulvxevqd.onion/","pattern":"[url:value = 'http://qysbb5qdwpxsimtrsbehqc75q4b2lw6m4imtnswgmbsq2mw4ulvxevqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11b6ca61-9bb7-18d4-1a44-0000ae74cdd5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://twm7i3mxyydc2ew5ppbmjiz6rzww7ze32t2ecmznnsywdccwatzjxead.onion/","pattern":"[url:value = 'http://twm7i3mxyydc2ew5ppbmjiz6rzww7ze32t2ecmznnsywdccwatzjxead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c277fdd-ee6b-29b4-befa-00007c8a33d3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fijqvpzptg2sxavr3s6vw32lx4xdfa3i2oedi4574qo3apqyhd7srwad.onion/","pattern":"[url:value = 'http://fijqvpzptg2sxavr3s6vw32lx4xdfa3i2oedi4574qo3apqyhd7srwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a11ca557-3dc3-f259-da56-00005af469d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4b2njxftjecmzgyafn46dcyibnv3mourddcfq7qxdylkov4bisjl7xqd.onion/","pattern":"[url:value = 'http://4b2njxftjecmzgyafn46dcyibnv3mourddcfq7qxdylkov4bisjl7xqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--180c8e47-0d00-c860-dc5e-00002d15271d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tg6cr3uyeakbug6jt4oeaxbcpu4urdpm7ksk6uk7sdwg3walnqcwftqd.onion/","pattern":"[url:value = 'http://tg6cr3uyeakbug6jt4oeaxbcpu4urdpm7ksk6uk7sdwg3walnqcwftqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f7fc061-79fd-2063-be9e-0000b6235f35","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tr2w7zxx2clrckh4mr6aupyennkngrz2bfuohpdzeifajgeqg6rtxxyd.onion/","pattern":"[url:value = 'http://tr2w7zxx2clrckh4mr6aupyennkngrz2bfuohpdzeifajgeqg6rtxxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c5baa29-b5c0-fc89-b776-00006bbbe452","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ycgedgigkqoeabmpnpwwbqojcgldekrjraaeeo4litevj5bvp7dtmrid.onion/","pattern":"[url:value = 'http://ycgedgigkqoeabmpnpwwbqojcgldekrjraaeeo4litevj5bvp7dtmrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b6a59f1-5cf7-6730-fbef-0000866e3259","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tlntayu7wbtcqxtumbqh4x2vzurw7ybpuhtozusbxuqggcwmnisd7vid.onion/","pattern":"[url:value = 'http://tlntayu7wbtcqxtumbqh4x2vzurw7ybpuhtozusbxuqggcwmnisd7vid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f47a84fa-f3ee-e842-9d04-0000a31a7631","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wi5q5npnch6fy5y7m4jtjznrydzyhtp6ik4j5swrdsehdwtvv3akleqd.onion/","pattern":"[url:value = 'http://wi5q5npnch6fy5y7m4jtjznrydzyhtp6ik4j5swrdsehdwtvv3akleqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d143fd77-0906-d528-56b7-0000eb0fb470","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jck4dycheanyy6zrolymheurxak54o53lzg3hfcz7ao35hs7fewsaoyd.onion/","pattern":"[url:value = 'http://jck4dycheanyy6zrolymheurxak54o53lzg3hfcz7ao35hs7fewsaoyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c36be6c1-3dfc-99a0-f07d-0000b65f55a0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7usqkx3whuqipzsolnctey7xgszixv446vam7et2qas6xmuxtjm54pad.onion/","pattern":"[url:value = 'http://7usqkx3whuqipzsolnctey7xgszixv446vam7et2qas6xmuxtjm54pad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc41f3e9-a920-65a7-eba9-00006c0f6d35","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6nwhpuwtf4onxvr7el5ycc4xwefhk4w6q6rbn23oe2ghax2x7nns3iad.onion/","pattern":"[url:value = 'http://6nwhpuwtf4onxvr7el5ycc4xwefhk4w6q6rbn23oe2ghax2x7nns3iad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ef4ad06-bc25-baad-a9d7-00005182cdf3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lpp4aze237qkkursbtesd54ofag6te5i5lzpee5a3buhq4v3uwtxnlqd.onion/","pattern":"[url:value = 'http://lpp4aze237qkkursbtesd54ofag6te5i5lzpee5a3buhq4v3uwtxnlqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3c996b7-3447-d045-6c00-0000f1c4fa40","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rs3icoalw6bdgedspnmt6vp2dzzuyqxtccezmta2g5mlyao64len7dyd.onion/","pattern":"[url:value = 'http://rs3icoalw6bdgedspnmt6vp2dzzuyqxtccezmta2g5mlyao64len7dyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52406d8d-23f8-e4e3-cbd9-0000bb149955","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nf5b6a4b4s623wfxkveibjmwwpqjm536t5tyrbtrw7vsdqepsdoejoad.onion/","pattern":"[url:value = 'http://nf5b6a4b4s623wfxkveibjmwwpqjm536t5tyrbtrw7vsdqepsdoejoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d20d2af5-c914-e000-170e-000056a344d2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iiobxrljnmjwb6l66bfvhin5zxbghbgiv6yamqpb4bezlrxd2vhetgyd.onion/","pattern":"[url:value = 'http://iiobxrljnmjwb6l66bfvhin5zxbghbgiv6yamqpb4bezlrxd2vhetgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f2cbf77-89cf-f666-60bb-0000f44de5b0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pauppf2nuoqxwwqqshaehbkj54debl7bppacfm5h6z6zjoiejifezhad.onion/","pattern":"[url:value = 'http://pauppf2nuoqxwwqqshaehbkj54debl7bppacfm5h6z6zjoiejifezhad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--466f1828-3c50-cd54-e9f8-00009d3eb620","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r3yes535gjsi2puoz2bvssl3ewygcfgwoji6wdk3grj3baexn2hha2id.onion/","pattern":"[url:value = 'http://r3yes535gjsi2puoz2bvssl3ewygcfgwoji6wdk3grj3baexn2hha2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--020d7929-08b5-95f0-9364-000043a686c1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://modre6n4hqm4seip2thhbjcfkcdcljhec7ekvd5qt7m7fhimpc2446qd.onion/","pattern":"[url:value = 'http://modre6n4hqm4seip2thhbjcfkcdcljhec7ekvd5qt7m7fhimpc2446qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e89e075-6f99-c8ca-758b-00006c562753","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://55lfxollcks2pvxbtg73vrpl3i7x4jnnrxfl6al6viamwngqlu4cxgyd.onion/","pattern":"[url:value = 'http://55lfxollcks2pvxbtg73vrpl3i7x4jnnrxfl6al6viamwngqlu4cxgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9103b1a-6abb-b71c-03cc-0000c4c29ced","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lyz3i74psw6vkuxdjhkyxzy3226775qpzs6oage4zw6qj66ppdxma2qd.onion/","pattern":"[url:value = 'http://lyz3i74psw6vkuxdjhkyxzy3226775qpzs6oage4zw6qj66ppdxma2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e13b1b91-c3cc-a812-164b-0000109ab536","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://icmghe66zl4twvbv5g4h532mogcea44hrkxtotrlx6aia5jslnnbnxad.onion/","pattern":"[url:value = 'http://icmghe66zl4twvbv5g4h532mogcea44hrkxtotrlx6aia5jslnnbnxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e98751b1-07e7-3fc0-41d7-0000e096abf6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ngvvafvhfgwknj63ivqjqdxc7b5fyedo67zshblipo5a2zuair5t4nid.onion/","pattern":"[url:value = 'http://ngvvafvhfgwknj63ivqjqdxc7b5fyedo67zshblipo5a2zuair5t4nid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--971d69ec-5cb2-729b-9c3e-000083b7d0ca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://54yjkjwjqbm74nchm6o6b4l775ws2hgesdopus5jvo3jx6ftj7zn7mid.onion/","pattern":"[url:value = 'http://54yjkjwjqbm74nchm6o6b4l775ws2hgesdopus5jvo3jx6ftj7zn7mid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2070878e-070f-22f9-b489-00003b1a0cb4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bi32pq7y3gqq3qacgvamnk2s2elnppvevqp325wtk2wo7vh2zavjcfid.onion/","pattern":"[url:value = 'http://bi32pq7y3gqq3qacgvamnk2s2elnppvevqp325wtk2wo7vh2zavjcfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8dbde846-f0c8-5a6c-c5b0-0000a3160284","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/nitrogen","pattern":"[url:value = 'https://www.ransomlook.io/group/nitrogen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e56ab20-b81b-815b-8f16-000003c092f3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yqiaekirp7n7fkp3bwx2nfxm6zohhaa3ct5xvdqsxsanxqqwoyltb6id.onion/","pattern":"[url:value = 'http://yqiaekirp7n7fkp3bwx2nfxm6zohhaa3ct5xvdqsxsanxqqwoyltb6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a66f54fd-b461-6922-a34d-00004ab04112","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vz4ybjdqhtm753rznnwx67elvzhbcdkqk24g3ytnq32h6qpirigkytqd.onion","pattern":"[url:value = 'http://vz4ybjdqhtm753rznnwx67elvzhbcdkqk24g3ytnq32h6qpirigkytqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95cd4f73-2a90-ddd0-abe6-000030f57ef5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://j56wqkcxzvuz25wzypoxua3fex5zfuc3emkhw4bemtiuikt46dwma6id.onion","pattern":"[url:value = 'http://j56wqkcxzvuz25wzypoxua3fex5zfuc3emkhw4bemtiuikt46dwma6id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39c4bd99-79f1-6eb0-a529-0000cbd610b4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4fklgnaegkdpfgaa3rxr3x4xujq4yi6dcuumxikrquzar2m3meiqxwad.onion/","pattern":"[url:value = 'http://4fklgnaegkdpfgaa3rxr3x4xujq4yi6dcuumxikrquzar2m3meiqxwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03ab16dc-2701-cad9-39ed-00002d79464e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6lrsxvqscxtznb4fhux5u3vbslbanxjzxzgtokjtfwaitxe4pfgfebad.onion/","pattern":"[url:value = 'http://6lrsxvqscxtznb4fhux5u3vbslbanxjzxzgtokjtfwaitxe4pfgfebad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--485fb6ce-84ae-8a33-255f-0000260cbbf7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ws6uapok34o3uvn3v6nru574urlvlbn5u3pi2xzyg765vpv2fixcm4ad.onion","pattern":"[url:value = 'http://ws6uapok34o3uvn3v6nru574urlvlbn5u3pi2xzyg765vpv2fixcm4ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c538371-5c52-f2ce-0202-000043898c03","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ybe6nbidsn6grrnhx5adksp2sd4cz7povuuszhmliir5p4th7inmexid.onion/","pattern":"[url:value = 'http://ybe6nbidsn6grrnhx5adksp2sd4cz7povuuszhmliir5p4th7inmexid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--478264bb-ecb7-4c78-db11-00003f5a18b7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://55gqddfwtzfcuxwgoz746tas2djoiai4lbjvc36kq55prehyvedee3qd.onion/","pattern":"[url:value = 'http://55gqddfwtzfcuxwgoz746tas2djoiai4lbjvc36kq55prehyvedee3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--970088aa-dabb-9dcb-3a51-0000d3c38fcc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zvdlza5tjyl33mbx4k7w7t25ve6e5c3ve3nmfwqlygl6ww6s4lmsu4ad.onion/","pattern":"[url:value = 'http://zvdlza5tjyl33mbx4k7w7t25ve6e5c3ve3nmfwqlygl6ww6s4lmsu4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e81d6f4-752c-fe40-7499-00000b664fe3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7o4vytbuk42nuucim5idwgsg3zqkocpllqpykmrdk6zvs75ne7iwgmad.onion/","pattern":"[url:value = 'http://7o4vytbuk42nuucim5idwgsg3zqkocpllqpykmrdk6zvs75ne7iwgmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ba187b4-38de-d55e-8cf2-0000e3328eeb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xqsdbtrtmufdyiqnkrkvosec4gqappf2egcptzqppjtqdevsoadakyqd.onion","pattern":"[url:value = 'http://xqsdbtrtmufdyiqnkrkvosec4gqappf2egcptzqppjtqdevsoadakyqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5541b624-9e7d-2a74-d4d5-00007876d3ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2idvzxbwvzbxhuniw7kfaimcvtqazmn7nmuw7codg65cshwwsvnpz7id.onion/","pattern":"[url:value = 'http://2idvzxbwvzbxhuniw7kfaimcvtqazmn7nmuw7codg65cshwwsvnpz7id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16d15fbe-5e6c-3d0b-f538-0000f741357b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bxi2cepk57dy3uhgwqd6dri6jtuqe7btay225rn6xkvvgnp2cvjvowqd.onion/","pattern":"[url:value = 'http://bxi2cepk57dy3uhgwqd6dri6jtuqe7btay225rn6xkvvgnp2cvjvowqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--942a1195-114d-bf53-f25d-000087ccd5e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nxarphaf35qp2uuosaq54m3a2s5kt4svpcv56mvz6r7xy6na7uo5ypyd.onion/","pattern":"[url:value = 'http://nxarphaf35qp2uuosaq54m3a2s5kt4svpcv56mvz6r7xy6na7uo5ypyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--119ddca2-508d-dc54-c6aa-00008db9a95b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bf7dw4n6zne6rbgjlpcsidphpk753nkyubipkym5t4pntgfyb6clw2qd.onion/login","pattern":"[url:value = 'http://bf7dw4n6zne6rbgjlpcsidphpk753nkyubipkym5t4pntgfyb6clw2qd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--086aee92-05e2-a235-08a0-0000677b7f1c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5xmd7pwpk4flmz5o2hbyndpkles5klmwbpxbw4jitzjnbhn4wkdktvad.onion/","pattern":"[url:value = 'http://5xmd7pwpk4flmz5o2hbyndpkles5klmwbpxbw4jitzjnbhn4wkdktvad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4785c1f8-f28c-91de-161a-00000092f621","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6blfnoe24tfpal2kmacphkjmzph3oghjdznsgkf23lmvjqbtgrmedpid.onion/","pattern":"[url:value = 'http://6blfnoe24tfpal2kmacphkjmzph3oghjdznsgkf23lmvjqbtgrmedpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10f6e7ff-4472-78c8-db35-00000f0f4351","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6stzturcvnli6ilm6f6vweiymchi6lboc62u7ive2q7hn5hbbbauvgid.onion/","pattern":"[url:value = 'http://6stzturcvnli6ilm6f6vweiymchi6lboc62u7ive2q7hn5hbbbauvgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38ec51d6-3f04-2928-4a6e-0000776ece52","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://whdoefodpz4jjpwr5imipdntkh6kdbjazhx2zvdhcbmrtuxs6f3iwnid.onion/","pattern":"[url:value = 'http://whdoefodpz4jjpwr5imipdntkh6kdbjazhx2zvdhcbmrtuxs6f3iwnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0ea1f7f-4f5c-6609-2db1-0000265e6feb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wjwbqeuni4zslbm4cduvo7uwyo653k4gdx2x4irj4zkrwyerksdcxryd.onion/","pattern":"[url:value = 'http://wjwbqeuni4zslbm4cduvo7uwyo653k4gdx2x4irj4zkrwyerksdcxryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dd27019-1bfe-6e8a-e9b7-0000a0631742","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vkl3xfkp2vtpdzk7ohock3w2oiwwtvgnwbwvurrqafh5nhw23h43dbid.onion/","pattern":"[url:value = 'http://vkl3xfkp2vtpdzk7ohock3w2oiwwtvgnwbwvurrqafh5nhw23h43dbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b4e4638-f15b-87ae-5914-0000e9497599","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://awrfq7pjydfp3hwbsun6ltxrrzths5ztgxj7i7ybx7twjrdvzvxkgwad.onion","pattern":"[url:value = 'http://awrfq7pjydfp3hwbsun6ltxrrzths5ztgxj7i7ybx7twjrdvzvxkgwad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22b2a5c4-a822-5cb6-ffc6-000094cfe11c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z4tonbkjybcllsvd45smpkqkk5uaspmlnvmysrkxt37wuudijvp7k2id.onion","pattern":"[url:value = 'http://z4tonbkjybcllsvd45smpkqkk5uaspmlnvmysrkxt37wuudijvp7k2id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96c787af-0b56-2d04-d886-0000579006fa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sqnnhgqr4iiwnkaih6vspyxmebz2vvjv3uybmjdynw6sne5plilunhyd.onion/","pattern":"[url:value = 'http://sqnnhgqr4iiwnkaih6vspyxmebz2vvjv3uybmjdynw6sne5plilunhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1561f779-339d-0f90-8f57-0000ce1e30d0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://67hvtslok5a4cwjxfmidbgbunsvckypf2dwkpxg3y2sabar5b4jidmyd.onion/","pattern":"[url:value = 'http://67hvtslok5a4cwjxfmidbgbunsvckypf2dwkpxg3y2sabar5b4jidmyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a881f189-fe7d-93fa-dcbb-00008d8a0643","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hzyp7n436ecwo73xvrgnf5wmbjewszwut4h6vz4fu6f2oqd5zfcd7sad.onion/","pattern":"[url:value = 'http://hzyp7n436ecwo73xvrgnf5wmbjewszwut4h6vz4fu6f2oqd5zfcd7sad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3338b5de-5dc3-09aa-54b4-0000c2d1bfc4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6a5ib4udgwlkyl3zzeyenedcb7d33j2vq7egpqykr5457uiskeu6zjad.onion/","pattern":"[url:value = 'http://6a5ib4udgwlkyl3zzeyenedcb7d33j2vq7egpqykr5457uiskeu6zjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb294dcd-3854-f174-6301-00006a64e962","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jzl4bylm4bng2zgmeqw3lx6bcbxzb2hulicxneuosq26sshnitrcvcad.onion/","pattern":"[url:value = 'http://jzl4bylm4bng2zgmeqw3lx6bcbxzb2hulicxneuosq26sshnitrcvcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa92655f-743d-b8dd-288a-0000951d4103","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2u6njk55okdxvrup5feu3wbhyxvlqla7yuj2oz3xkzz27yzc66vcirqd.onion/","pattern":"[url:value = 'http://2u6njk55okdxvrup5feu3wbhyxvlqla7yuj2oz3xkzz27yzc66vcirqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26f2738d-5efe-c74c-d2e3-00004a3a745e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/embrago","pattern":"[url:value = 'https://www.ransomlook.io/group/embrago']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5a8c508-20a4-9bbf-32e7-000094e51c62","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/osyolorz","pattern":"[url:value = 'https://www.ransomlook.io/group/osyolorz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb187663-3ed5-92a0-ec0e-0000d4ee760a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hackerosyolorz77y7vwj57zobwdeuzydhctz3kuuzr52ylzayvxuqyd.onion","pattern":"[url:value = 'http://hackerosyolorz77y7vwj57zobwdeuzydhctz3kuuzr52ylzayvxuqyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0292d3d-aefd-a5cc-c06f-0000ba5df14e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/orca","pattern":"[url:value = 'https://www.ransomlook.io/group/orca']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2232a9c5-dc7f-9280-91f6-0000d4004707","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/soleenya","pattern":"[url:value = 'https://www.ransomlook.io/group/soleenya']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad94946a-eafc-79c4-825b-0000537913b6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xzbltrroh4ocknyi7kj2ucjuw63fhyy23dh6lplydl545d33kbygw2id.onion/home","pattern":"[url:value = 'http://xzbltrroh4ocknyi7kj2ucjuw63fhyy23dh6lplydl545d33kbygw2id.onion/home']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aff6daff-3021-b62c-d04f-000065e70b50","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/valencia","pattern":"[url:value = 'https://www.ransomlook.io/group/valencia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a4d9919-7ab7-ef95-94bc-00004f6fd145","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6doyqxqqj36vnedtt2zwxmngx52mgyp7brbrtwkyd75jgiolocoybgid.onion/","pattern":"[url:value = 'http://6doyqxqqj36vnedtt2zwxmngx52mgyp7brbrtwkyd75jgiolocoybgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b080f15e-b434-2a9e-b933-0000724b1578","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://x.com/ValenciaLeaks72","pattern":"[url:value = 'https://x.com/ValenciaLeaks72']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9a218df-9a63-a548-be9f-0000c8606d97","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/helldown-ransomware","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/helldown-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22803a21-3730-233f-b369-000005e83402","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://hivepro.com/threat-advisory/new-helldown-ransomware-a-growing-threat-across-cross-platform-systems","pattern":"[url:value = 'https://hivepro.com/threat-advisory/new-helldown-ransomware-a-growing-threat-across-cross-platform-systems']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--265ec66e-498f-198c-8569-0000a74caf99","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.sekoia.io/helldown-ransomware-an-overview-of-this-emerging-threat","pattern":"[url:value = 'https://blog.sekoia.io/helldown-ransomware-an-overview-of-this-emerging-threat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--012d67f5-32d0-393a-c528-0000281a5581","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.truesec.com/hub/blog/helldown-ransomware-group","pattern":"[url:value = 'https://www.truesec.com/hub/blog/helldown-ransomware-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dc184ca-acc9-99a4-c03f-0000dbc2f94c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/helldown","pattern":"[url:value = 'https://www.ransomlook.io/group/helldown']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af2089e9-619e-0eb9-d8de-0000836aade4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://onyxcb44xvqra35m3lp3z26kf2pxrlbn64nbzvyvzjyc3uykzrwcjdid.onion","pattern":"[url:value = 'http://onyxcb44xvqra35m3lp3z26kf2pxrlbn64nbzvyvzjyc3uykzrwcjdid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efe6df8b-0363-18d5-4207-000056df2fbd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://www.helldown.org","pattern":"[url:value = 'http://www.helldown.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9833b546-2fcc-7e79-8d21-0000a6038faf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://onyxcgfg4pjevvp5h34zvhaj45kbft3dg5r33j5vu3nyp7xic3vrzvad.onion/","pattern":"[url:value = 'http://onyxcgfg4pjevvp5h34zvhaj45kbft3dg5r33j5vu3nyp7xic3vrzvad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb522766-eb91-c2a5-da27-0000e78c706a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/radar","pattern":"[url:value = 'https://www.ransomlook.io/group/radar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c9a359b-f84e-5065-8bd4-0000b7dbaa1f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3bnusfu2lgk5at43ceu7cdok5yv4gfbono2jv57ho74ucjvc7czirfid.onion/api/leakeds_u","pattern":"[url:value = 'http://3bnusfu2lgk5at43ceu7cdok5yv4gfbono2jv57ho74ucjvc7czirfid.onion/api/leakeds_u']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--936e9cf8-fe7e-5420-388f-0000385fee1c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3bnusfu2lgk5at43ceu7cdok5yv4gfbono2jv57ho74ucjvc7czirfid.onion/awaiting-publication","pattern":"[url:value = 'http://3bnusfu2lgk5at43ceu7cdok5yv4gfbono2jv57ho74ucjvc7czirfid.onion/awaiting-publication']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb29e48b-d8af-86c0-4936-000061b61f80","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://radar.ltd","pattern":"[url:value = 'http://radar.ltd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89b98f05-004a-19a5-c556-0000fc1b0860","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/rtm","pattern":"[url:value = 'https://www.ransomlook.io/group/rtm']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b1841c1-7eb1-f077-5360-00009e155fa0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nvfutdbq3ubteaxj4m2jyihov5aa4akfudsj5h7vhyrvfarfra26ksyd.onion","pattern":"[url:value = 'http://nvfutdbq3ubteaxj4m2jyihov5aa4akfudsj5h7vhyrvfarfra26ksyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b19d298b-5114-f0ff-0276-0000d3eec16c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3wugtklp46ufx7dnr6j5cd6ate7wnvnivsyvwuni7hqcqt7hm5r72nid.onion/","pattern":"[url:value = 'http://3wugtklp46ufx7dnr6j5cd6ate7wnvnivsyvwuni7hqcqt7hm5r72nid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--656eec8d-1dcb-7e77-285e-0000455a3da7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nv4addu4insb7x6aagdv6r5gvxzczgfje7mmecsjonnrvsq7ulevvfid.onion","pattern":"[url:value = 'http://nv4addu4insb7x6aagdv6r5gvxzczgfje7mmecsjonnrvsq7ulevvfid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f0cbbbf-391c-dbbf-6d72-000034f3c7b4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lynx","pattern":"[url:value = 'https://www.ransomlook.io/group/lynx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--516184ea-631c-2fbd-c0dc-000035591c08","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxcdn6yh5inxdqregzgm674qlbwzrmvozmejuercv2zq3nlugifoad.onion/","pattern":"[url:value = 'http://lynxcdn6yh5inxdqregzgm674qlbwzrmvozmejuercv2zq3nlugifoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee4461f1-ec05-0eba-8273-00004d2783c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxk7rmhe7luff3ed7chlziwrju34pzc5hm452xhryeaeulc3wxc3ad.onion/login","pattern":"[url:value = 'http://lynxk7rmhe7luff3ed7chlziwrju34pzc5hm452xhryeaeulc3wxc3ad.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ecfbd82-52f8-9845-b216-00004c77850a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxjamasdeyeeiusfgfipfivewc3l3u34hyiiguhdyj776mh535l4ad.onion/login","pattern":"[url:value = 'http://lynxjamasdeyeeiusfgfipfivewc3l3u34hyiiguhdyj776mh535l4ad.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb8e06f5-935b-43d5-61a7-00001b23fd8f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxhwtifuwxs2zejofpagvzxf7p2l3nhdi3zlrap3y2wsn5hqyfeuid.onion/login","pattern":"[url:value = 'http://lynxhwtifuwxs2zejofpagvzxf7p2l3nhdi3zlrap3y2wsn5hqyfeuid.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8505e19f-a23c-a703-ac9e-000035368cc4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxbk3nzrnph5z5tilsn3twfcgltqynaofuxgb5yt43vdu266z3vvyd.onion/login","pattern":"[url:value = 'http://lynxbk3nzrnph5z5tilsn3twfcgltqynaofuxgb5yt43vdu266z3vvyd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd153345-6e0a-9865-2ebd-00001b918b93","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxaeddweqscykez5rknrug6ui5znq4yoxof5qnusiatiyuqqlwhead.onion/login","pattern":"[url:value = 'http://lynxaeddweqscykez5rknrug6ui5znq4yoxof5qnusiatiyuqqlwhead.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d4907bf-c6e4-daeb-cb08-00007a35932d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynx25vsi4cxesh44chevu2qyguqcx4zrjsjd77cjrmbgn75xkv626yd.onion/login","pattern":"[url:value = 'http://lynx25vsi4cxesh44chevu2qyguqcx4zrjsjd77cjrmbgn75xkv626yd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a8cde05-fe42-e0ac-e99f-00000908a055","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxoifh5boac42m6xdoak6ne7q53sz7kgaaze7ush72uuetbnjg2oqd.onion/login","pattern":"[url:value = 'http://lynxoifh5boac42m6xdoak6ne7q53sz7kgaaze7ush72uuetbnjg2oqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f0febd5-e0d2-4cb8-63fc-0000520185cc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxroggpujfxy7xnlrz3yknphqgk4k5dy4rhaldgz2hpxyyy3ncuvad.onion/login","pattern":"[url:value = 'http://lynxroggpujfxy7xnlrz3yknphqgk4k5dy4rhaldgz2hpxyyy3ncuvad.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b55205e-2ba2-bff7-cb11-00001cd1c746","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxikczcyposxfz5a7hxbqxilsrtx7zdzwmhk5wcb5qoatbv2suizid.onion/login","pattern":"[url:value = 'http://lynxikczcyposxfz5a7hxbqxilsrtx7zdzwmhk5wcb5qoatbv2suizid.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3954724-71c9-0ef2-4428-0000f46f1528","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxdehvlvrrtnhtpuy6bhrxffzvl5j7y7p3zl553slzq44lcb2jzkyd.onion/login","pattern":"[url:value = 'http://lynxdehvlvrrtnhtpuy6bhrxffzvl5j7y7p3zl553slzq44lcb2jzkyd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce2de5bd-b2a1-425a-4928-00005f2673ff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxcyys7c2np3b3er2wo6sufwoonmh6i3nykv53pst336c3ml4ycjqd.onion/login","pattern":"[url:value = 'http://lynxcyys7c2np3b3er2wo6sufwoonmh6i3nykv53pst336c3ml4ycjqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5beb2cb5-81b8-b516-cfaa-0000390a2950","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxcwuhva6qzlnj3m3qrcl6bgvnxpixg5vsikf53vutdf3ijuv2pxyd.onion/login","pattern":"[url:value = 'http://lynxcwuhva6qzlnj3m3qrcl6bgvnxpixg5vsikf53vutdf3ijuv2pxyd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1610965-532e-6057-b062-0000511da653","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynx2m7xz73zpmlm5nddbokk6a55fh2nzjq2r5nk2hbdbk74iddqfiqd.onion/login","pattern":"[url:value = 'http://lynx2m7xz73zpmlm5nddbokk6a55fh2nzjq2r5nk2hbdbk74iddqfiqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af4b4e37-5170-4e9d-b72e-00005aa64c87","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxad2seqpyu52lr5v7il4idasv23535a46s4bj65b3v7t5y6u5daqd.onion/login","pattern":"[url:value = 'http://lynxad2seqpyu52lr5v7il4idasv23535a46s4bj65b3v7t5y6u5daqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1c795dd-7e3b-d328-8b80-00007811ca60","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxcdnjg43re373nltauhdqfbau25mwawsg42h4lswfe455uaznilad.onion/","pattern":"[url:value = 'http://lynxcdnjg43re373nltauhdqfbau25mwawsg42h4lswfe455uaznilad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e8aea2f-5586-2f6a-2533-00006e9b3575","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxchat.net","pattern":"[url:value = 'http://lynxchat.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79b77870-cf56-84e3-e66f-00001264f856","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxba5y5juv3c4de2bftamjkbxvcuujr5c5wn4hq2fwmt66pxb7qqad.onion","pattern":"[url:value = 'http://lynxba5y5juv3c4de2bftamjkbxvcuujr5c5wn4hq2fwmt66pxb7qqad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9dbefa2-f9d3-bec8-8bd7-0000e66d2876","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/","pattern":"[url:value = 'http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02d11770-e8fb-7d61-8b41-000054d04b28","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/leaks","pattern":"[url:value = 'http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d328106-ea68-4f29-eb6a-00001ab4c1fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/leaks","pattern":"[url:value = 'http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0209f74f-a250-ad68-3349-0000ad91408f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/leaks","pattern":"[url:value = 'http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cf188e9-509b-9688-959a-00006ba57e14","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxstorage1.net/","pattern":"[url:value = 'http://lynxstorage1.net/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af0ba5d0-3195-a1bf-9784-00003d5de115","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion","pattern":"[url:value = 'http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--688c01af-bfb5-cab0-7f81-0000db47a1d1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion","pattern":"[url:value = 'http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3312c58-92f0-6f3b-5e74-0000fe3651c1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion","pattern":"[url:value = 'http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0c69057-7800-97ec-325f-00009ec390f4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion","pattern":"[url:value = 'http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4e2041a-97bb-358f-d6ac-0000cfaf25bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login","pattern":"[url:value = 'http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a6a08b1-7b2b-6eb4-7564-00005554d35d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login","pattern":"[url:value = 'http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b65c149c-d1cb-0859-3aeb-00004c0cce06","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login","pattern":"[url:value = 'http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5feb7881-0d3b-f986-7fdf-0000c4bffc48","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login","pattern":"[url:value = 'http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83fffad3-1d48-7c0d-556d-0000b8e828fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login","pattern":"[url:value = 'http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48b208ab-5aa8-1c08-2dcb-0000ccedafcf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion/login","pattern":"[url:value = 'http://lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0613d26-8ec5-c1af-2d77-000098eb662c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd.onion/leaks","pattern":"[url:value = 'http://lynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd.onion/leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--941074b6-b44d-4654-f994-000063416b0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lynxblog.net/","pattern":"[url:value = 'http://lynxblog.net/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f55d6943-0473-c4b7-0409-0000274f8b65","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ransomcortex","pattern":"[url:value = 'https://www.ransomlook.io/group/ransomcortex']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efc32628-5661-fffc-7f98-0000039b4237","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gg6owuhu72muoelkt2msjrp2llwr2on5634sk5v2xefzmobvryywbhid.onion/","pattern":"[url:value = 'http://gg6owuhu72muoelkt2msjrp2llwr2on5634sk5v2xefzmobvryywbhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2769d473-7bfc-8b11-6abb-000073fb4a67","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.enigmasoftware.com/adminlockerransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/adminlockerransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71e59772-dc1f-4ddf-043e-00004d63f3cb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/22722-admin-locker-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/22722-admin-locker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79fca821-b561-bcca-18d1-00001f2ce1d6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/adminlocker","pattern":"[url:value = 'https://www.ransomlook.io/group/adminlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf81d8e3-5d36-0e29-ecc0-00008c8cd739","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lockdata","pattern":"[url:value = 'https://www.ransomlook.io/group/lockdata']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ced439d-8c17-c954-fc4b-00000452ec62","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wm6mbuzipviusuc42kcggzkdpbhuv45sn7olyamy6mcqqked3waslbqd.onion","pattern":"[url:value = 'http://wm6mbuzipviusuc42kcggzkdpbhuv45sn7olyamy6mcqqked3waslbqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0aa35f8-aef5-c04d-1a60-0000db93ef56","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mad","pattern":"[url:value = 'https://www.ransomlook.io/group/mad']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ec8caa3-03db-f428-663a-00008be2d34f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cymulate.com/blog/september-2022-cyberattacks-wrap-up","pattern":"[url:value = 'https://www.cymulate.com/blog/september-2022-cyberattacks-wrap-up']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24910fb3-6495-1bda-f836-000033febade","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyble.com/blog/arcrypt-ransomware-evolves-with-multiple-tor-communication-channels","pattern":"[url:value = 'https://cyble.com/blog/arcrypt-ransomware-evolves-with-multiple-tor-communication-channels']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5289378f-8854-59b4-11c0-00001a7c82f1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.fortinet.com/blog/threat-research/ransomware-roundup-bisamware-and-chile-locker","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/ransomware-roundup-bisamware-and-chile-locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ca7fafc-0354-4faf-f033-0000ee49f04a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/chilelocker","pattern":"[url:value = 'https://www.ransomlook.io/group/chilelocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0274c5b3-4360-e705-500d-0000d28b93cb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7wa2bi6grhbu4opt5bguga4g63jsxiy3ysfbabh7dbyk3niqxlsburad.onion/","pattern":"[url:value = 'http://7wa2bi6grhbu4opt5bguga4g63jsxiy3ysfbabh7dbyk3niqxlsburad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62d4755d-9bbc-22c1-48fc-000043e46351","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ebljej7okwfnx5hdfikqqt2uqehihqv3yns3ziij5clqpklwb3i2cxad.onion/","pattern":"[url:value = 'http://ebljej7okwfnx5hdfikqqt2uqehihqv3yns3ziij5clqpklwb3i2cxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--673dc46e-5322-abd1-69ad-000041c1fdb8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2022/07/14/holyghost-north-korean-threat-actor-uses-custom-ransomware-in-attacks/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2022/07/14/holyghost-north-korean-threat-actor-uses-custom-ransomware-in-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8508100a-e1a3-cce7-b529-0000bdf85a9e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/us-govt-links-north-korean-holyghost-ransomware-to-lazarus-group/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/us-govt-links-north-korean-holyghost-ransomware-to-lazarus-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfad9d83-2df4-4414-8379-00007b8dcbba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-187a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-187a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b33e3df-f89a-f5ec-a9bc-0000b820f691","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/holyghost","pattern":"[url:value = 'https://www.ransomlook.io/group/holyghost']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea826d52-a625-ddd9-21d7-000048ab487c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/nullbulge","pattern":"[url:value = 'https://www.ransomlook.io/group/nullbulge']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12989b96-3189-0b71-c027-00006189c959","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion","pattern":"[url:value = 'http://nullblgtk7dwzpfklgktzll27ovvnj7pvqkoprmhubnnb32qcbmcpgid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bb89f50-76b6-e7f6-d69c-0000aba9c6fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://goocasino.org","pattern":"[url:value = 'http://goocasino.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--542d8243-379f-2cfb-6617-0000cac0d0df","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nullbulge.com","pattern":"[url:value = 'http://nullbulge.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56a8e1f2-2c73-4a6b-2c5b-0000dd5e0b31","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nullbulge.se","pattern":"[url:value = 'http://nullbulge.se']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6920c54f-3ea0-2f13-b3b8-000002538cf9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nullbulge.co/blog.html","pattern":"[url:value = 'http://nullbulge.co/blog.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--921a76d6-681c-733a-cac1-0000f9752bb4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.infosecurity-magazine.com/news/fbi-dismantle-radardispossessor/","pattern":"[url:value = 'https://www.infosecurity-magazine.com/news/fbi-dismantle-radardispossessor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--753843cb-d26f-94d0-53d4-00009ada9822","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.reuters.com/technology/cybersecurity/dispossessor-ransomware-group-shut-down-by-us-european-authorities-2024-08-13/","pattern":"[url:value = 'https://www.reuters.com/technology/cybersecurity/dispossessor-ransomware-group-shut-down-by-us-european-authorities-2024-08-13/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d70f1301-941b-47c8-7006-000004e4734d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.fbi.gov/contact-us/field-offices/cleveland/news/international-investigation-leads-to-shutdown-of-ransomware-group","pattern":"[url:value = 'https://www.fbi.gov/contact-us/field-offices/cleveland/news/international-investigation-leads-to-shutdown-of-ransomware-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e287b5a-f5f9-ec06-0ff3-00006c23e691","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/dispossessor","pattern":"[url:value = 'https://www.ransomlook.io/group/dispossessor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2a7719f-3789-8d25-0129-00007cafc42d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://redhotcypher.com","pattern":"[url:value = 'http://redhotcypher.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92dc114f-7adc-c299-44be-0000530c322e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cybernewsint.com","pattern":"[url:value = 'http://cybernewsint.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--649076cf-a5d5-2ae5-7e85-0000e7efd983","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dispossessor-cloud.com","pattern":"[url:value = 'http://dispossessor-cloud.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a133a5a5-b916-2a48-b96d-00004765f33e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dispossessor.com","pattern":"[url:value = 'http://dispossessor.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c13b12f-7e81-8c3c-9f21-0000be079a58","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/back/getallblogs","pattern":"[url:value = 'http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/back/getallblogs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12f82e3d-5e8a-25c5-c212-000060a4407d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cybertube.video/web/index.html#!/details?id=0c3b52f6e73709725dc6e12b30b139d9&serverId=2be5e68176ff4f8fbb930fe66321ab72","pattern":"[url:value = 'http://cybertube.video/web/index.html#!/details?id=0c3b52f6e73709725dc6e12b30b139d9&serverId=2be5e68176ff4f8fbb930fe66321ab72']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afde06d4-b72c-ad09-9576-000049c780b8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion","pattern":"[url:value = 'http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db9c8e78-7786-fdb9-b726-0000f22d1637","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vanir","pattern":"[url:value = 'https://www.ransomlook.io/group/vanir']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86691ffe-91a1-4c7f-f6ab-0000b218cc90","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion","pattern":"[url:value = 'http://6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93b40ec5-f5ed-7023-f4db-0000319d4b8d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/pyrx","pattern":"[url:value = 'https://www.ransomlook.io/group/pyrx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ab7ed59-4672-147a-91fd-000029cefb95","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pyrx.cc","pattern":"[url:value = 'http://pyrx.cc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6a7a89d-a2b9-bf7b-df74-00002fd16e11","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c2mdhim6btaiyae3xqthnxsz64brvdxsnbty4tvos65zb565y4v55iid.onion/blogs.html","pattern":"[url:value = 'http://c2mdhim6btaiyae3xqthnxsz64brvdxsnbty4tvos65zb565y4v55iid.onion/blogs.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--398915d9-36e3-4e31-dfa2-0000d5ff96b8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c2mdhim6btaiyae3xqthnxsz64brvdxsnbty4tvos65zb565y4v55iid.onion/b/","pattern":"[url:value = 'http://c2mdhim6btaiyae3xqthnxsz64brvdxsnbty4tvos65zb565y4v55iid.onion/b/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--827f01ac-0391-cb90-57da-0000fdb5bcc4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c2mdhim6btaiyae3xqthnxsz64brvdxsnbty4tvos65zb565y4v55iid.onion","pattern":"[url:value = 'http://c2mdhim6btaiyae3xqthnxsz64brvdxsnbty4tvos65zb565y4v55iid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d02909bc-2198-057a-4e3c-000097027af0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: cloak.su","pattern":"[domain-name:value = 'cloak.su']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c059019-8d25-92f2-9340-0000e6aaa3a8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cloak.su","pattern":"[url:value = 'https://www.ransomlook.io/group/cloak.su']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deee46b2-6c6c-b89e-5a64-0000d33d48f2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cloak.su/indexo.php","pattern":"[url:value = 'http://cloak.su/indexo.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f68b14a-c001-e6c4-9270-000037cc3b64","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/not-a-good-day-ransomware","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/not-a-good-day-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a428cd1e-2672-5438-d04d-0000a92fca89","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/good-day/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/good-day/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adbc8e72-6ef4-675b-2f07-0000c4d4b35f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/good","pattern":"[url:value = 'https://www.ransomlook.io/group/good']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d938fe8b-35d8-2456-b843-0000bb2bc5bb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://47h4pwve4scndaneljfnxdhzoulgsyfzbgayyonbwztfz74gsdprz5qd.onion/","pattern":"[url:value = 'http://47h4pwve4scndaneljfnxdhzoulgsyfzbgayyonbwztfz74gsdprz5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdcab5a9-cbc9-7b6e-92a7-0000c0dc52df","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.waterisac.org/portal/ransomware-awareness-%E2%80%93-new-ransomware-group-%E2%80%9Ccicada3301%E2%80%9D-surfaces-connections-alphv-network","pattern":"[url:value = 'https://www.waterisac.org/portal/ransomware-awareness-%E2%80%93-new-ransomware-group-%E2%80%9Ccicada3301%E2%80%9D-surfaces-connections-alphv-network']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc69920a-0ab7-3e78-1a63-00008ef8f1e0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.morphisec.com/blog/cicada3301-ransomware-threat-analysis","pattern":"[url:value = 'https://www.morphisec.com/blog/cicada3301-ransomware-threat-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48ed386d-9e72-6cd4-acc1-00007d5d3fab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.truesec.com/hub/blog/dissecting-the-cicada","pattern":"[url:value = 'https://www.truesec.com/hub/blog/dissecting-the-cicada']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--807790cf-58a1-0ba1-d078-0000d1a5fad6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyble.com/threat-actor-profiles/cicada3301/","pattern":"[url:value = 'https://cyble.com/threat-actor-profiles/cicada3301/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--188be41f-8ee5-d670-4930-0000a374cdbb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://thehackernews.com/2024/10/cross-platform-cicada3301-ransomware.html","pattern":"[url:value = 'https://thehackernews.com/2024/10/cross-platform-cicada3301-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fd58705-b667-06da-f5a3-000070c6af8d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://unit42.paloaltonetworks.com/repellent-scorpius-cicada3301-ransomware/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/repellent-scorpius-cicada3301-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd9baed3-6b7c-bfd5-695c-00002ce01591","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.group-ib.com/blog/cicada3301/","pattern":"[url:value = 'https://www.group-ib.com/blog/cicada3301/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d80f66d-cce7-ccdc-a049-00001b27d8bb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cicada3301","pattern":"[url:value = 'https://www.ransomlook.io/group/cicada3301']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7fb3d7a-2a81-9372-e30c-0000ed97cbf5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sia5sekp5vokknfigbnef53mrb677lm2vy42wgnespkr5af4z4y4stad.onion/","pattern":"[url:value = 'http://sia5sekp5vokknfigbnef53mrb677lm2vy42wgnespkr5af4z4y4stad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98ba9930-474e-da58-6fc6-00005b2acb67","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cicadapkh4vg2qh4qcoelszhftota5cdcgrwbjcesdyiwjwmsfzgobid.onion","pattern":"[url:value = 'http://cicadapkh4vg2qh4qcoelszhftota5cdcgrwbjcesdyiwjwmsfzgobid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7af29851-15f5-625d-9aa2-000073239271","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://leakshrlgof456tiw4ww5moiqlnrcork7q7r3cjgmsvex6zazpluhlad.onion/ec49pw6bi8xc2mk3j89kkiaa4ikdrf4wnq2nas4cseciagbw5pq63th7cqajky3c/","pattern":"[url:value = 'http://leakshrlgof456tiw4ww5moiqlnrcork7q7r3cjgmsvex6zazpluhlad.onion/ec49pw6bi8xc2mk3j89kkiaa4ikdrf4wnq2nas4cseciagbw5pq63th7cqajky3c/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5cb3ae-52ca-7350-e850-00008aa5d55d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ruzislhpcuvfzw3t2xfqu7gog3gs5j2u65ysaq3ybqkzri3hjddaqgad.onion/","pattern":"[url:value = 'http://ruzislhpcuvfzw3t2xfqu7gog3gs5j2u65ysaq3ybqkzri3hjddaqgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fa31415-2e9d-f806-b053-00008fea012d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5atqn4dwosjauijzj445mm7t6bqrcvzlzcylpmpnx243jxvlimyb6aid.onion/","pattern":"[url:value = 'http://5atqn4dwosjauijzj445mm7t6bqrcvzlzcylpmpnx243jxvlimyb6aid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e709db0-4ee0-39a3-eee3-0000a5c23e9b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yaoehn32c2s5pwsuzhaa4lsu2a4seycpwyvn5gfz3bn4i74t2jo3frad.onion/","pattern":"[url:value = 'http://yaoehn32c2s5pwsuzhaa4lsu2a4seycpwyvn5gfz3bn4i74t2jo3frad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4f19d44-1bab-2162-9354-00008db056db","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bmfyfxl74qb6rsukgwymv7e22ua4uvhszsamqwx7jmj57qkamxwlhbid.onion/","pattern":"[url:value = 'http://bmfyfxl74qb6rsukgwymv7e22ua4uvhszsamqwx7jmj57qkamxwlhbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a30dff54-8cd5-a6af-370e-0000725642ae","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wuyfbttjjzsmr5ghl5hoi75ytse3bwrqgk63c6guv3lhw7hwtxbgveid.onion/","pattern":"[url:value = 'http://wuyfbttjjzsmr5ghl5hoi75ytse3bwrqgk63c6guv3lhw7hwtxbgveid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4689e5a-be31-d4fa-e8a5-000039f6a0d2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uds75egfqi7mfpxckf2un742qsj6rh3kfrydqaldwgkrqp2a37lk6fyd.onion/","pattern":"[url:value = 'http://uds75egfqi7mfpxckf2un742qsj6rh3kfrydqaldwgkrqp2a37lk6fyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28c12262-97fd-b65d-0f49-0000f4f4eece","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://osd6tsgegts2xaqo3o2hrpqatwlslqfyc3msvyksad4iucauif3oqqad.onion/","pattern":"[url:value = 'http://osd6tsgegts2xaqo3o2hrpqatwlslqfyc3msvyksad4iucauif3oqqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74ec0760-fcf4-fed5-b1e5-00005a5cb66e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hgannromwuui7n2jvphpteposc3gioqkuo2ncb6fzopasgcq7ixcjeqd.onion/","pattern":"[url:value = 'http://hgannromwuui7n2jvphpteposc3gioqkuo2ncb6fzopasgcq7ixcjeqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02026ec8-9971-99f6-0f35-00007ebaa551","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zf6bl4dczp5z7uaba2lhm5wrhrpflwvzsx2nhf7zyf63tpsfzc54tbad.onion/","pattern":"[url:value = 'http://zf6bl4dczp5z7uaba2lhm5wrhrpflwvzsx2nhf7zyf63tpsfzc54tbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7af19689-1051-ca8e-37a1-0000f7338acd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cicadafhqpjwm2sblkfbuwn7sglbibuejr3m7fildpqpjv3hghlhb4id.onion/","pattern":"[url:value = 'http://cicadafhqpjwm2sblkfbuwn7sglbibuejr3m7fildpqpjv3hghlhb4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7438e27c-e91e-05d8-0f38-0000edd7fd1e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cicadaxousmk6nbntd3ucxefmfgt2drhtfdvh7gmdeh3ttvudam6f2ad.onion","pattern":"[url:value = 'http://cicadaxousmk6nbntd3ucxefmfgt2drhtfdvh7gmdeh3ttvudam6f2ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fab5e3d9-f408-77ec-5936-0000b876acc7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cicadacnft7gcgnveb7wjm6pjpjcjcsugogmlrat7u7pcel3iwb7bhyd.onion/","pattern":"[url:value = 'http://cicadacnft7gcgnveb7wjm6pjpjcjcsugogmlrat7u7pcel3iwb7bhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9be528d3-c703-b5a5-cf48-0000f6847601","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cicadabv7vicyvgz5khl7v2x5yygcgow7ryy6yppwmxii4eoobdaztqd.onion/","pattern":"[url:value = 'http://cicadabv7vicyvgz5khl7v2x5yygcgow7ryy6yppwmxii4eoobdaztqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee787888-fe19-0159-c4bd-0000a2680588","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/synapse","pattern":"[url:value = 'https://www.ransomlook.io/group/synapse']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df90e722-d217-ab63-9a2f-00002e8f2190","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ugoakjk3v6hop3epjhdgn4num43ndb5glgixhraeg2xm455gxqtu2qid.onion","pattern":"[url:value = 'http://ugoakjk3v6hop3epjhdgn4num43ndb5glgixhraeg2xm455gxqtu2qid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a146afc1-f4f7-2196-923e-0000d23bfdfb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.reuters.com/technology/cybersecurity/indonesia-says-it-has-begun-recovering-data-after-major-ransomware-attack-2024-07-12/","pattern":"[url:value = 'https://www.reuters.com/technology/cybersecurity/indonesia-says-it-has-begun-recovering-data-after-major-ransomware-attack-2024-07-12/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc681ac4-7d1e-9a1a-1ab9-00009194684f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://wazuh.com/blog/detecting-brain-cipher-ransomware-with-wazuh/","pattern":"[url:value = 'https://wazuh.com/blog/detecting-brain-cipher-ransomware-with-wazuh/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c85e47d-8d22-d51e-d86d-00000f9fffc6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.group-ib.com/masked-actors/brain-cipher/","pattern":"[url:value = 'https://www.group-ib.com/masked-actors/brain-cipher/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5faf1337-7f97-f45c-02cd-0000f2d4490f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.vectra.ai/modern-attack/threat-actors/brain-cipher","pattern":"[url:value = 'https://www.vectra.ai/modern-attack/threat-actors/brain-cipher']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63bd63af-5fbf-2629-f6a6-0000dd52a8c5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/brain-cipher","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/brain-cipher']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--559291e9-48f6-daca-7856-0000241ee7e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/brain-cipher/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/brain-cipher/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--130d5c39-8d94-0d64-0b68-0000b773f547","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/brain","pattern":"[url:value = 'https://www.ransomlook.io/group/brain']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6eeb8455-af06-8947-c63b-0000f636cf24","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x3nb7qcygpem2j5xzstyzdtgzofzkwkx4eko3ug4r73i6uhcgvyffjyd.onion/","pattern":"[url:value = 'http://x3nb7qcygpem2j5xzstyzdtgzofzkwkx4eko3ug4r73i6uhcgvyffjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--481b5de0-846a-8173-6f1a-0000d8e47fb3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://a4vbe7yp4kluped6khuhpr5nmzshiimx2jt5j22ozriiq6ngsm3fcpyd.onion/","pattern":"[url:value = 'http://a4vbe7yp4kluped6khuhpr5nmzshiimx2jt5j22ozriiq6ngsm3fcpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9b7aff8-a618-651b-876b-0000333be136","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://emdnfl2fv32jhssxcbxlo6dzg2at4d7qbw2md6inz63qzdfgyln5cwyd.onion/","pattern":"[url:value = 'http://emdnfl2fv32jhssxcbxlo6dzg2at4d7qbw2md6inz63qzdfgyln5cwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9dd0b963-c668-5211-d3f9-00000d33f76f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3fg2gfwrdks46drwvejpgpak5klrflclsjjo35dxtqfk3poeez6oezad.onion/","pattern":"[url:value = 'http://3fg2gfwrdks46drwvejpgpak5klrflclsjjo35dxtqfk3poeez6oezad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e526db5-5c3b-9d8f-f03f-000062d55c09","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mejouwrwja4iou7myj34rqi7cixyhn7vsa42e2n2dhxzc5mmkiaki3yd.onion/","pattern":"[url:value = 'http://mejouwrwja4iou7myj34rqi7cixyhn7vsa42e2n2dhxzc5mmkiaki3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--164657e5-5aee-59fd-2934-0000311a78c5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lhsxojxowgtwdqlryl72d2v5cpgqv3sll4d47yyqdisersigvfbl5uid.onion/","pattern":"[url:value = 'http://lhsxojxowgtwdqlryl72d2v5cpgqv3sll4d47yyqdisersigvfbl5uid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8f24e6f-21f8-9ce9-96e7-00008ab438a0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://psv5ejeysrncs6ltu4pkjyazswcmw3atmxi4eg44a6luudin5ufchcqd.onion/","pattern":"[url:value = 'http://psv5ejeysrncs6ltu4pkjyazswcmw3atmxi4eg44a6luudin5ufchcqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f59a637-38cf-6a22-61bd-00003fb844eb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://upiqcdsgvh6v5owteasjzyxbj2xug574dj4fctthehd7zjq7wmuxbwqd.onion/","pattern":"[url:value = 'http://upiqcdsgvh6v5owteasjzyxbj2xug574dj4fctthehd7zjq7wmuxbwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ea62609-7572-4461-3188-000007ccfbf6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://inzk64xcf3sm6qzkehmio7piwhkslhnab3rlviniyg7alcgsxvy7kcyd.onion/","pattern":"[url:value = 'http://inzk64xcf3sm6qzkehmio7piwhkslhnab3rlviniyg7alcgsxvy7kcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdb90d73-422a-ff82-eeb3-0000a5d2e60f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zijgmuqjzb6dc7pofxhtaiz36qqyg35lhutybmzaz6whzgei2casjgid.onion/","pattern":"[url:value = 'http://zijgmuqjzb6dc7pofxhtaiz36qqyg35lhutybmzaz6whzgei2casjgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b1b1079-75c0-aa3d-15e8-00006ff1cd87","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6ft2dfh26wm3w44orpjcgviutvfp25ez2iyh5ego5egvfmifrws7vvqd.onion/","pattern":"[url:value = 'http://6ft2dfh26wm3w44orpjcgviutvfp25ez2iyh5ego5egvfmifrws7vvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93c697fb-1ffb-c9a3-8a6c-000001e0a254","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3frnhzcnlkjnw5q3tm6elzizinm2k3bmrtf2xwqjzpcxzeqwn2tv6wyd.onion/","pattern":"[url:value = 'http://3frnhzcnlkjnw5q3tm6elzizinm2k3bmrtf2xwqjzpcxzeqwn2tv6wyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e523baaf-ad0e-3867-186a-00009a1f6856","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zke5xim35cfolmq2h5i5sfmcoxr4pbpkfjwtq5lf6o4zo7avfcvnb5qd.onion/","pattern":"[url:value = 'http://zke5xim35cfolmq2h5i5sfmcoxr4pbpkfjwtq5lf6o4zo7avfcvnb5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24048891-6143-ba08-2241-0000fc904117","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://braincgksuixxkpkme7zlpkh7u47oryxx574d74ws4eal4t2mxyahbqd.onion","pattern":"[url:value = 'http://braincgksuixxkpkme7zlpkh7u47oryxx574d74ws4eal4t2mxyahbqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56d635e8-55a4-5c24-6e27-00009e0671b7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jgkgqztfmwk53wlttsjo6i3nmwtzoch2oi2bocqzb4zmp6kfspuiaead.onion/","pattern":"[url:value = 'http://jgkgqztfmwk53wlttsjo6i3nmwtzoch2oi2bocqzb4zmp6kfspuiaead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dacdc9a8-97ec-d893-9849-0000dcf09ba6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hdgfvxxkepllbvqvk7vrudgwq55tg4joo4xpajaa3nv5gzpake66bnid.onion/","pattern":"[url:value = 'http://hdgfvxxkepllbvqvk7vrudgwq55tg4joo4xpajaa3nv5gzpake66bnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a118b7d6-14aa-407d-7e08-0000c59aaca4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://q226mkoikzgyu33jin7ox3qo6tea7yhlgz52p5lslpj73edtocsz4wqd.onion/","pattern":"[url:value = 'http://q226mkoikzgyu33jin7ox3qo6tea7yhlgz52p5lslpj73edtocsz4wqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df065cb7-a3f2-5f7d-d225-0000cb0a1a89","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xangddavm54rgsju7iceahxztbqrcflzunffwbaswwhhftieygc4j3ad.onion/","pattern":"[url:value = 'http://xangddavm54rgsju7iceahxztbqrcflzunffwbaswwhhftieygc4j3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42706290-0b98-bb0c-b174-00000eab8505","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://as7fbsjvifse52ek5qnptfgvkduvvnl56adb3jjgk6k3p7bisipvotyd.onion/","pattern":"[url:value = 'http://as7fbsjvifse52ek5qnptfgvkduvvnl56adb3jjgk6k3p7bisipvotyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64736ef9-5aa5-366e-a645-00007c116b3a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bgpeqy3d5svuikeaueitix6zosg3pzekw77viulnucsiqsn4sjr65iyd.onion/","pattern":"[url:value = 'http://bgpeqy3d5svuikeaueitix6zosg3pzekw77viulnucsiqsn4sjr65iyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51ce20e7-f6e3-ae36-5d9f-0000b18348cf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ncyg34lipi3w2u7yvxl3swr6wj6lsoeix3grrdsn6nmcv4r7vntanoid.onion/","pattern":"[url:value = 'http://ncyg34lipi3w2u7yvxl3swr6wj6lsoeix3grrdsn6nmcv4r7vntanoid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5868be8-45e8-2c6a-9802-00008f2ba3d6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tahr6kwobsi7fj5j3hoyzxr34ipyiyuv2svhteht5td4etq23bcx7tyd.onion/","pattern":"[url:value = 'http://tahr6kwobsi7fj5j3hoyzxr34ipyiyuv2svhteht5td4etq23bcx7tyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f18218b-5d5b-f0d9-ee19-000086e53c25","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ixvarmokkir6t6fzpn7prussp3ulys66aeivrhcvrmfowqi2gi2fgryd.onion/","pattern":"[url:value = 'http://ixvarmokkir6t6fzpn7prussp3ulys66aeivrhcvrmfowqi2gi2fgryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff900694-29b2-4061-7e31-0000a83961bf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ubetdhmgnry4jk7ya7gh7p4hm4c3c57srkw62oc6hjmvvvkrqeybjjid.onion/","pattern":"[url:value = 'http://ubetdhmgnry4jk7ya7gh7p4hm4c3c57srkw62oc6hjmvvvkrqeybjjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7bdebc6-c55f-a31e-20b5-0000690e4afd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zv27q4tjvqxelm2imgztfg7gtl3v56oqabe77hiufqoqilis2dgcdsad.onion/","pattern":"[url:value = 'http://zv27q4tjvqxelm2imgztfg7gtl3v56oqabe77hiufqoqilis2dgcdsad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e61cfb3-ae4a-fde0-970d-000045b99fc6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://oe7kcuvnulmdzir6zkewv5p353kc7qjf5tyqxfxabhzsm26pji44elqd.onion/","pattern":"[url:value = 'http://oe7kcuvnulmdzir6zkewv5p353kc7qjf5tyqxfxabhzsm26pji44elqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9c5a7c1-ac54-1600-af59-00006e53a571","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lhdv4ydjx5idzvntdrmcbwsh3dhdi3ww5hoz3ws2d5q5jlfewdacx4qd.onion/","pattern":"[url:value = 'http://lhdv4ydjx5idzvntdrmcbwsh3dhdi3ww5hoz3ws2d5q5jlfewdacx4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--925ce1aa-7c1c-289b-6577-0000052142f8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5v6tgs5xyuvl7kpg5b26e54kddlxdvktep2qmglawrohksv3qjwvw7qd.onion/","pattern":"[url:value = 'http://5v6tgs5xyuvl7kpg5b26e54kddlxdvktep2qmglawrohksv3qjwvw7qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fedf363-3b71-ef9e-8f8a-00005fcd1ce3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pzghjpkm2liszmvjsttflp475zqxgrywjhr7xagc4bqfb2a7aw3qysyd.onion/","pattern":"[url:value = 'http://pzghjpkm2liszmvjsttflp475zqxgrywjhr7xagc4bqfb2a7aw3qysyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eef0cb22-6e75-8cfc-2fd8-00005a0c2b57","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://i6b4r6blgmm3r62zj42qxn6bvcbcrslcg6b6uwqws6xhnxz2howbhkid.onion/","pattern":"[url:value = 'http://i6b4r6blgmm3r62zj42qxn6bvcbcrslcg6b6uwqws6xhnxz2howbhkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1a107d1-e537-fdc0-7fa0-000096ad1fa1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yt7beb7fj6xbh4dndrlyvl3gn4ck36qn2oqheiqjs4bp3wspj3wgpcad.onion/","pattern":"[url:value = 'http://yt7beb7fj6xbh4dndrlyvl3gn4ck36qn2oqheiqjs4bp3wspj3wgpcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ceec6e3-cb5a-46f7-b2d2-000085c094cc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onion/c/lgc2Yxua65agt4XMOMkQKJjsdrV2IzYk","pattern":"[url:value = 'http://4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onion/c/lgc2Yxua65agt4XMOMkQKJjsdrV2IzYk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b96712c7-7bf9-b7f6-9e1b-0000cbb441fa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p6wmotxzvg34tdmpwm4beqgrcyp5iys43snkccsahnw74la3k3xx6pad.onion","pattern":"[url:value = 'http://p6wmotxzvg34tdmpwm4beqgrcyp5iys43snkccsahnw74la3k3xx6pad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d561ea96-bb89-536e-dc73-000093cccb91","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/","pattern":"[url:value = 'http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99b57fac-7e2d-8c47-7cb7-000037b8c309","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion/","pattern":"[url:value = 'http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3054339-f6e3-e18b-570a-0000239e11ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: extension.README.txt","pattern":"[domain-name:value = 'extension.README.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3ec28f4-cf07-263a-4202-0000b25a9eb8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/trinity","pattern":"[url:value = 'https://www.ransomlook.io/group/trinity']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6014ee3-1d9e-0687-4460-0000462f79ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://txtggyng5euqkyzl2knbejwpm4rlq575jn2egqldu27osbqytrj6ruyd.onion/","pattern":"[url:value = 'http://txtggyng5euqkyzl2knbejwpm4rlq575jn2egqldu27osbqytrj6ruyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9dadd0cc-453b-0167-d249-0000459c305d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sensayq","pattern":"[url:value = 'https://www.ransomlook.io/group/sensayq']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef1a3e85-bf11-b771-88c6-0000af2f7e2d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ppzmaodrgtg7r6zcputdlaqfliubmmjpo4u56l3ayckut3nyvw6dyayd.onion/","pattern":"[url:value = 'http://ppzmaodrgtg7r6zcputdlaqfliubmmjpo4u56l3ayckut3nyvw6dyayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1016f1a9-b218-11b3-aae1-0000dbac46fc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gmixcebhni6c3kcf5m7xxybomaphj7pizoqtxiqmrz5wsh6g6x5s2wqd.onion/","pattern":"[url:value = 'http://gmixcebhni6c3kcf5m7xxybomaphj7pizoqtxiqmrz5wsh6g6x5s2wqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76497036-8cc1-b4de-fa8c-0000f4af5c38","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/wikileaksv2","pattern":"[url:value = 'https://www.ransomlook.io/group/wikileaksv2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32d1b46b-1dab-b4a1-5da4-0000c189e8a3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://assets.kpmg.com/content/dam/kpmgsites/in/pdf/2024/11/kpmg-ctip-fog-ransomware-19-nov-2024.pdf.coredownload.inline.pdf","pattern":"[url:value = 'https://assets.kpmg.com/content/dam/kpmgsites/in/pdf/2024/11/kpmg-ctip-fog-ransomware-19-nov-2024.pdf.coredownload.inline.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d75c6b7-68b3-9bd7-68de-000089a8585d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.areteir.com/static/FOG_Ransomware.pdf","pattern":"[url:value = 'https://www.areteir.com/static/FOG_Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6b20be3-6857-b149-c612-00009949209a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.securitymagazine.com/articles/101694-fog-ransomware-group-uses-unconventional-toolset-new-research-finds","pattern":"[url:value = 'https://www.securitymagazine.com/articles/101694-fog-ransomware-group-uses-unconventional-toolset-new-research-finds']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0687a0c6-17f7-a48d-749b-0000bc8f0530","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/d/fog-ransomware-concealed-within-binary-loaders-linking-themselve.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/d/fog-ransomware-concealed-within-binary-loaders-linking-themselve.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3184506e-e97c-272c-ebba-0000e651b9d8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.barracuda.com/2025/04/29/a-closer-look-at-fog-ransomware","pattern":"[url:value = 'https://blog.barracuda.com/2025/04/29/a-closer-look-at-fog-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f5e0637-1bb2-8129-abde-00000fdb6da1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/fog/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/fog/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--620c38c4-04b4-a3dd-db49-00007cf98b80","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/fog-ransomware","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/fog-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28de3c48-eab2-41f0-a8da-000098671fd2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.kroll.com/en/publications/cyber/fog-ransomware-targets-higher-education","pattern":"[url:value = 'https://www.kroll.com/en/publications/cyber/fog-ransomware-targets-higher-education']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db75a62d-7db4-cf65-82b4-00001cd10e1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/fog","pattern":"[url:value = 'https://www.ransomlook.io/group/fog']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94a72291-c26e-15df-2bc2-0000e7a7e796","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nw5zrjqarckmsf22rrgo5yooelpnn5raxhesuhrpzceqibmjwanbbaad.onion/","pattern":"[url:value = 'http://nw5zrjqarckmsf22rrgo5yooelpnn5raxhesuhrpzceqibmjwanbbaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e0b95d4-8b1a-932d-5bda-0000e5127f8b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onion/","pattern":"[url:value = 'http://44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2481dfc-01a3-f213-d9a3-0000cfc36a66","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hlbqbuy2bo3onn6h6eq7pbci24kughiaw4rkxrewidnqma3hwwgt2ead.onion","pattern":"[url:value = 'http://hlbqbuy2bo3onn6h6eq7pbci24kughiaw4rkxrewidnqma3hwwgt2ead.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a611a33e-a27b-29c6-e45d-00003519424a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion","pattern":"[url:value = 'http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13ae8226-69fe-5937-66a9-0000f06d0bc9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion/","pattern":"[url:value = 'https://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47e22337-0338-9c13-2fa6-000025ff42c9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/risen","pattern":"[url:value = 'https://www.ransomlook.io/group/risen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6654fadc-b38c-1b3d-a7ce-0000f2b01546","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cqqzfmdd2fwshfyic6srf3fxjjigiipqdygosk6sdifstrbtxnm5bead.onion","pattern":"[url:value = 'https://cqqzfmdd2fwshfyic6srf3fxjjigiipqdygosk6sdifstrbtxnm5bead.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c4798bf-dd93-7a51-f39b-00006b5428fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://o6pi3u67zyag73ligtsupin5rjkxpfrbofwoxnhimpgpfttxqu7lsuyd.onion","pattern":"[url:value = 'http://o6pi3u67zyag73ligtsupin5rjkxpfrbofwoxnhimpgpfttxqu7lsuyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be52d000-f65f-fecf-c490-0000f02bb0d7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://s2wk77h653qn54csf4gp52orhem4y72dgxsquxulf255pcymazeepbyd.onion/","pattern":"[url:value = 'http://s2wk77h653qn54csf4gp52orhem4y72dgxsquxulf255pcymazeepbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88bb88f0-b041-16fa-aace-0000ee5b4eb1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/locus","pattern":"[url:value = 'https://www.ransomlook.io/group/locus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dc831b5-69c4-012e-983f-000064013458","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ugn5khvt4kitlivv4ddfh3lb6mdhn2ud3ximcaypy73hxlk3arj2goad.onion/","pattern":"[url:value = 'http://ugn5khvt4kitlivv4ddfh3lb6mdhn2ud3ximcaypy73hxlk3arj2goad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73218912-3763-9cd7-15bc-00004dfc019f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/el","pattern":"[url:value = 'https://www.ransomlook.io/group/el']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dad76a7e-8413-4bfa-f10f-00002dbcc474","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4ozbomcjurd64vgeblkoqeqirvawi3dddswriw6qespscmequmqlshyd.onion/","pattern":"[url:value = 'http://4ozbomcjurd64vgeblkoqeqirvawi3dddswriw6qespscmequmqlshyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--919b4535-03b4-4425-f237-00003c0593c8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onion/","pattern":"[url:value = 'http://zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ed4124d-8ea2-aabd-e8be-0000757e3dbd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://26ubgm3vvrjawkdyfhvl2d2nhq77nu3zsagbih4yy2zgau5uv5ivfgyd.onion","pattern":"[url:value = 'http://26ubgm3vvrjawkdyfhvl2d2nhq77nu3zsagbih4yy2zgau5uv5ivfgyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1f984f7-f050-825c-0474-0000df7337ad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://panela3eefdzfzxzxcshfnbustdprtlhlbe3x2fqomdz7t33iqtzvjyd.onion/","pattern":"[url:value = 'http://panela3eefdzfzxzxcshfnbustdprtlhlbe3x2fqomdz7t33iqtzvjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4930328f-9c15-293b-80da-0000d5b67d87","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion/Url=4094dd92-0f91-4699-8328-fdb7070a8230","pattern":"[url:value = 'http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion/Url=4094dd92-0f91-4699-8328-fdb7070a8230']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4946b043-7ed7-f84a-dbea-0000fdd03c63","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion","pattern":"[url:value = 'http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61c7865f-9b98-f562-1c98-0000fb4f449c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onion/","pattern":"[url:value = 'http://dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5275eee-da86-3291-b29e-0000d6387d60","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.group-ib.com/blog/hunters-international-ransomware-group/","pattern":"[url:value = 'https://www.group-ib.com/blog/hunters-international-ransomware-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4326437a-d22c-904c-23e3-0000a4493150","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/apos-security","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/apos-security']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5346f6c1-8cfe-a8c8-172c-0000b9421b14","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-new-face-of-ransomware-key-players-and-emerging-tactics-of-2024/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-new-face-of-ransomware-key-players-and-emerging-tactics-of-2024/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--782f9779-a24b-87ba-f066-00003a87378d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyble.com/blog/top-ransomware-groups-may-2025-safepay-devman-rise/","pattern":"[url:value = 'https://cyble.com/blog/top-ransomware-groups-may-2025-safepay-devman-rise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36d99d08-c5db-3ff9-e2ed-0000c1858a07","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyberint.com/blog/research/ransomware-trends-2024-report/","pattern":"[url:value = 'https://cyberint.com/blog/research/ransomware-trends-2024-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c7eb024-b474-2780-61f9-0000984a590d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/apos","pattern":"[url:value = 'https://www.ransomlook.io/group/apos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ea0d031-3a55-a80b-9768-00008631ac80","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yrz6bayqwhleymbeviter7ejccxm64sv2ppgqgderzgdhutozcbbhpqd.onion/","pattern":"[url:value = 'http://yrz6bayqwhleymbeviter7ejccxm64sv2ppgqgderzgdhutozcbbhpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b4bb88b-b69a-68cf-df9f-0000d4040d3c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yrz6bayqwhleymbeviter7ejccxm64sv2ppgqgderzgdhutozcbbhpqd.onion/rules","pattern":"[url:value = 'http://yrz6bayqwhleymbeviter7ejccxm64sv2ppgqgderzgdhutozcbbhpqd.onion/rules']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebb0af74-2a2b-299b-4a0a-000045709663","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://apos.blog","pattern":"[url:value = 'https://apos.blog']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b28aa1e-a545-b6e3-e9bf-000083933706","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/meow","pattern":"[url:value = 'https://www.ransomlook.io/group/meow']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44e556b5-5c3f-bd32-0132-00000b629534","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://meowthxcf4tm3rujk4bsjaoxd2ghmjx7vi342hz6zdu3lfyeykmc4wqd.onion","pattern":"[url:value = 'http://meowthxcf4tm3rujk4bsjaoxd2ghmjx7vi342hz6zdu3lfyeykmc4wqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f4c12c7-4a0f-fdaf-fcf7-00006708b80c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mops6j3iuepvarl7ackf2itjkt4in3xkcbupnhy656byx6m6hnxkbgid.onion","pattern":"[url:value = 'http://mops6j3iuepvarl7ackf2itjkt4in3xkcbupnhy656byx6m6hnxkbgid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcf23ada-f25e-511b-0309-00000272b8fd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ikjht3url3tvx6itf2eghtrmwlmjfywz63ymnxghwwyhflcxnqffhvid.onion","pattern":"[url:value = 'http://ikjht3url3tvx6itf2eghtrmwlmjfywz63ymnxghwwyhflcxnqffhvid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af1df33d-0c9a-630b-b662-00008452ed65","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://totos7fquprkecvcsl2jwy72v32glgkp2ejeqlnx5ynnxvbebgnletqd.onion","pattern":"[url:value = 'http://totos7fquprkecvcsl2jwy72v32glgkp2ejeqlnx5ynnxvbebgnletqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32487e7d-be3a-0a9e-6285-000061e42345","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://meow6xanhzfci2gbkn3lmbqq7xjjufskkdfocqdngt3ltvzgqpsg5mid.onion/","pattern":"[url:value = 'http://meow6xanhzfci2gbkn3lmbqq7xjjufskkdfocqdngt3ltvzgqpsg5mid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--479b8767-dc3e-9b3f-5697-0000aaf1dc0c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://dig.watch/updates/darkvaults-slip-up-exposes-link-to-lockbit","pattern":"[url:value = 'https://dig.watch/updates/darkvaults-slip-up-exposes-link-to-lockbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c88e7d20-ebed-cd5f-01ea-00005caaaa1a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.threatintelligence.com/blog/darkvault-ransomware","pattern":"[url:value = 'https://www.threatintelligence.com/blog/darkvault-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17663238-0bdc-eb02-7904-000097af618d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dark-vault","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dark-vault']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d119f7a-2d02-3ebc-d387-000031791e72","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/darkvault","pattern":"[url:value = 'https://www.ransomlook.io/group/darkvault']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75ee80b0-bb09-21ad-aa03-00004d19ecff","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kkvanuf7on5uglvdhihy627w5pxwcmhl6pxik7rwef6y7crt6wj4hjqd.onion/","pattern":"[url:value = 'http://kkvanuf7on5uglvdhihy627w5pxwcmhl6pxik7rwef6y7crt6wj4hjqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18d2955e-befe-4250-6e9e-0000f6bf8bab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/f/embargo-ransomware-raas-analysis.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/f/embargo-ransomware-raas-analysis.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dded3b8-4373-bff3-0841-0000f4458304","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.zscaler.com/blogs/security-research/technical-analysis-embargo-ransomware","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/technical-analysis-embargo-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b82d387-173e-c9c8-5fd2-0000b9af3c70","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/embargo-ransomware-new-raas-on-the-scene/","pattern":"[url:value = 'https://www.sentinelone.com/blog/embargo-ransomware-new-raas-on-the-scene/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a3e96d5-ef6e-a2ff-7878-0000994e8238","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/embargo","pattern":"[url:value = 'https://www.ransomlook.io/group/embargo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3245ab1-a731-043f-41fe-00004cbd8035","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dr4zejrunmmijebc4jhz6xwplapeltdqdchvbvikiwitvrtjedcezmad.onion/","pattern":"[url:value = 'http://dr4zejrunmmijebc4jhz6xwplapeltdqdchvbvikiwitvrtjedcezmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fed50b2-b3f0-d110-320e-000056acacce","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bjy6kwjxxepe6v3vjlxhir4qzdpl7jvwvxua6wvemyfm44di2cxdd4qd.onion/","pattern":"[url:value = 'http://bjy6kwjxxepe6v3vjlxhir4qzdpl7jvwvxua6wvemyfm44di2cxdd4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a7ecf1a-6d69-0b28-6030-00001e18f488","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yunznlzrpp7oa45og6unujpp4t3f4m2sqh2b4vuhct3kmbxxj6lwqbqd.onion/","pattern":"[url:value = 'http://yunznlzrpp7oa45og6unujpp4t3f4m2sqh2b4vuhct3kmbxxj6lwqbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a5b0b4f-bc12-5f33-ebe9-000090fdde9e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://n56t64ldkhzygjk5cqa2f3r4xxjqzaftusjy56z25qcnun6ab4cijeqd.onion/","pattern":"[url:value = 'http://n56t64ldkhzygjk5cqa2f3r4xxjqzaftusjy56z25qcnun6ab4cijeqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8c4fa12-10ea-6a97-1cd0-0000998e3dd6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gvhj726josrtcuig76yfme5x72d7xqbevgsqm26ua3qcmskxddnx3oid.onion/","pattern":"[url:value = 'http://gvhj726josrtcuig76yfme5x72d7xqbevgsqm26ua3qcmskxddnx3oid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--593f5afb-a7b7-1d30-ec0e-0000bbd54125","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fvbobs6fcm5lske2xhfyx5sazn3i5cbxrbdyozoio23ouhnmortg5fyd.onion/","pattern":"[url:value = 'http://fvbobs6fcm5lske2xhfyx5sazn3i5cbxrbdyozoio23ouhnmortg5fyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d1dbb81-f869-8d42-0437-000070b62f8e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rdur3c3dxhjjpfxebaiba6fuj6lqrcdtqfzengynkg5ptyelcclgvdid.onion/","pattern":"[url:value = 'http://rdur3c3dxhjjpfxebaiba6fuj6lqrcdtqfzengynkg5ptyelcclgvdid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--311d982a-ee25-b9ed-75bd-00001b32ea62","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://clqt3b3ldzxyemjrkvgsm5so2tyus7f7i2ia5qvikt4623srq5w3d7ad.onion/","pattern":"[url:value = 'http://clqt3b3ldzxyemjrkvgsm5so2tyus7f7i2ia5qvikt4623srq5w3d7ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b3493fc-ee71-4e21-7306-00003370e23d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nbgvwttzh35irjtnxgeaydqob6ixorgabbufb4ociefv4zklyppu5lad.onion/","pattern":"[url:value = 'http://nbgvwttzh35irjtnxgeaydqob6ixorgabbufb4ociefv4zklyppu5lad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d98d6339-e86a-995f-e431-000002155c91","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://22g3uiuyqqa4txxuyvzmlyvlou4crrgfvgnvodrv3wrxcedtvjgx6aid.onion/","pattern":"[url:value = 'http://22g3uiuyqqa4txxuyvzmlyvlou4crrgfvgnvodrv3wrxcedtvjgx6aid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ac43327-4074-673f-8ec7-0000a1167648","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6cs2fy7brjjx3fza7ny2vyhbkaxtn6rdx4p4js2lbgyhke7z4aslxtid.onion/","pattern":"[url:value = 'http://6cs2fy7brjjx3fza7ny2vyhbkaxtn6rdx4p4js2lbgyhke7z4aslxtid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d7fb5fa-0ee9-7ed9-74b4-0000152d8585","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wsw3zgmaw32cjt4j4iwwpg7td7qgrh2fp2p34pvhupyqke6ilepsnqad.onion/","pattern":"[url:value = 'http://wsw3zgmaw32cjt4j4iwwpg7td7qgrh2fp2p34pvhupyqke6ilepsnqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adf0dc3d-462f-15a1-e815-000048f54bcf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://olpvpdu4dotl54dereuembantzyjqzftjqj2ovvlfgcvw23qknuxzjad.onion/","pattern":"[url:value = 'http://olpvpdu4dotl54dereuembantzyjqzftjqj2ovvlfgcvw23qknuxzjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27d9d19a-6b24-7898-91ca-000063dee681","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://73klffkonzmo6csfca75k67rniemcvlc2ydnfnkk54cqnkmdk2yqxqad.onion/","pattern":"[url:value = 'http://73klffkonzmo6csfca75k67rniemcvlc2ydnfnkk54cqnkmdk2yqxqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c2cd099-3d31-8ea5-f596-0000b5546f61","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7t635vqx6zm733ryjj5jm6hnavlw2it3umi3zmbq6gd6nhaeaylsbsyd.onion/","pattern":"[url:value = 'http://7t635vqx6zm733ryjj5jm6hnavlw2it3umi3zmbq6gd6nhaeaylsbsyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13abafeb-9b2d-4886-98b0-0000395aa0ba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3kt5ouf4qxdkuzsct6zp3jxsqmtaqjsun3uvfdwbeuo2yizjp73ripyd.onion/","pattern":"[url:value = 'http://3kt5ouf4qxdkuzsct6zp3jxsqmtaqjsun3uvfdwbeuo2yizjp73ripyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f30a006e-9851-2896-942e-000056ea4a69","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fanr4dyego253yx5pmbc7krct6qzq3hqfrchvj5fafiwalvjijfgsmid.onion/","pattern":"[url:value = 'http://fanr4dyego253yx5pmbc7krct6qzq3hqfrchvj5fafiwalvjijfgsmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89703efa-385a-b327-669f-00005de5d960","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://g7hva5likuonhljhh3sp2nvg7pezpu45vpxjccgihevwpb4fi2napqad.onion/","pattern":"[url:value = 'http://g7hva5likuonhljhh3sp2nvg7pezpu45vpxjccgihevwpb4fi2napqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aff8ce00-c6c5-2d82-09e3-00001269c5ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rlseptkjo5yt2c3m4ov7hmhxmb2uia3cic3ohq2u5tmb2uv4enovhfid.onion/","pattern":"[url:value = 'http://rlseptkjo5yt2c3m4ov7hmhxmb2uia3cic3ohq2u5tmb2uv4enovhfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47e7b50c-71db-fc82-2219-00005ab091ab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7jkcp27353enwfwdemqgsevyjbtz5cxv66n5ctfgd37h2mdxbhhiluyd.onion/","pattern":"[url:value = 'http://7jkcp27353enwfwdemqgsevyjbtz5cxv66n5ctfgd37h2mdxbhhiluyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddb36206-e1be-1997-4d4d-0000f558d2d2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://orxo6qmizqa43suoox3xteu6645y4zf2bpvnsutb2yq3n2lpprw2x7yd.onion/","pattern":"[url:value = 'http://orxo6qmizqa43suoox3xteu6645y4zf2bpvnsutb2yq3n2lpprw2x7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d14245c-b0dd-39c0-28e5-00007ae2a7dc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kk3puzzmu6jfzll6sllchr5olxf4bg4tl7uyq7wtiqqpntkreya3qxqd.onion","pattern":"[url:value = 'http://kk3puzzmu6jfzll6sllchr5olxf4bg4tl7uyq7wtiqqpntkreya3qxqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd712808-87f9-de66-9447-0000803afbab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jolfnfw6lmcjsppgjfimhimqt2t7viybk67yc5zkxip6fxrcgo7mv4id.onion/","pattern":"[url:value = 'http://jolfnfw6lmcjsppgjfimhimqt2t7viybk67yc5zkxip6fxrcgo7mv4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bbbbb84-7743-e74e-9130-000049c8eb8e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tamvd5fdyvpekhaf2sdg5sum73ra2abc4h2iqihijpvw4hythnlmuhid.onion/","pattern":"[url:value = 'http://tamvd5fdyvpekhaf2sdg5sum73ra2abc4h2iqihijpvw4hythnlmuhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a09f452-ac4a-05c7-7389-000092422337","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rngjexyyyl5mek5kg2lkxilqfef5nr6bpa4u24i5ei5hb3ydsh5drpid.onion/","pattern":"[url:value = 'http://rngjexyyyl5mek5kg2lkxilqfef5nr6bpa4u24i5ei5hb3ydsh5drpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f71c7052-9c46-d6df-3c2f-0000a0709a3e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vh2wkazjlflm6pvwtvw2fnztu3dcw4346lasvikzeg25yhx6bjvl5pqd.onion/","pattern":"[url:value = 'http://vh2wkazjlflm6pvwtvw2fnztu3dcw4346lasvikzeg25yhx6bjvl5pqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51abc072-02a9-6211-bd51-000029fd54ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p474ku5ehoex7mfsbdenppakbb4twvrnvggjzhp53xw4z5qq6glm4yad.onion/","pattern":"[url:value = 'http://p474ku5ehoex7mfsbdenppakbb4twvrnvggjzhp53xw4z5qq6glm4yad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--000d35ef-4ac6-c754-f1c3-00008a486c38","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qk5nd25xdnygqrey7al2tb3xop5brk7kxua7xr2zrgftzked43bku4yd.onion/","pattern":"[url:value = 'http://qk5nd25xdnygqrey7al2tb3xop5brk7kxua7xr2zrgftzked43bku4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6e6a1d1-c222-9bd6-3a41-00008648d0aa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://usu2gxoiijvnswhfymd6ucjjwhtgqby4c4ywzvnrtw4i6mpgppvzpsad.onion/","pattern":"[url:value = 'http://usu2gxoiijvnswhfymd6ucjjwhtgqby4c4ywzvnrtw4i6mpgppvzpsad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8136b90d-a90d-3575-b6cc-000006135614","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qrthxx5hkttfl3pk57eou6ddqi34pxsibxvndq7vt5pblqbaurkmxbqd.onion/","pattern":"[url:value = 'http://qrthxx5hkttfl3pk57eou6ddqi34pxsibxvndq7vt5pblqbaurkmxbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26ba7923-5301-fedf-b151-00001b34251c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://a3kvb22nuhfgaluy6uzufrjn3azzsu7tylszdbyne3kiextdmxz4nnyd.onion/","pattern":"[url:value = 'http://a3kvb22nuhfgaluy6uzufrjn3azzsu7tylszdbyne3kiextdmxz4nnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58347244-b94d-a96b-f7b8-0000bf588f2b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/","pattern":"[url:value = 'http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f12ff70c-17e6-5b45-0af9-00000d40f618","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/","pattern":"[url:value = 'http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7efb420c-f77c-3d94-f081-0000154cbaa7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ec6edgevw2lzqy4ipafpbvjuu7r6ugqbljqokl3pvecc6c3a5ix3wgyd.onion/","pattern":"[url:value = 'http://ec6edgevw2lzqy4ipafpbvjuu7r6ugqbljqokl3pvecc6c3a5ix3wgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c23ff39-b5e0-ec80-542a-0000ee8f17dd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://a3kvb22nuhfgaluy6uzufrjn3azzsu7tylszdbyne3kiextdmxz4nnyd.onion","pattern":"[url:value = 'http://a3kvb22nuhfgaluy6uzufrjn3azzsu7tylszdbyne3kiextdmxz4nnyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30de1d8f-2014-5dbc-97d0-000080188aec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5dw7bszmidrhpoltqbqmpixpz6mvgez3mr6xc7ktval2glrmbxkwopad.onion/","pattern":"[url:value = 'http://5dw7bszmidrhpoltqbqmpixpz6mvgez3mr6xc7ktval2glrmbxkwopad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53830b23-abad-6024-1085-00005938b615","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7watkqnnuwxvlpgy5gaosgqy67nve3jgpy37xobqngmswz3vuvde56yd.onion/","pattern":"[url:value = 'http://7watkqnnuwxvlpgy5gaosgqy67nve3jgpy37xobqngmswz3vuvde56yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74af9183-0308-5d1b-b3a1-00003936e521","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7lxwbzlkpjyuahuvngwwkc4mycj2a4flh45ksqjo2ezfdbkmxmlxikad.onion/","pattern":"[url:value = 'http://7lxwbzlkpjyuahuvngwwkc4mycj2a4flh45ksqjo2ezfdbkmxmlxikad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3df2e34-875c-6b26-c7fc-0000ca7fce58","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z2b75lk7xf6kme3zfvlmdmpwiaansnkcuhsojd23dgub5md24fhogcyd.onion/","pattern":"[url:value = 'http://z2b75lk7xf6kme3zfvlmdmpwiaansnkcuhsojd23dgub5md24fhogcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a94b4ae2-1311-c5a2-7d8e-0000b5887e5e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4q5tsu5o3msmv4am4dfhupwhzlyg7wv3lpswbvbhcrknr4ega7xetxad.onion/","pattern":"[url:value = 'http://4q5tsu5o3msmv4am4dfhupwhzlyg7wv3lpswbvbhcrknr4ega7xetxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ff263fb-63e8-620d-0efe-0000508472f4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7watkqnnuwxvlpgy5gaosgqy67nve3jgpy37xobqngmswz3vuvde56yd.onion","pattern":"[url:value = 'http://7watkqnnuwxvlpgy5gaosgqy67nve3jgpy37xobqngmswz3vuvde56yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c0afd93-1281-44cc-ec18-00004ae435f5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3o5ewrzhqoyodfs5kll4cjxagdfrpuu474panwobm4im7ejfpaux5jyd.onion/","pattern":"[url:value = 'http://3o5ewrzhqoyodfs5kll4cjxagdfrpuu474panwobm4im7ejfpaux5jyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ad0b956-569c-b6e1-a1b9-00002f93d0a3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/api/blog/get","pattern":"[url:value = 'http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/api/blog/get']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36d66db3-2e56-d095-a25f-00008c8d67da","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://y6kyfs2unbfcyodzjrxadn4w5vyulhyotdi5dtiqulxbduujehupunqd.onion/","pattern":"[url:value = 'http://y6kyfs2unbfcyodzjrxadn4w5vyulhyotdi5dtiqulxbduujehupunqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ae52b4e-6db0-3935-fdda-000028620ef0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://2nn4b6gihz5bttzabjegune3blwktad2zmy77fwutvvrxxodbufo6qid.onion/","pattern":"[url:value = 'https://2nn4b6gihz5bttzabjegune3blwktad2zmy77fwutvvrxxodbufo6qid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf77a95b-1b78-8e66-ecda-0000253b670f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://66ohzao6afsv2opk22r2kv6fbnf2fthe7v4ykzzc5vjezvvyf3gocwyd.onion/","pattern":"[url:value = 'http://66ohzao6afsv2opk22r2kv6fbnf2fthe7v4ykzzc5vjezvvyf3gocwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3c6dfea-e0a1-6b1b-064f-000024a4ae7e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zo5xog4vpvdae473doneepetidh36m5czdq2vyeiq3lvqhuel56p6nid.onion/","pattern":"[url:value = 'http://zo5xog4vpvdae473doneepetidh36m5czdq2vyeiq3lvqhuel56p6nid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ff576dc-6873-6548-eba4-0000c4575196","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sbjthwyoxfuxq75b77e2hsj7ie67m3qicfnuikhuabwo3sikvrzyaxad.onion/","pattern":"[url:value = 'http://sbjthwyoxfuxq75b77e2hsj7ie67m3qicfnuikhuabwo3sikvrzyaxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9a29e8d-6170-ace2-5718-0000ca81a8e4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wg55rcy2chmbpeh6pl5pftnveac2lqfxbletrtzanfjhhmvcjnn5tcqd.onion/","pattern":"[url:value = 'http://wg55rcy2chmbpeh6pl5pftnveac2lqfxbletrtzanfjhhmvcjnn5tcqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d3ae922-2a92-c7a4-9b22-0000860f465a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://oftm4u5cfl6wyadj27h3csdxfvyd7favssxcr7l7wnswdsrfedxswxqd.onion/","pattern":"[url:value = 'http://oftm4u5cfl6wyadj27h3csdxfvyd7favssxcr7l7wnswdsrfedxswxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--342c4bd5-8662-a33c-84e2-00005e61486c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://s37weqmxusvfcxkoorgkut5v7frn27zftdb6pdjsyjl5djg6oxjqjbid.onion/","pattern":"[url:value = 'http://s37weqmxusvfcxkoorgkut5v7frn27zftdb6pdjsyjl5djg6oxjqjbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7d23638-fd2f-a623-8a6d-00003fcfd3ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://i2okedfryhllg6ka6aur3wnxcxdaufbuuysp4drr5xoc6gvqpcogejid.onion/","pattern":"[url:value = 'http://i2okedfryhllg6ka6aur3wnxcxdaufbuuysp4drr5xoc6gvqpcogejid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5032bfa7-4239-6763-6c81-000083cbedec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ufjoe7fdwvml52oin7flwlqksvp3fcvfyh2kwsngt7j2yf7xou52w2qd.onion/","pattern":"[url:value = 'http://ufjoe7fdwvml52oin7flwlqksvp3fcvfyh2kwsngt7j2yf7xou52w2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c28fe1e2-c2c6-9504-62d2-000064721dbe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yj3eozlkkxkcsprc2fug7tolgtnllruyavuyyar3yzsccjdgvu2bl2yd.onion/","pattern":"[url:value = 'http://yj3eozlkkxkcsprc2fug7tolgtnllruyavuyyar3yzsccjdgvu2bl2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c141d29c-ae51-2c08-c4e8-0000b2aad260","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://76yl7gfmz2kkjglcevxps4tleyeqnqhfcxh6rnstxj27oxhoxird3hyd.onion","pattern":"[url:value = 'http://76yl7gfmz2kkjglcevxps4tleyeqnqhfcxh6rnstxj27oxhoxird3hyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53542534-0e53-a8f6-ac06-000053e14dbb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion","pattern":"[url:value = 'http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db12eb4a-6345-00da-9f7d-0000c748160c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.scworld.com/brief/handala-hacking-group-asserts-attacks-against-israel","pattern":"[url:value = 'https://www.scworld.com/brief/handala-hacking-group-asserts-attacks-against-israel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a38f706c-052c-c24f-e6d9-0000e783900e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.splunk.com/blog/security/handalas-wiper-threat-analysis-and-detections.html","pattern":"[url:value = 'https://www.splunk.com/blog/security/handalas-wiper-threat-analysis-and-detections.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6cba464-0993-ffe7-109a-00007d754431","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/actor/handala","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/actor/handala']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b36b9dd-ed95-0954-e877-00008b9a638e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://threats.wiz.io/all-actors/handala","pattern":"[url:value = 'https://threats.wiz.io/all-actors/handala']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8429c3b8-ea21-a31c-601e-00009d5ef663","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/handala","pattern":"[url:value = 'https://www.ransomlook.io/group/handala']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad621013-d129-26f9-f899-000003684a0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://www.handala-team.to/","pattern":"[url:value = 'http://www.handala-team.to/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5dfd54f5-f25f-0578-3110-00005aa2e239","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://handala-hack.to","pattern":"[url:value = 'http://handala-hack.to']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1714c95c-1627-a82d-c155-000091322a17","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/money","pattern":"[url:value = 'https://www.ransomlook.io/group/money']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--296d37c5-3b9d-b45b-0515-0000c016acfd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z33ua54qzvzyxtbe5oghqyvxfs5orftqlws3w5ndrtsvmaldcvbyf5ad.onion/","pattern":"[url:value = 'http://z33ua54qzvzyxtbe5oghqyvxfs5orftqlws3w5ndrtsvmaldcvbyf5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--675c83b9-cb16-9adf-6d03-00004c8a5601","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://d26nwzgwylb3no3ar3rt3si3e3ujzndhp5wryxxlr76wba5snhap3tyd.onion/","pattern":"[url:value = 'http://d26nwzgwylb3no3ar3rt3si3e3ujzndhp5wryxxlr76wba5snhap3tyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--991cf1d8-3f13-7004-8a7a-00006e4aad0c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l4wvjhcng4klrah4gldyyvo3x5p5o4frzbvwdhzqa6vkg2chistqj3yd.onion/","pattern":"[url:value = 'http://l4wvjhcng4klrah4gldyyvo3x5p5o4frzbvwdhzqa6vkg2chistqj3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9a8091b-286a-497a-dd8c-0000edca9975","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://md7a4mzsppjuaw4zczoojpo7arqrlnmhlqoo35ttrc7l2lpeiblx2yqd.onion/","pattern":"[url:value = 'http://md7a4mzsppjuaw4zczoojpo7arqrlnmhlqoo35ttrc7l2lpeiblx2yqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca4670d0-d469-b324-c086-0000c97fed07","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pdndkkg2hu4z36yhrbgtycxf52iodlh5os4argm2ooia4ypwgnvlzgqd.onion/","pattern":"[url:value = 'http://pdndkkg2hu4z36yhrbgtycxf52iodlh5os4argm2ooia4ypwgnvlzgqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29c2c76a-3617-a1da-3395-000040e7e964","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xq5t7xwptmpoxzjkns7wfbbr43zxedm6ygbfsh6bp6lipvyhzkfopjyd.onion/","pattern":"[url:value = 'http://xq5t7xwptmpoxzjkns7wfbbr43zxedm6ygbfsh6bp6lipvyhzkfopjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f2a9860-bd13-15d3-5191-0000de8247d5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://client372kkzvqpgniqp6r5rqkg22yrlhstxiaxskeowp2hrperdelad.onion","pattern":"[url:value = 'http://client372kkzvqpgniqp6r5rqkg22yrlhstxiaxskeowp2hrperdelad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08f4ddd5-d61b-867d-eecf-0000f1723f2a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3w3uuz4vze6wdwxrebn3oaavft47xtvghl7qcmpqclgojr44muaigwyd.onion/","pattern":"[url:value = 'http://3w3uuz4vze6wdwxrebn3oaavft47xtvghl7qcmpqclgojr44muaigwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b718c58c-cd81-708a-52be-0000b9b81ca0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vkge4tbgo3kfc6n5lgjyvb7abjxp7wdnaumkh6xscyj4dceifieunkad.onion/","pattern":"[url:value = 'http://vkge4tbgo3kfc6n5lgjyvb7abjxp7wdnaumkh6xscyj4dceifieunkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f49d8869-2d58-eaa4-09fe-0000ce94484f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z46mj5ihckzwf2ons46ceryjwyxt3ctrqyglmre5uhnipvoepaciulid.onion/","pattern":"[url:value = 'http://z46mj5ihckzwf2ons46ceryjwyxt3ctrqyglmre5uhnipvoepaciulid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed431a30-e520-f8e8-48d7-00008fe54a22","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p6kxp556kkcbjdjsg24g3edmvr7v7ujecuychw4ibvqhl6wuomnrgbqd.onion/","pattern":"[url:value = 'http://p6kxp556kkcbjdjsg24g3edmvr7v7ujecuychw4ibvqhl6wuomnrgbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91bde0da-3616-0281-e814-00009fc6c904","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wzu6yixpcohxeeunakzqf42dothwikt3gvtovamxdm6rfl3oe6smywyd.onion/","pattern":"[url:value = 'http://wzu6yixpcohxeeunakzqf42dothwikt3gvtovamxdm6rfl3oe6smywyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cebf71c-ea78-4dfd-d773-00008d6f530c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://au6l74lej2qvwrvasdyc5ta4g7jdshjwkzbi635g6uztld2n2fcacyad.onion/","pattern":"[url:value = 'http://au6l74lej2qvwrvasdyc5ta4g7jdshjwkzbi635g6uztld2n2fcacyad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6e58162-d686-cbb2-fbe7-00004ddde5db","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://moze6ryu3ev65tgmssb4sckagkgfzmjtsxg2d6xrjjua2dke5lagcxqd.onion/","pattern":"[url:value = 'http://moze6ryu3ev65tgmssb4sckagkgfzmjtsxg2d6xrjjua2dke5lagcxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b07c7d7-0be9-fe37-72a8-0000666fb20a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://26kbddrpm2xfjg4unow76xyvrffwh4usqjhsqgalf4h3diiujy75ngqd.onion/","pattern":"[url:value = 'http://26kbddrpm2xfjg4unow76xyvrffwh4usqjhsqgalf4h3diiujy75ngqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39df4088-490e-ca94-0b37-0000fd458fef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://d2vda7sp7rxuizyduwvnvccs3giddkwgglj5ecgrmdpu32grp2txjeqd.onion/","pattern":"[url:value = 'http://d2vda7sp7rxuizyduwvnvccs3giddkwgglj5ecgrmdpu32grp2txjeqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2d52f71-3d8b-d1ec-7e42-000045e0594d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lhzaw2b2xn6lmtoioiswufyvjnrghlkmhtvwgsrsjnnmj2ceu56popqd.onion/","pattern":"[url:value = 'http://lhzaw2b2xn6lmtoioiswufyvjnrghlkmhtvwgsrsjnnmj2ceu56popqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cc02d79-e668-5928-464d-000014188eb2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jg7qeqdbqqordr5tazw5zc7s2h4sk2pt2hx4cxycqrcwr7vtpmreshad.onion/","pattern":"[url:value = 'http://jg7qeqdbqqordr5tazw5zc7s2h4sk2pt2hx4cxycqrcwr7vtpmreshad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b16ee01-95d0-99f2-e642-0000c19d44e1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vycmr2wn5nqhkpla62mqe4vxh4fgdbc5id4g6piy4mvbjnb4mp4t25yd.onion/","pattern":"[url:value = 'http://vycmr2wn5nqhkpla62mqe4vxh4fgdbc5id4g6piy4mvbjnb4mp4t25yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5940ade9-bdda-f6c7-c54a-00003f302dec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://372bkntomuk4xmevyki2gvpzdsm77xkhp4z6sctugcogqwgpqj4xkjyd.onion/","pattern":"[url:value = 'http://372bkntomuk4xmevyki2gvpzdsm77xkhp4z6sctugcogqwgpqj4xkjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c32cc45-7f26-f8ce-4ba2-00002dbfc30b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jioj2j5k53vrhtdgvjmeijgkdxgwadzjacywnybjvqftbkqpt3oy6cid.onion/","pattern":"[url:value = 'http://jioj2j5k53vrhtdgvjmeijgkdxgwadzjacywnybjvqftbkqpt3oy6cid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8a63d97-d573-51f4-c90d-00005977a510","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nhdmgcysxuvvmd4dqwqisxumirvcj6xfhahuds5z7qgj7qlr3i73nnqd.onion/","pattern":"[url:value = 'http://nhdmgcysxuvvmd4dqwqisxumirvcj6xfhahuds5z7qgj7qlr3i73nnqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67762f06-a956-1083-74e3-00005b81d51f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://742srdwxlwiu75kr3sbf6kzwjcxjwezvpi3s76ignhes3vqacvh3e4ad.onion/","pattern":"[url:value = 'http://742srdwxlwiu75kr3sbf6kzwjcxjwezvpi3s76ignhes3vqacvh3e4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e7cf24c-9b9a-eb81-1fe3-0000f2cf8fbc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bolfkdkjbdig64ieqixpyhmquuadkm6nzohutbkfwgzftd35kipy45ad.onion/","pattern":"[url:value = 'http://bolfkdkjbdig64ieqixpyhmquuadkm6nzohutbkfwgzftd35kipy45ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1157544-3f13-b800-4217-0000bc70092b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qyk5o7wcgocwebnymjusnc7siyetwl7po26flw4e6hhg2xiue7brvmid.onion/","pattern":"[url:value = 'http://qyk5o7wcgocwebnymjusnc7siyetwl7po26flw4e6hhg2xiue7brvmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41345f15-3c13-f738-4c5a-0000f20c915a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l7eupjzxzfbsw7nxu7wu7lj2lzr5ulmyuyd4neyasbdmvzcedal7mmid.onion/","pattern":"[url:value = 'http://l7eupjzxzfbsw7nxu7wu7lj2lzr5ulmyuyd4neyasbdmvzcedal7mmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87e4d8e4-4d5e-6b05-76c9-0000b41b5423","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6xkylzxoxpd6bnl5ymhr6hysaoe3bsxzxhxpydhv22fmnt6m5zrlpvad.onion/","pattern":"[url:value = 'http://6xkylzxoxpd6bnl5ymhr6hysaoe3bsxzxhxpydhv22fmnt6m5zrlpvad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d26fc706-f448-498b-e3a3-0000a94d048e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://clientcuworpelkdwecucgvfhp5uz5n7uohsnokndrlhm2zkntyg3had.onion/","pattern":"[url:value = 'http://clientcuworpelkdwecucgvfhp5uz5n7uohsnokndrlhm2zkntyg3had.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2724c34-e752-e018-f6ac-000035d31839","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://blogvl7tjyjvsfthobttze52w36wwiz34hrfcmorgvdzb6hikucb7aqd.onion","pattern":"[url:value = 'http://blogvl7tjyjvsfthobttze52w36wwiz34hrfcmorgvdzb6hikucb7aqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06b578d7-694b-9477-ce3d-0000205dd2e0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-donex-muse-and-darkrace-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-donex-muse-and-darkrace-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b87b583e-71f6-6e78-c566-00006f36f264","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/i/new-donex-ransomware-variant.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/i/new-donex-ransomware-variant.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c567bdf-c3d6-c349-7b4d-00003c606363","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.fortinet.com/blog/threat-research/ransomware-roundup-keganohitobito-and-donex","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/ransomware-roundup-keganohitobito-and-donex']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d039bbb-318d-5f3f-2cb7-000036c15659","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/donex","pattern":"[url:value = 'https://www.ransomlook.io/group/donex']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--131f43c8-b054-1dc8-c620-0000535bfaab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: Readme.ID.txt","pattern":"[domain-name:value = 'Readme.ID.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23c73bd3-b993-4721-ba8d-0000420b76cf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tox.chat/download.html\\n\\nTox","pattern":"[url:value = 'http://tox.chat/download.html\\\\n\\\\nTox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c4f9644-816b-90f2-cd8c-0000429d1103","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.torproject.org/\\n\\nWrite","pattern":"[url:value = 'https://www.torproject.org/\\\\n\\\\nWrite']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ddb9173-f113-24c6-441f-0000db9a238d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://g3h3klsev3eiofxhykmtenmdpi67wzmaixredk5pjuttbx7okcfkftqd.onion\\n\\n","pattern":"[url:value = 'http://g3h3klsev3eiofxhykmtenmdpi67wzmaixredk5pjuttbx7okcfkftqd.onion\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca489f44-1c56-0545-d0f7-00000d3b3f0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ransom","pattern":"[url:value = 'https://www.ransomlook.io/group/ransom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--706bef98-68ac-0d90-f917-000004f0fb65","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sewo2yliwvgca3abz565nsnnx3khi6x7t5ccpbvvg6wgce4bk2jagiad.onion/","pattern":"[url:value = 'http://sewo2yliwvgca3abz565nsnnx3khi6x7t5ccpbvvg6wgce4bk2jagiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e729e6c0-82a5-8374-093f-00002f4f1f0f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ransomed","pattern":"[url:value = 'https://www.ransomlook.io/group/ransomed']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12ab51a5-1399-2745-858d-0000c961cc42","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/22493-insane-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/22493-insane-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76304bac-d993-738e-8e1f-0000114047be","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://id-ransomware.blogspot.com/2021/11/insane-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2021/11/insane-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b18bbe2-c895-de92-dcc5-00004a4daece","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/insane","pattern":"[url:value = 'https://www.ransomlook.io/group/insane']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa7ffaea-820e-9a4c-dee6-00007eea75e8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r2ad4ayrgpf7og673lhrw5oqyvqg4em2fpialk7l7gxkasvqkqow4qad.onion/Insane.html","pattern":"[url:value = 'http://r2ad4ayrgpf7og673lhrw5oqyvqg4em2fpialk7l7gxkasvqkqow4qad.onion/Insane.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b42ea08-56f7-d416-a7e4-0000c6262ff7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r2ad4ayrgpf7og673lhrw5oqyvqg4em2fpialk7l7gxkasvqkqow4qad.onion/","pattern":"[url:value = 'http://r2ad4ayrgpf7og673lhrw5oqyvqg4em2fpialk7l7gxkasvqkqow4qad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb507b1f-a4b5-2002-5db2-000044ac50c1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nv5lbsrr4rxmewzmpe25nnalowe4ga7ki6yfvit3wlpu7dfc36pyh4ad.onion/Insane.html","pattern":"[url:value = 'http://nv5lbsrr4rxmewzmpe25nnalowe4ga7ki6yfvit3wlpu7dfc36pyh4ad.onion/Insane.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a315d077-e1f0-4c84-d536-0000492d1a2c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gfksiwpsqudibondm6o2ipxymaonehq3l26qpgqr3nh4jvcyayvogcid.onion/Insane.html","pattern":"[url:value = 'http://gfksiwpsqudibondm6o2ipxymaonehq3l26qpgqr3nh4jvcyayvogcid.onion/Insane.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45bb561c-5758-cff5-55ab-000051188f29","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gfksiwpsqudibondm6o2ipxymaonehq3l26qpgqr3nh4jvcyayvogcid.onion/","pattern":"[url:value = 'http://gfksiwpsqudibondm6o2ipxymaonehq3l26qpgqr3nh4jvcyayvogcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5762382b-17e8-6de4-c58a-0000744d5077","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nv5lbsrr4rxmewzmpe25nnalowe4ga7ki6yfvit3wlpu7dfc36pyh4ad.onion/","pattern":"[url:value = 'http://nv5lbsrr4rxmewzmpe25nnalowe4ga7ki6yfvit3wlpu7dfc36pyh4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e28d6df8-0016-bde2-3d31-00000cfb8d53","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zeon","pattern":"[url:value = 'https://www.ransomlook.io/group/zeon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bb28345-3287-b0b6-8f2e-0000b7e61326","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zeonrefpbompx6rwdqa5hxgtp2cxgfmoymlli3azoanisze33pp3x3yd.onion","pattern":"[url:value = 'http://zeonrefpbompx6rwdqa5hxgtp2cxgfmoymlli3azoanisze33pp3x3yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa180dd0-7967-7fc1-34f8-0000df3d962f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/labs/knight-ransomware-raas-targets-multiple-platforms/","pattern":"[url:value = 'https://www.sentinelone.com/labs/knight-ransomware-raas-targets-multiple-platforms/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6019cbe5-2a2f-c166-717a-0000173af1c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/h/knight-ransomware-raas.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/h/knight-ransomware-raas.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73de10da-0370-0f0d-08bd-00005fc118b9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/knight-ransomware-rebrands-from-cyclops-targets-windows-linux-esxi/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/knight-ransomware-rebrands-from-cyclops-targets-windows-linux-esxi/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c11356d4-4aab-ef87-016f-000016a9638f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/knight","pattern":"[url:value = 'https://www.ransomlook.io/group/knight']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8a56505-dc2b-79cd-19a5-00004c8b4f78","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://apem3txac4a74co33eceffd3yrfsufhebdzjc5zvjlie53wius2gbtyd.onion","pattern":"[url:value = 'http://apem3txac4a74co33eceffd3yrfsufhebdzjc5zvjlie53wius2gbtyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e5dc182-b2a4-bf7d-b6ac-0000d1fc4128","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vdyummkrwpjg5ufzefpsqlei5jgfulgci42fjraslavxeegsodei2tyd.onion","pattern":"[url:value = 'http://vdyummkrwpjg5ufzefpsqlei5jgfulgci42fjraslavxeegsodei2tyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec186c11-c626-c006-6b4e-000033b630f8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r6chas4skrvna72fg5ui3cqkke4fnpinsskvlo57aiolrrdb3r777mqd.onion","pattern":"[url:value = 'http://r6chas4skrvna72fg5ui3cqkke4fnpinsskvlo57aiolrrdb3r777mqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc7b13e8-7cf9-6ee6-d6ea-0000f5bf2d4c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uzfrntnmwojla5v4w3xvpxerjg43kuzqxmtspqhi5qclwtof5ibgonyd.onion","pattern":"[url:value = 'http://uzfrntnmwojla5v4w3xvpxerjg43kuzqxmtspqhi5qclwtof5ibgonyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1793e74e-2625-cbf3-290e-0000f64b42a6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3r7zqtidvujbmfhx52sb34u4vwkh66baefmqzlbqpcnwm3krzipy37yd.onion/","pattern":"[url:value = 'http://3r7zqtidvujbmfhx52sb34u4vwkh66baefmqzlbqpcnwm3krzipy37yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--889c1e16-d5f8-36d6-a10d-0000c1257a54","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion/","pattern":"[url:value = 'http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22237e6b-8a79-de81-508c-0000a32f4447","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/noname","pattern":"[url:value = 'https://www.ransomlook.io/group/noname']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3e4a7f5-e63f-31f1-7c1b-00000158f879","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6qubpgkb7vjd6upivya4ll2xvzkx6zdj5bfwfo7qqm4jd3cuv4nwg2id.onion","pattern":"[url:value = 'http://6qubpgkb7vjd6upivya4ll2xvzkx6zdj5bfwfo7qqm4jd3cuv4nwg2id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5656f426-55f5-009e-3ea5-00003a6eafd2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lockbitvyq2uedft666b4ezxfvneq36jagpov4shitftjcoro7pjlsqd.onion","pattern":"[url:value = 'http://lockbitvyq2uedft666b4ezxfvneq36jagpov4shitftjcoro7pjlsqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb427e7a-21ff-9753-6312-0000847edc27","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7tkffbh3qiumpfjfq77plcorjmfohmbj6nwq5je6herbpya6kmgoafid.onion/","pattern":"[url:value = 'http://7tkffbh3qiumpfjfq77plcorjmfohmbj6nwq5je6herbpya6kmgoafid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d4587bf-8e9c-8505-808c-00004800474d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.lockbitblog.info/","pattern":"[url:value = 'https://www.lockbitblog.info/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13b07182-434d-f96b-aeb9-0000eb827168","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cryptbb","pattern":"[url:value = 'https://www.ransomlook.io/group/cryptbb']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61328089-0f7c-ec28-e1eb-0000e9c6ac0b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion","pattern":"[url:value = 'http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b72d800b-b2ba-6776-941e-0000867f6ec6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/u-bomb","pattern":"[url:value = 'https://www.ransomlook.io/group/u-bomb']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d432737-ab26-3c75-279a-0000e04214d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.techtarget.com/searchsecurity/feature/The-mystery-of-the-75M-ransom-payment-to-Dark-Angels","pattern":"[url:value = 'https://www.techtarget.com/searchsecurity/feature/The-mystery-of-the-75M-ransom-payment-to-Dark-Angels']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41622f18-8c54-8b55-b827-000057e38f3e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dunghill-leak","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dunghill-leak']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ecbf4ed-1c8c-f473-6dcd-0000292a39c2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/dunghill","pattern":"[url:value = 'https://www.ransomlook.io/group/dunghill']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eaec79eb-fc78-2064-ca90-0000068016e9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zroxb37ghsh2xkwrkfkyz65jmuv6goaltcqxohk4syziahgjv5zou5qd.onion","pattern":"[url:value = 'http://zroxb37ghsh2xkwrkfkyz65jmuv6goaltcqxohk4syziahgjv5zou5qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--639c16d3-4a34-9f29-fa1e-00009e98a41c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sldltcn2d6mgtp66vgmvjptdtwgqyyewsjgwkzjybq3x55plzw4tefid.onion:3452","pattern":"[url:value = 'http://sldltcn2d6mgtp66vgmvjptdtwgqyyewsjgwkzjybq3x55plzw4tefid.onion:3452']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f0c765f-0780-24dc-bd5d-0000e345be77","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://r4znrcbthzjclilled5yyrjy35gagoyfwvekiqih7btzrchvqdmgviqd.onion","pattern":"[url:value = 'http://r4znrcbthzjclilled5yyrjy35gagoyfwvekiqih7btzrchvqdmgviqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b57fc6b-5f0b-157d-dc71-0000fdf20bd2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p242scyqdujesnozehk4ecfshk6i357cjywv3vzywrera3bndko4pgyd.onion","pattern":"[url:value = 'http://p242scyqdujesnozehk4ecfshk6i357cjywv3vzywrera3bndko4pgyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5bcc9d3-247c-709d-5a64-0000a3565dc2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://5kvv27efetbcqgem4tl7jsolvr3jxkrbmn23rcjzl7kvqycxuao3t4ad.onion/","pattern":"[url:value = 'https://5kvv27efetbcqgem4tl7jsolvr3jxkrbmn23rcjzl7kvqycxuao3t4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f851bc1d-7041-f2f6-5f4e-0000b494f5a3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nsalewdnfclsowcal6kn5csm4ryqmfpijznxwictukhrgvz2vbmjjjyd.onion/","pattern":"[url:value = 'http://nsalewdnfclsowcal6kn5csm4ryqmfpijznxwictukhrgvz2vbmjjjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6435298e-3eff-ce2c-ce92-00000d282888","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p66slxmtum2ox4jpayco6ai3qfehd5urgrs4oximjzklxcol264driqd.onion/index.html","pattern":"[url:value = 'http://p66slxmtum2ox4jpayco6ai3qfehd5urgrs4oximjzklxcol264driqd.onion/index.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55bdb9f3-1aec-7826-4fd0-0000c32352b2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/rancoz","pattern":"[url:value = 'https://www.ransomlook.io/group/rancoz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fecc9c1-3b74-8774-3c98-0000d79f7be2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion/","pattern":"[url:value = 'http://ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6db0c467-cfc1-57cd-72fa-0000dd1939a0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/jo","pattern":"[url:value = 'https://www.ransomlook.io/group/jo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b7e2f1d-7f96-1dda-52b1-000045291190","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jos666vxenlqp4xpnsxehovnaumi4c3q4bmvhpgdyz7bsk3ho3caokad.onion/","pattern":"[url:value = 'http://jos666vxenlqp4xpnsxehovnaumi4c3q4bmvhpgdyz7bsk3ho3caokad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ded36e89-4f05-436c-50e6-0000fe36a038","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/arcus-media","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/arcus-media']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bed0286c-44f3-9702-b27e-00006e350b2a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securitybuzz.com/cybersecurity-news/arcus-media-the-rising-ransomware-threat-redefining-modern-cybersecurity-defenses/","pattern":"[url:value = 'https://securitybuzz.com/cybersecurity-news/arcus-media-the-rising-ransomware-threat-redefining-modern-cybersecurity-defenses/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd129d03-a656-8662-b891-0000c1667e15","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://halcyon.ai/blog/emerging-threat-actor-arcus-media-ransomware","pattern":"[url:value = 'https://halcyon.ai/blog/emerging-threat-actor-arcus-media-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0da083f7-57d6-2bf7-4aca-000082854896","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://halcyon.ai/blog/arcus-media-ransomware-displays-novel-process-targeting-selective-encryption-and-recovery-disruption","pattern":"[url:value = 'https://halcyon.ai/blog/arcus-media-ransomware-displays-novel-process-targeting-selective-encryption-and-recovery-disruption']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d258c303-fd02-d1e8-ffcf-00007357a66e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/arcus","pattern":"[url:value = 'https://www.ransomlook.io/group/arcus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce5f1448-aeee-5149-0242-00005f850228","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/inc","pattern":"[url:value = 'https://www.ransomlook.io/group/inc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afe0ee66-7029-9e44-6eb4-0000d8dbce89","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion","pattern":"[url:value = 'http://incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c95264a-44cf-dfb4-94cb-0000cac0a94b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://incbackfgm7qa7sioq7r4tdunoaqsvzjg5i7w46bhqlfonwjgiemr7qd.onion","pattern":"[url:value = 'http://incbackfgm7qa7sioq7r4tdunoaqsvzjg5i7w46bhqlfonwjgiemr7qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e16f22c7-e03c-fa01-7f06-00001a29ff63","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://incbackend.top","pattern":"[url:value = 'http://incbackend.top']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e959127-2f46-4084-b5f4-0000214bc965","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion","pattern":"[url:value = 'http://incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c667257a-a3b5-2bf0-20dc-000096358cf2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion/","pattern":"[url:value = 'http://incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03f9a59f-61aa-537e-ed92-00001528b874","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/","pattern":"[url:value = 'http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09cd397b-c309-069e-ce60-00004783f1a1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://incapt.blog/","pattern":"[url:value = 'http://incapt.blog/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd36e989-aec8-187e-d2e6-00005a94b820","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion","pattern":"[url:value = 'http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11c9eaa6-f2bd-a2c4-bf29-00006faa051f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyberpress.org/ciphbit-ransomware-attack/","pattern":"[url:value = 'https://cyberpress.org/ciphbit-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ff7faec-ec51-ffe2-9715-00009904028d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.hookphish.com/blog/ransomware-group-ciphbit-hits-iptelecom-gmbh/","pattern":"[url:value = 'https://www.hookphish.com/blog/ransomware-group-ciphbit-hits-iptelecom-gmbh/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4542f1d-4025-58eb-d0ff-00009e92d8d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.pcrisk.com/removal-guides/27862-ciphbit-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/27862-ciphbit-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02318105-7e92-0b75-b25c-000081fb2e77","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/ciphbit","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/ciphbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed972d83-3c6e-e7df-ae47-00005944bc92","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ciphbit","pattern":"[url:value = 'https://www.ransomlook.io/group/ciphbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0da0858-ea92-cecc-1533-000038068ba4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ciphbitekvxj27jmtw5sncirfrhxrh4cw4a5qw7ef6o4vqfy4habxbyd.onion","pattern":"[url:value = 'http://ciphbitekvxj27jmtw5sncirfrhxrh4cw4a5qw7ef6o4vqfy4habxbyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d0599ea-daca-84ff-4418-000080ead559","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sonarmsng5vzwqezlvtu2iiwwdn3dxkhotftikhowpfjuzg7p3ca5eid.onion/contact/CiphBit","pattern":"[url:value = 'http://sonarmsng5vzwqezlvtu2iiwwdn3dxkhotftikhowpfjuzg7p3ca5eid.onion/contact/CiphBit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0930cb90-c2d4-ac44-e909-000007b2c37e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ciphbitqyg26jor7eeo6xieyq7reouctefrompp6ogvhqjba7uo4xdid.onion/","pattern":"[url:value = 'http://ciphbitqyg26jor7eeo6xieyq7reouctefrompp6ogvhqjba7uo4xdid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2440bb1f-db13-0f89-1ef0-000092e19724","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54a2d4f0-3545-d6cf-f508-00009c3ef4f5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://tripwire.com/state-of-security/cactus-ransomware-what-you-need-know","pattern":"[url:value = 'https://tripwire.com/state-of-security/cactus-ransomware-what-you-need-know']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f73ed6e8-50e1-3285-b4e8-00004584bb73","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.kroll.com/en/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection","pattern":"[url:value = 'https://www.kroll.com/en/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--458da728-5316-d06a-8fda-0000b0678700","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.barracuda.com/2024/03/20/who-is-behind-cactus-ransomware","pattern":"[url:value = 'https://blog.barracuda.com/2024/03/20/who-is-behind-cactus-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac0af941-a296-594d-8854-0000a085111f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/cactus-ransomware/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/cactus-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--459c0b84-9f64-f33d-6da2-00000807f013","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://thehackernews.com/2023/11/cactus-ransomware-exploits-qlik-sense.html","pattern":"[url:value = 'https://thehackernews.com/2023/11/cactus-ransomware-exploits-qlik-sense.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--829c24ec-69d7-2a9a-25fa-00005cdf5221","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securityscorecard.com/wp-content/uploads/2024/01/Whitepaper-Cactus-Ransomware.pdf","pattern":"[url:value = 'https://securityscorecard.com/wp-content/uploads/2024/01/Whitepaper-Cactus-Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d44074e-497d-6889-0a75-0000b082f6a7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://socradar.io/dark-web-profile-cactus-ransomware/","pattern":"[url:value = 'https://socradar.io/dark-web-profile-cactus-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92474e5e-9de6-2cb5-9e65-00001416f03e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection","pattern":"[url:value = 'https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfc5479a-5393-2d84-29ea-000050c497ca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cactus","pattern":"[url:value = 'https://www.ransomlook.io/group/cactus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f6d1034-ed59-b06d-e791-0000aed507d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://socradar.io/wp-content/uploads/2024/01/cactus-ransom-note.png.webp","pattern":"[url:value = 'https://socradar.io/wp-content/uploads/2024/01/cactus-ransom-note.png.webp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--304b3c88-773a-5eb6-7708-000089adee41","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://jvtxo5gdcgloguty322ynfnpqkc2whe2jauc7ucm7bzmgct3k7ogr4yd.onion/","pattern":"[url:value = 'https://jvtxo5gdcgloguty322ynfnpqkc2whe2jauc7ucm7bzmgct3k7ogr4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45b59bfc-4790-87bf-b25f-00006116db8d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://truysrv2txxvobngtlssbgqs3e3ekd53zl6zoxbotajyvmslp5rdxgid.onion","pattern":"[url:value = 'https://truysrv2txxvobngtlssbgqs3e3ekd53zl6zoxbotajyvmslp5rdxgid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a1bdc74-d093-103a-99e9-00000066c6f7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onion","pattern":"[url:value = 'https://6wuivqgrv2g7brcwhjw5co3vligiqowpumzkcyebku7i2busrvlxnzid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13db17b3-8b09-f263-5def-000027ec8a3e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://acfckf3l6l7v2tsnedfx222a4og63zt6dmvheqbvsd72hkhaqadrrsad.onion","pattern":"[url:value = 'https://acfckf3l6l7v2tsnedfx222a4og63zt6dmvheqbvsd72hkhaqadrrsad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f72464f9-295d-bdf0-8fa3-000073f14774","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://vhfd5qagh6j7qbisjqvly7eejqbv6z5bv77v6yuhctn77wmd3hjkyvad.onion","pattern":"[url:value = 'https://vhfd5qagh6j7qbisjqvly7eejqbv6z5bv77v6yuhctn77wmd3hjkyvad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a15435c9-996b-93a9-f8ee-0000a43fbf9b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/","pattern":"[url:value = 'https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9973fc09-a7df-4b73-0f75-00008aa2f08f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/qiulong","pattern":"[url:value = 'https://www.ransomlook.io/group/qiulong']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87dd8223-71e1-ffd2-ba2a-00003faae930","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://62brsjf2w77ihz5paods33cdgqnon54gjns5nmag3hmqv6fcwamtkmad.onion/","pattern":"[url:value = 'http://62brsjf2w77ihz5paods33cdgqnon54gjns5nmag3hmqv6fcwamtkmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbd16c3f-dccb-cbc1-6664-0000e3dd2151","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/trisec","pattern":"[url:value = 'https://www.ransomlook.io/group/trisec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caa46297-6136-29d5-add4-00008a5a85c5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pkk4gbz7lsbgeja6s6iwsan2ce364sqioici65swwt65uhicke65uyid.onion/victim.html","pattern":"[url:value = 'http://pkk4gbz7lsbgeja6s6iwsan2ce364sqioici65swwt65uhicke65uyid.onion/victim.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1991d34d-e3dd-d0ed-efb9-0000a1296e2a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5qmw6mv5ucbeskd3rv6vgn5dqgsuectmtqvz4paukmvhtlazzkuxuwqd.onion/victim.html","pattern":"[url:value = 'http://5qmw6mv5ucbeskd3rv6vgn5dqgsuectmtqvz4paukmvhtlazzkuxuwqd.onion/victim.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa85292d-a9ef-d0f0-28b5-00001d7778f3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5qmw6mv5ucbeskd3rv6vgn5dqgsuectmtqvz4paukmvhtlazzkuxuwqd.onion/","pattern":"[url:value = 'http://5qmw6mv5ucbeskd3rv6vgn5dqgsuectmtqvz4paukmvhtlazzkuxuwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85333b72-7c1a-8619-193b-00002061773b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pkk4gbz7lsbgeja6s6iwsan2ce364sqioici65swwt65uhicke65uyid.onion/","pattern":"[url:value = 'http://pkk4gbz7lsbgeja6s6iwsan2ce364sqioici65swwt65uhicke65uyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69eab127-bcbe-f4ca-f9fb-00007475813d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://orfc3joknhrzscdbuxajypgrvlcawtuagbj7f44ugbosuvavg3dc3zid.onion/","pattern":"[url:value = 'http://orfc3joknhrzscdbuxajypgrvlcawtuagbj7f44ugbosuvavg3dc3zid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5054aa01-8863-ab1a-f573-0000cd5aee47","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://orfc3joknhrzscdbuxajypgrvlcawtuagbj7f44ugbosuvavg3dc3zid.onion/victim.html#","pattern":"[url:value = 'http://orfc3joknhrzscdbuxajypgrvlcawtuagbj7f44ugbosuvavg3dc3zid.onion/victim.html#']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f40b689-71ce-6290-c99f-0000ded12d10","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ransomware","pattern":"[url:value = 'https://www.ransomlook.io/group/ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e81bb0c-cb91-67ac-fd58-000060e27801","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6i42qq2xdu244a3xp2c3gjvcwtp3hurbajesfnsuga2v3frf6x7ivcyd.onion/","pattern":"[url:value = 'http://6i42qq2xdu244a3xp2c3gjvcwtp3hurbajesfnsuga2v3frf6x7ivcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c5b5bd2-5248-d6a2-d1e5-0000df8da83f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a2e7085-8cb4-782e-49d1-0000e061e8f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://chuongdong.com/reverse%20engineering/2022/09/03/PLAYRansomware/","pattern":"[url:value = 'https://chuongdong.com/reverse%20engineering/2022/09/03/PLAYRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fb11e5a-b621-b053-1466-0000fd7a5292","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/play","pattern":"[url:value = 'https://www.ransomlook.io/group/play']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac9bb69e-6e9a-a61e-020e-0000d6b9930a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://75tkvxemb6zpyk3fbl3mwm32jklc2sdjacb3kazrioamopbfn2w2z5qd.onion/","pattern":"[url:value = 'http://75tkvxemb6zpyk3fbl3mwm32jklc2sdjacb3kazrioamopbfn2w2z5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5b8f4fb-dcf5-b253-8f5c-0000f88dc64d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wannafwvcfarw5dmjfqv4trxjtut7l4cguoirpennale6offik42a2qd.onion","pattern":"[url:value = 'http://wannafwvcfarw5dmjfqv4trxjtut7l4cguoirpennale6offik42a2qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2d35e6f-bfed-03ae-c898-00008c1f3ab5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://v5da6357wpzzqccy46ikdwe7zfeayh7kdfbhrpas4eli4w5qx44i4tqd.onion","pattern":"[url:value = 'http://v5da6357wpzzqccy46ikdwe7zfeayh7kdfbhrpas4eli4w5qx44i4tqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f91ea244-d0e7-e7f7-edd1-0000e5db8343","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://v3zgtoh5etfeuvhtgdpiejle4mzy7gdvoygildytlxwoay6qvrkixfad.onion","pattern":"[url:value = 'http://v3zgtoh5etfeuvhtgdpiejle4mzy7gdvoygildytlxwoay6qvrkixfad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e0e032b-e8bd-6a1f-43fd-00000cfb9245","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tahgzc6zcq4dxwsdfziwdaljmdbuqegpoh5sfng7xmux6psih3epa4yd.onion","pattern":"[url:value = 'http://tahgzc6zcq4dxwsdfziwdaljmdbuqegpoh5sfng7xmux6psih3epa4yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a597fc38-d6da-a990-09d4-0000086c5975","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sa5g7pzkbhkh3tthniumj7cz7ftdx7upengz4iq3mnwubiotrhn63had.onion","pattern":"[url:value = 'http://sa5g7pzkbhkh3tthniumj7cz7ftdx7upengz4iq3mnwubiotrhn63had.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--449f7eaa-f5c9-76c8-076f-0000f19547f1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://redchanpj427pbextcjriae5ottv4cka7cdrpghauzrwdwkobxdbpqid.onion","pattern":"[url:value = 'http://redchanpj427pbextcjriae5ottv4cka7cdrpghauzrwdwkobxdbpqid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3a86461-9a3a-387a-0039-000064ff6113","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qqtncwvlhyw6doanyykioeqit25jajjr7srelr75dgpn2bo3ovdsu3yd.onion","pattern":"[url:value = 'http://qqtncwvlhyw6doanyykioeqit25jajjr7srelr75dgpn2bo3ovdsu3yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94c15e3e-b74e-da81-9367-000012d80f5c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pastebitl7cxnftvpyczqh6e6kaeyfdl2sodgeckrsl4idkfp5mqgdid.onion","pattern":"[url:value = 'http://pastebitl7cxnftvpyczqh6e6kaeyfdl2sodgeckrsl4idkfp5mqgdid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6e1f9bb-6419-d106-e93f-00002f0edc93","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lolipornqyecnhtrddt54qhayeownl5g6i5yadmwpnmbpek5mo4ks2qd.onion","pattern":"[url:value = 'http://lolipornqyecnhtrddt54qhayeownl5g6i5yadmwpnmbpek5mo4ks2qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--789a7ea1-1c26-0db4-c33e-00008daa5ca3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lesg437bhmubeh4fas2mgmnllsfgj2mnxvbljv32myzmj2adfctuyaqd.onion","pattern":"[url:value = 'http://lesg437bhmubeh4fas2mgmnllsfgj2mnxvbljv32myzmj2adfctuyaqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5377bf6-a705-7d18-41cb-000031494f0b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gyv3gai4l5z5cecfqhnff54iq4ezkd7wbivxei4dobhty5jnbbtxecqd.onion","pattern":"[url:value = 'http://gyv3gai4l5z5cecfqhnff54iq4ezkd7wbivxei4dobhty5jnbbtxecqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0568d73f-1848-4913-9e95-000056515db4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://courierccomf4pnkbr2t2a5pvpwnbzc67fbnpt6ncbhyqj5opidhpqad.onion","pattern":"[url:value = 'http://courierccomf4pnkbr2t2a5pvpwnbzc67fbnpt6ncbhyqj5opidhpqad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63c42dcf-b3fc-1ff0-baeb-0000d2a6c8f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ceyt3r2mcygr5ep3gbjxasj2vjdcb3jxql4ywkjqz6jy3t37gvw7byqd.onion","pattern":"[url:value = 'http://ceyt3r2mcygr5ep3gbjxasj2vjdcb3jxql4ywkjqz6jy3t37gvw7byqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--289942f9-8bf9-7245-5951-000005ff0bbe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://btdigggok4d4pz6e3gdvj4ghdnmzhwctuff2jnh4gfanaqsd4omj3oqd.onion","pattern":"[url:value = 'http://btdigggok4d4pz6e3gdvj4ghdnmzhwctuff2jnh4gfanaqsd4omj3oqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c809f6a3-a8fc-8f6d-9441-0000147258c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6u4fttcz3utppij47uzvuwuh7twvf35c6j35zbjyaar3l5nuiqg5ocqd.onion","pattern":"[url:value = 'http://6u4fttcz3utppij47uzvuwuh7twvf35c6j35zbjyaar3l5nuiqg5ocqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3b0e5b6-4e0c-a2ff-21a8-0000ddcd738a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3fyivvhqricced46pa3xg7tzp3cr7zkca4ig7jbetcw7zs5ob7i46hid.onion","pattern":"[url:value = 'http://3fyivvhqricced46pa3xg7tzp3cr7zkca4ig7jbetcw7zs5ob7i46hid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47633fb1-6cf6-b4f6-290c-0000bc8fcb10","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2ebzdvjkfd5j6jjgm5cnxzk5v6c5pyaaylmzluy2h6v7esatqngswjid.onion","pattern":"[url:value = 'http://2ebzdvjkfd5j6jjgm5cnxzk5v6c5pyaaylmzluy2h6v7esatqngswjid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eea9b330-e1e4-db75-4232-0000b0ff46e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://22rob5wgz7e7fskszzxvsyv4kuoqen62cui4wwoyjtsp22y6oescfhid.onion","pattern":"[url:value = 'http://22rob5wgz7e7fskszzxvsyv4kuoqen62cui4wwoyjtsp22y6oescfhid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac798691-aa4b-e1b5-d286-00004ca76190","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion","pattern":"[url:value = 'http://whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7340cd4-c27d-3eaf-014c-0000f3f7634c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion","pattern":"[url:value = 'http://p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aca20236-c6dc-6229-36c4-0000de7e7c66","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion","pattern":"[url:value = 'http://b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b52806b0-1e15-e140-75ec-000052c7b477","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ysknyr5m5n3pwg4jnaqsytxea2thwsbca3qipi64vlep42flywx7dgqd.onion","pattern":"[url:value = 'http://ysknyr5m5n3pwg4jnaqsytxea2thwsbca3qipi64vlep42flywx7dgqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a490e87e-7dfe-6309-b248-0000ccb1eaf0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hbwsxlq3uzknabg2blt7d4mcbu24oriklji36zdqsz3ou3mf2d7bvoid.onion","pattern":"[url:value = 'http://hbwsxlq3uzknabg2blt7d4mcbu24oriklji36zdqsz3ou3mf2d7bvoid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17f0a23b-28dc-6f00-3ae2-0000fdc463bf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://doz7omlqqanryonvil4iuj65shzcv3efupqwubkza6553wnekrrd4uid.onion","pattern":"[url:value = 'http://doz7omlqqanryonvil4iuj65shzcv3efupqwubkza6553wnekrrd4uid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00bb3dc1-3df8-56de-bc2f-000052409b63","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6jb5avmh6rvcb7vcux7kaivnzpqcrfg4ui4xv2co5vmspgrwll7lkkyd.onion","pattern":"[url:value = 'http://6jb5avmh6rvcb7vcux7kaivnzpqcrfg4ui4xv2co5vmspgrwll7lkkyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5367c81a-eaea-211b-31f4-00003532cae6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://a4gbdvoorwn3tcqijoedvdeukqaqwc6t2kx4gh3gm37gv4p37evvzqad.onion","pattern":"[url:value = 'http://a4gbdvoorwn3tcqijoedvdeukqaqwc6t2kx4gh3gm37gv4p37evvzqad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a945d0ee-45f4-0557-5c3d-0000d084c8ad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4xo3cicwo2rhpwr6vkgwt7mqg4oiqihsmoxwlmklf4sjoatkdqjtmcyd.onion","pattern":"[url:value = 'http://4xo3cicwo2rhpwr6vkgwt7mqg4oiqihsmoxwlmklf4sjoatkdqjtmcyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7feb4840-8c66-79ff-b519-00008b9436ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://v3r6g4q3b2jpqusznecxexr5aqi42vy5ts6jy6fu3strecvb5c2woead.onion","pattern":"[url:value = 'http://v3r6g4q3b2jpqusznecxexr5aqi42vy5ts6jy6fu3strecvb5c2woead.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33d66fb9-009d-554c-f0cc-0000b32c808b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gpph6awu7hqsmzmr5sihusjoscp3itwtk3b4i2chwspmka2ikuqcwaqd.onion","pattern":"[url:value = 'http://gpph6awu7hqsmzmr5sihusjoscp3itwtk3b4i2chwspmka2ikuqcwaqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b59cdf1f-c161-85e1-48cb-00001c15a7e9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mokcrzbitq2gc5qcpxcbce43pawuthyaoazl6iz2xknj53ebyb4r4eid.onion","pattern":"[url:value = 'http://mokcrzbitq2gc5qcpxcbce43pawuthyaoazl6iz2xknj53ebyb4r4eid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04981df6-5a6c-9f27-02b1-000044873da2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://giix5r763sbxmu442tmwfb4thqbz4i5ppxcqsmnnlqnm2yiezv6epxqd.onion","pattern":"[url:value = 'http://giix5r763sbxmu442tmwfb4thqbz4i5ppxcqsmnnlqnm2yiezv6epxqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f049a1c-b343-f093-03ea-00006d89b9ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xixkhm6inbg6t5642t2pjafsjsh3eaonpjysdcfvr3zvadlqb6nhryad.onion","pattern":"[url:value = 'http://xixkhm6inbg6t5642t2pjafsjsh3eaonpjysdcfvr3zvadlqb6nhryad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4455a58a-667f-f39f-56d0-0000d0a5366b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iejj6bywviuecjwi3kxanzojqroe3j3phzgplvrdzcicimtcw6xgk3yd.onion","pattern":"[url:value = 'http://iejj6bywviuecjwi3kxanzojqroe3j3phzgplvrdzcicimtcw6xgk3yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bff664f6-61e2-7260-2368-00001070b3f9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kri3lez34pbqra3xs5wxo55djldtsekol6tuqdjqecqzga6dpnjqruyd.onion","pattern":"[url:value = 'http://kri3lez34pbqra3xs5wxo55djldtsekol6tuqdjqecqzga6dpnjqruyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da270e57-7bf2-4333-9335-0000a60ce5a4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z7u6dkys7b2aeibvklxga7mldzrepoauiuniqwfhdadkkwwgmv6bqhad.onion","pattern":"[url:value = 'http://z7u6dkys7b2aeibvklxga7mldzrepoauiuniqwfhdadkkwwgmv6bqhad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d09ae6f-5454-72a9-a032-0000fea5e01d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sm2gah7bjg6u2dfl3voiex6njh2kcuqqquvv7za37xokmbcivsgqcnad.onion","pattern":"[url:value = 'http://sm2gah7bjg6u2dfl3voiex6njh2kcuqqquvv7za37xokmbcivsgqcnad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86b3b55e-9285-c2ed-d51b-0000598efe59","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jnbiz5lp44ddg4u5rsr4yebbpxa3iytcsshgbqa4m6r6po5y57h6yxid.onion","pattern":"[url:value = 'http://jnbiz5lp44ddg4u5rsr4yebbpxa3iytcsshgbqa4m6r6po5y57h6yxid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fa5a12e-e814-bf99-e5d7-0000d705f4c4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onion","pattern":"[url:value = 'http://x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4be25ec8-ced7-704c-ecfa-000001f67193","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://slg7tnjb65swwyaebnyymyvo73xm36hxwugdsps7cwcxicizyzyt2byd.onion","pattern":"[url:value = 'http://slg7tnjb65swwyaebnyymyvo73xm36hxwugdsps7cwcxicizyzyt2byd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bd48b22-d665-30e3-6168-000096768066","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onion","pattern":"[url:value = 'http://eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--338eb8d1-a382-6b1e-9f42-00005e21900d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://37wb3ygyb3r2vf2dt5o3ca62zlduuowvkkwjrtbcgc5iri4t6rnzr7yd.onion","pattern":"[url:value = 'http://37wb3ygyb3r2vf2dt5o3ca62zlduuowvkkwjrtbcgc5iri4t6rnzr7yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a28cb7e0-3172-bf43-4bfb-0000121e62d8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zi34ocznt242jallttwvvhihrezjdzfgflf3uhdv6t3z23hhcn54efid.onion","pattern":"[url:value = 'http://zi34ocznt242jallttwvvhihrezjdzfgflf3uhdv6t3z23hhcn54efid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0e6fc2b-8d04-1107-496d-0000310e0593","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion","pattern":"[url:value = 'http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8385639-b25b-14a5-6ffe-00001b2fd915","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k7kg3jqzffsxe2z53jjx4goybvxu3a557kpsqakpwi6mrvfgcdo55tid.onion","pattern":"[url:value = 'http://k7kg3jqzffsxe2z53jjx4goybvxu3a557kpsqakpwi6mrvfgcdo55tid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99454e51-1b38-3afd-3f1f-0000f144d624","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/wiper","pattern":"[url:value = 'https://www.ransomlook.io/group/wiper']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d57bd43d-6101-0ed2-4fc9-0000fa469b17","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://discord.com/invite/jjZQdDNnG","pattern":"[url:value = 'https://discord.com/invite/jjZQdDNnG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc524ee6-54a7-9eeb-6e76-0000b286bb33","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/la","pattern":"[url:value = 'https://www.ransomlook.io/group/la']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56fd7a64-b712-192e-ccc4-0000ad7439d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://h3txev6jev7rcm6p2qkxn2vctybi4dvochr3inymzgif53n2j2oqviqd.onion/","pattern":"[url:value = 'http://h3txev6jev7rcm6p2qkxn2vctybi4dvochr3inymzgif53n2j2oqviqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5eb7738-e5ea-e8be-5940-000089a825a2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://et22fibzuzfyzgurm35sttm52qbzvdgzy5qhzy46a3gmkrrht3lec5ad.onion/","pattern":"[url:value = 'http://et22fibzuzfyzgurm35sttm52qbzvdgzy5qhzy46a3gmkrrht3lec5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b13cb4ec-bc98-301b-1b93-0000fb487be0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ransomhub","pattern":"[url:value = 'https://www.ransomlook.io/group/ransomhub']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b10dcc1-7d7d-b831-4a49-0000542123b5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rnc6scfbqslz5aqxfg5hrjel5qomxsclltc6jvhahi6qwt7op5qc7iad.onion","pattern":"[url:value = 'http://rnc6scfbqslz5aqxfg5hrjel5qomxsclltc6jvhahi6qwt7op5qc7iad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97255a2c-7d2d-7ef6-9e93-0000ce719b24","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ijbw7iiyodqzpg6ooewbgn6mv2pinoer3k5pzdecoejsw5nyoe73zvad.onion/blog","pattern":"[url:value = 'http://ijbw7iiyodqzpg6ooewbgn6mv2pinoer3k5pzdecoejsw5nyoe73zvad.onion/blog']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bacbbb7-7991-bfb8-8683-0000ec3635d0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sres5y2sze7lqkk5s4ahns5lhvc7nr5hqy5lchbxcvhaty2hnivdacqd.onion","pattern":"[url:value = 'http://sres5y2sze7lqkk5s4ahns5lhvc7nr5hqy5lchbxcvhaty2hnivdacqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1840309-6616-a1bb-4aeb-00003a5f6a7a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yvst24dvz66unqqes6se3p3flxyzbtohaz6faknu5ne3zzeq2jumpiid.onion","pattern":"[url:value = 'http://yvst24dvz66unqqes6se3p3flxyzbtohaz6faknu5ne3zzeq2jumpiid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b6e90f3-c43d-8e24-b5f2-000098bf4e29","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://y2hkrrb7aba2pgyvpfzqj3vlhbw7e2wj2t2wvtlmkr54yqz7p5ghnfid.onion/","pattern":"[url:value = 'http://y2hkrrb7aba2pgyvpfzqj3vlhbw7e2wj2t2wvtlmkr54yqz7p5ghnfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c786c1b8-ec06-a1e7-fd78-0000e9012adb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xznhtihjpaz3rwcgwqrv3jipbbivlg5ttsdqoet55xe5a3nbxi47jwqd.onion/","pattern":"[url:value = 'http://xznhtihjpaz3rwcgwqrv3jipbbivlg5ttsdqoet55xe5a3nbxi47jwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b64bd99f-65e6-21bd-d948-0000b3cd5c9b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://red46f427ed4ogc76gscsqrytpdh4gy5reh2g6dzjpbm24k3ns2t27qd.onion/","pattern":"[url:value = 'http://red46f427ed4ogc76gscsqrytpdh4gy5reh2g6dzjpbm24k3ns2t27qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44c66270-a0fe-c5e9-10bd-0000854b431a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ljxmkfr6kl3ovwgkxycdrvvdf6tk7qdhgowcjkpsiocg7j5uuhmszyyd.onion/","pattern":"[url:value = 'http://ljxmkfr6kl3ovwgkxycdrvvdf6tk7qdhgowcjkpsiocg7j5uuhmszyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76c5c762-1c8b-f29c-326a-0000d0902d20","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l5hzzorh57w4wp5va4ouye77x5f2apqd6rvvh3tb2a7vcenn6c5a2fad.onion/","pattern":"[url:value = 'http://l5hzzorh57w4wp5va4ouye77x5f2apqd6rvvh3tb2a7vcenn6c5a2fad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a3dc06a-1abd-b007-3e88-000022a4904d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kfvsqtlnfa5iiweywpubtqk4c2omc2vu4hvy26mhanaahtvpifzuxlid.onion/","pattern":"[url:value = 'http://kfvsqtlnfa5iiweywpubtqk4c2omc2vu4hvy26mhanaahtvpifzuxlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--743d80a4-9cab-9d24-aa74-000049ec643c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://i2agsvbyoy3viwel7ucjqtzcq3ocsj3jqqew5wlwpxty6uxd455qkoqd.onion/","pattern":"[url:value = 'http://i2agsvbyoy3viwel7ucjqtzcq3ocsj3jqqew5wlwpxty6uxd455qkoqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--120e5e11-5f5d-a2d7-7208-00002a12d126","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hjs27fuzq4j4gzshhbakt274eewxv2qdwmeugjx5eepwoaecczdkiiyd.onion/","pattern":"[url:value = 'http://hjs27fuzq4j4gzshhbakt274eewxv2qdwmeugjx5eepwoaecczdkiiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78e9acb7-06ed-c540-5349-0000ef03047a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gsqxzyynjegp73imth5p3ug4etgbehd3pb72e4zmiro4st3s2nlkmgyd.onion/","pattern":"[url:value = 'http://gsqxzyynjegp73imth5p3ug4etgbehd3pb72e4zmiro4st3s2nlkmgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d649e9b6-7e31-e99f-e0f8-0000b519764b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fmcrlb2t524cpiiqiudbvdjmgvaczix2o5y5uc3zvi57niiyl467qgyd.onion/","pattern":"[url:value = 'http://fmcrlb2t524cpiiqiudbvdjmgvaczix2o5y5uc3zvi57niiyl467qgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f32e569-bb2d-e7f7-81b6-000058aee3b7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bzfp6qfir7bfqjxnpgofwvfzoyca7kmcsfliot5zzfsas6oofwo7zoad.onion/","pattern":"[url:value = 'http://bzfp6qfir7bfqjxnpgofwvfzoyca7kmcsfliot5zzfsas6oofwo7zoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eee4cfb-b082-f5fd-65ab-000056991697","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://biurt7anlhkncf2t3dvvtlszpnnyg3oiksyapcikxostz6zfrh4csvid.onion/","pattern":"[url:value = 'http://biurt7anlhkncf2t3dvvtlszpnnyg3oiksyapcikxostz6zfrh4csvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3fbc773-752e-9cf3-c7ad-00000c15f909","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bd3atkmicmcif6mliquqdxltjq6mxvagw44gealayp34awtcx3ywlxid.onion/","pattern":"[url:value = 'http://bd3atkmicmcif6mliquqdxltjq6mxvagw44gealayp34awtcx3ywlxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c77f5071-726f-41fb-f062-0000db4476f7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3ysbtsnhldlijvfdv7hwkr2gl3op2d56puspeo4whs6p272sde6fq5id.onion/","pattern":"[url:value = 'http://3ysbtsnhldlijvfdv7hwkr2gl3op2d56puspeo4whs6p272sde6fq5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f4ce56c-f39a-647f-3897-0000e9d87d87","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://i4xita2momkw2jitqohbqgomjxqp53pyvgv5gbogvendbx3ucnynekyd.onion/","pattern":"[url:value = 'http://i4xita2momkw2jitqohbqgomjxqp53pyvgv5gbogvendbx3ucnynekyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69d11547-5a35-53d2-0cf9-000047c2dad4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yszafmehxkoa7hrcay7cnyogfrmjqc4grds6innadspii5oz6fneyzyd.onion/","pattern":"[url:value = 'http://yszafmehxkoa7hrcay7cnyogfrmjqc4grds6innadspii5oz6fneyzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--479ad5f3-32ff-1404-3a41-0000af61c360","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vhxbjx4iaeqgna22kqt5ajlqi72vbm6qcjev3efgr5oiklgptvjvjhqd.onion/","pattern":"[url:value = 'http://vhxbjx4iaeqgna22kqt5ajlqi72vbm6qcjev3efgr5oiklgptvjvjhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--058af9cf-7279-c557-087d-0000a696a41c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fvixrjsdk2adazfnz4mrdvr4eznm346fk33y7nos65bdrtmfvw7f5vid.onion/","pattern":"[url:value = 'http://fvixrjsdk2adazfnz4mrdvr4eznm346fk33y7nos65bdrtmfvw7f5vid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9290b06f-2344-545a-7291-0000a337f4dd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tjnt7x2xodhthwrfnabhloogoo66jrgohgzpta22uwbqznsvrm5tu4id.onion/","pattern":"[url:value = 'http://tjnt7x2xodhthwrfnabhloogoo66jrgohgzpta22uwbqznsvrm5tu4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--256abe4e-da4a-472f-04b9-00005953ee31","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://toq7bk6abkr6lapwj3k22ffu4ud5jpox7jbfgzetpz7lxb427katstid.onion","pattern":"[url:value = 'http://toq7bk6abkr6lapwj3k22ffu4ud5jpox7jbfgzetpz7lxb427katstid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6e187bd-98d5-bc02-250c-00009a3ff469","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xdg53hbpwshgtbfbm6m7nv3ckkduo3dfdwdearcsvybfb3qaf4v7suyd.onion","pattern":"[url:value = 'http://xdg53hbpwshgtbfbm6m7nv3ckkduo3dfdwdearcsvybfb3qaf4v7suyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20fb7307-46a2-81fc-673a-0000df4452aa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rmr2kgq6vzifnyoaz7jaxdx5t6gsxurbakah5bafatsqldtt2mwneyid.onion","pattern":"[url:value = 'http://rmr2kgq6vzifnyoaz7jaxdx5t6gsxurbakah5bafatsqldtt2mwneyid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ed682a5-4fa3-1eb5-daff-00004dc05703","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://brclvwefzszko5xrlan7pebyliqdkv5cw75xksrxp772urjytkko5fyd.onion","pattern":"[url:value = 'http://brclvwefzszko5xrlan7pebyliqdkv5cw75xksrxp772urjytkko5fyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c87f797-c482-9bba-9f6c-0000240b8a4e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://m52fl4estv4lmcvqhssh7mb7nsygiwe7oybhjhny7iuzrzwulq455eqd.onion","pattern":"[url:value = 'http://m52fl4estv4lmcvqhssh7mb7nsygiwe7oybhjhny7iuzrzwulq455eqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f7a8281-7e03-d6a1-a266-0000ade4569d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nr4jw2reeta2u4n2sq4sejjudllir4yfotzf5d4p3wn2ep6ddomtxxid.onion/","pattern":"[url:value = 'http://nr4jw2reeta2u4n2sq4sejjudllir4yfotzf5d4p3wn2ep6ddomtxxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e20f286e-2795-d1b0-b15b-00007bdd105d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://445ouvbxlevrxm7phyfr4au3ritat62zl7cwvrarvonrwmququordayd.onion","pattern":"[url:value = 'http://445ouvbxlevrxm7phyfr4au3ritat62zl7cwvrarvonrwmququordayd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--923b55fa-2f3a-2a84-d12a-00003ae2f30f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pod4gkypkd6kykwoht3kioehhpoh4k75ybdfoe6q7hqbphrd77b32jqd.onion/","pattern":"[url:value = 'http://pod4gkypkd6kykwoht3kioehhpoh4k75ybdfoe6q7hqbphrd77b32jqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bfbdb65-e862-6c75-28a8-0000f2c97b1e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cki3klxqycazagx3r5prae3nmfvxmwa34beknr3il4uf76vxd76akqid.onion/","pattern":"[url:value = 'http://cki3klxqycazagx3r5prae3nmfvxmwa34beknr3il4uf76vxd76akqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea7b6a0e-60e9-cf9c-6a53-0000a62d43d7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dd4djzr2ywfcox3zfvpkpyh3b657hsdwpwv5cfkmdfde2lr3fpz6spad.onion/","pattern":"[url:value = 'http://dd4djzr2ywfcox3zfvpkpyh3b657hsdwpwv5cfkmdfde2lr3fpz6spad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d14ba21-aa4d-7305-848f-0000c909fb5b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://davtdavm734bl4hkr3sr4dvfzpdzuzei2zrcor4vte4a3xuok2rxcmyd.onion/","pattern":"[url:value = 'http://davtdavm734bl4hkr3sr4dvfzpdzuzei2zrcor4vte4a3xuok2rxcmyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67ed72dc-7a08-d07d-3a26-0000b3570c2c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vqcrizmr7757hjbamfcb7pei2zv462o4ypi2djj4xvy5ax7f2b3c7bad.onion","pattern":"[url:value = 'http://vqcrizmr7757hjbamfcb7pei2zv462o4ypi2djj4xvy5ax7f2b3c7bad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45c7244e-8ffb-27cf-2b9d-00007a9a5394","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://shedjytnmsdgyey7ho7r52leod3plffhe3yjmhyxfxxivnunnmw7coid.onion/","pattern":"[url:value = 'http://shedjytnmsdgyey7ho7r52leod3plffhe3yjmhyxfxxivnunnmw7coid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee33c04e-2757-248a-6847-0000fa5853d2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ransomgxjnwmu5ceqwo2jrjssxpoicolmgismfpnslaixg3pgpe5qcad.onion/","pattern":"[url:value = 'http://ransomgxjnwmu5ceqwo2jrjssxpoicolmgismfpnslaixg3pgpe5qcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--590d7124-2224-4f03-d140-000083a79fc1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ransombgegc4e2vuq45noxekkmauikzt7qu6ab2rqsthdyxdpdufbqid.onion/","pattern":"[url:value = 'http://ransombgegc4e2vuq45noxekkmauikzt7qu6ab2rqsthdyxdpdufbqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1065672b-2a1d-e6ad-f983-0000d70a8408","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qa5qvqhtuzlyzrrgc7dkepyj34hb4psf6hk7jmiyn6cef7fxajdleoid.onion/","pattern":"[url:value = 'http://qa5qvqhtuzlyzrrgc7dkepyj34hb4psf6hk7jmiyn6cef7fxajdleoid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1d3dc87-ce4f-d873-f8c8-0000225b4117","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://crylcxzmkllsvq3qgh6gmeg3abqcyliepqza2r57o43gsfwomibq2cyd.onion/","pattern":"[url:value = 'http://crylcxzmkllsvq3qgh6gmeg3abqcyliepqza2r57o43gsfwomibq2cyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80ff4093-bfcb-9bd7-08c2-0000d658e30f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://7vy5mydtkf4hqo3g5s4v7skmyn2xdh4mxg3xgtcqnequuospqtsmutqd.onion/","pattern":"[url:value = 'https://7vy5mydtkf4hqo3g5s4v7skmyn2xdh4mxg3xgtcqnequuospqtsmutqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fec2591-6b75-3772-f66c-000049e8e9f2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xeuvs5poflczn5i5kbynb5rupmidb5zjuza6gaq22uqsdp3jvkjkciqd.onion/","pattern":"[url:value = 'http://xeuvs5poflczn5i5kbynb5rupmidb5zjuza6gaq22uqsdp3jvkjkciqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d9e27a9-e576-0ae4-80ba-0000efad2f3a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://an2ce4pqpf2ipvba2djurxi5pnxxhu3uo7ackul6eafcundqtly7bhid.onion","pattern":"[url:value = 'http://an2ce4pqpf2ipvba2djurxi5pnxxhu3uo7ackul6eafcundqtly7bhid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e2546d7-1ca7-cd5d-a180-000091975ab1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mjmru3yz65o5szsp4rmkmh4adlezcpy5tqjjc4y5z6lozk3nnz2da2ad.onion/","pattern":"[url:value = 'http://mjmru3yz65o5szsp4rmkmh4adlezcpy5tqjjc4y5z6lozk3nnz2da2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5965afb-4ebd-cc9f-12f3-000014df5ae5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/","pattern":"[url:value = 'http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8313d15c-b528-cd2b-d8d3-00008d4d2779","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.scworld.com/brief/dragonforce-victimization-on-the-rise-report-finds","pattern":"[url:value = 'https://www.scworld.com/brief/dragonforce-victimization-on-the-rise-report-finds']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--897a9b94-9007-cc5a-9390-00002c099ef8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ft.com/content/22cb54ef-1611-4aef-b671-16316280e3fb","pattern":"[url:value = 'https://www.ft.com/content/22cb54ef-1611-4aef-b671-16316280e3fb']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d48a4aa8-a051-809a-4b04-000024e68413","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.reuters.com/business/retail-consumer/ms-cyberattack-was-carried-out-by-dragonforce-chairman-says-2025-07-08/","pattern":"[url:value = 'https://www.reuters.com/business/retail-consumer/ms-cyberattack-was-carried-out-by-dragonforce-chairman-says-2025-07-08/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd6cf33f-1e4c-0eff-63e1-0000a0d478f3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.secureworks.com/blog/ransomware-groups-evolve-affiliate-models","pattern":"[url:value = 'https://www.secureworks.com/blog/ransomware-groups-evolve-affiliate-models']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46d2338f-24a7-2b39-05ba-000082a9cf9d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.barracuda.com/blog/dragonforce-ransomware-cartel-vs--everybody","pattern":"[url:value = 'https://www.barracuda.com/blog/dragonforce-ransomware-cartel-vs--everybody']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab3f601d-0478-1ae3-88c4-0000331333bc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/dragonforce-ransomware-gang-from-hacktivists-to-high-street-extortionists/","pattern":"[url:value = 'https://www.sentinelone.com/blog/dragonforce-ransomware-gang-from-hacktivists-to-high-street-extortionists/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bba2d922-b4cb-0d7f-bddb-0000a79d6b09","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/dragonforce","pattern":"[url:value = 'https://www.ransomlook.io/group/dragonforce']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d7720b6-6d28-06a9-a49a-00006e4007ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion\\n\\nSincerely","pattern":"[url:value = 'http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion\\\\n\\\\nSincerely']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71701ec5-38bc-3621-a09b-0000e7565f97","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.torproject.org/\\n\\n---","pattern":"[url:value = 'https://www.torproject.org/\\\\n\\\\n---']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e821d315-b9cd-6e0a-6173-000008e7a25f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion\\n\\t","pattern":"[url:value = 'http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion\\\\n\\\\t']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c3c073c-5b21-daa7-d776-0000b929b396","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dragongo.org","pattern":"[url:value = 'http://dragongo.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96a7f641-09db-6dc4-4e65-00008f7ad2bf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dragongoztkdfmnd7jkchznd3fvkpdmeh4vhbt6p3usrlsoy5dw2bhyd.onion/","pattern":"[url:value = 'http://dragongoztkdfmnd7jkchznd3fvkpdmeh4vhbt6p3usrlsoy5dw2bhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92caa2c4-56b6-4326-a215-000085508e65","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fsguestuctexqqaoxuahuydfa6ovxuhtng66pgyr5gqcrsi7qgchpkad.onion/","pattern":"[url:value = 'http://fsguestuctexqqaoxuahuydfa6ovxuhtng66pgyr5gqcrsi7qgchpkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9993e96f-3f19-d7b3-41c1-000051474371","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dszmdx3jr7vggdaf2c5k4qunt4mxclelhgbtjlgewlkmlnfpsnsg3sad.onion/","pattern":"[url:value = 'http://dszmdx3jr7vggdaf2c5k4qunt4mxclelhgbtjlgewlkmlnfpsnsg3sad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a49b733e-8fba-cc6d-28f0-0000b94ced69","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nwtetzmrqhxieetg5lvth7szzvg35gfrqt23ly46vku56oo7pkueswyd.onion/","pattern":"[url:value = 'http://nwtetzmrqhxieetg5lvth7szzvg35gfrqt23ly46vku56oo7pkueswyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--216ada46-72cd-4865-bd44-000056d1112e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://73h3lxn24kuayyfkn4t6ij7e67jklo24vqzqdhpts3ygmim7hu6u6aid.onion/","pattern":"[url:value = 'http://73h3lxn24kuayyfkn4t6ij7e67jklo24vqzqdhpts3ygmim7hu6u6aid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--545728f6-eb98-49de-4aaf-0000ed6d2065","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4wcrfql53ljekid3sn66z6swjot725muveddq77utxltaelw64eikfid.onion/","pattern":"[url:value = 'http://4wcrfql53ljekid3sn66z6swjot725muveddq77utxltaelw64eikfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d038bd5f-b258-06f6-5e3e-0000eaff4498","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xtcwd3xmxpggtizn7kmwwqeizexflkkyqsytg2kauccau6ddsfa4gfyd.onion/","pattern":"[url:value = 'http://xtcwd3xmxpggtizn7kmwwqeizexflkkyqsytg2kauccau6ddsfa4gfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f90071e4-4d7e-98ee-f666-00006cb9759c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dbvczza7nhwdb5kdvkzjtkrcvwnrt5viw7mihutueprvajy7rxhwq6id.onion/","pattern":"[url:value = 'http://dbvczza7nhwdb5kdvkzjtkrcvwnrt5viw7mihutueprvajy7rxhwq6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8229ff2-0681-aadd-4def-0000618f35e9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bpoowhokr3vi32l3t4mjdtdxfrfpigwachopk5ojwmgxihnojhsawuyd.onion/","pattern":"[url:value = 'http://bpoowhokr3vi32l3t4mjdtdxfrfpigwachopk5ojwmgxihnojhsawuyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62ed4d26-5d54-ab7c-ccba-000053dad013","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2yczff6zyiey3gkgl5anwejktdp73abxbzbnvwobmrwkwgf3hudpyvyd.onion/","pattern":"[url:value = 'http://2yczff6zyiey3gkgl5anwejktdp73abxbzbnvwobmrwkwgf3hudpyvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b27d6309-a399-3d20-e1fb-00009bc34b76","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jziu7k7uee467r2wt66ndrwymmw7tsmqgcqi7aemcaxraqmaf2hdm3yd.onion/","pattern":"[url:value = 'http://jziu7k7uee467r2wt66ndrwymmw7tsmqgcqi7aemcaxraqmaf2hdm3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50c6ae6c-dd63-0a07-2466-0000f7388158","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3ro23rujyigqrlrwk3e4keh3a3i6ntgrm3f42tbiqtf7vke47c6a6ayd.onion/","pattern":"[url:value = 'http://3ro23rujyigqrlrwk3e4keh3a3i6ntgrm3f42tbiqtf7vke47c6a6ayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55d1342b-28c8-a505-c5c1-00008a90fd4f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ewrxgpvv7wsrqq7itfwg5jr7lkc6zzknndmru5su2ugrowxo3wwy5yad.onion/","pattern":"[url:value = 'http://ewrxgpvv7wsrqq7itfwg5jr7lkc6zzknndmru5su2ugrowxo3wwy5yad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--031af228-bb1a-a928-b2a7-000019c028b0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://eogeko3sdn66gb7vjpwpmlmmmzfx7umtwaugpf5l6tb5jveolfydnuad.onion/","pattern":"[url:value = 'http://eogeko3sdn66gb7vjpwpmlmmmzfx7umtwaugpf5l6tb5jveolfydnuad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09be5581-a604-d39d-e718-0000ff94038a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6dgi54prfmpuuolutr4hl3akasxbx4o34g5y2bj4blrvzzkjemhxenad.onion/","pattern":"[url:value = 'http://6dgi54prfmpuuolutr4hl3akasxbx4o34g5y2bj4blrvzzkjemhxenad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2085a617-8de3-d0c2-b5eb-000088909cbb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zsglo7t7osxyk3vcl7zxzup7hs4ir52sntteymmw63zvoxzcqytlw7qd.onion/","pattern":"[url:value = 'http://zsglo7t7osxyk3vcl7zxzup7hs4ir52sntteymmw63zvoxzcqytlw7qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2187aec-536b-875e-8235-000092326582","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion","pattern":"[url:value = 'http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c0b657c-fc1f-0f77-46eb-000026c5928c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion/login","pattern":"[url:value = 'http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71f438ea-33f1-996f-2278-0000fd4c9a57","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.quorumcyber.com/malware-reports/knight-ransomware-report/","pattern":"[url:value = 'https://www.quorumcyber.com/malware-reports/knight-ransomware-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46f568f9-2b95-e079-6939-00002e90ea8b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cloudsek.com/ar/blog/understanding-knight-ransomware-advisory-analysis","pattern":"[url:value = 'https://cloudsek.com/ar/blog/understanding-knight-ransomware-advisory-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daac95c7-01e7-4864-b798-0000b3c0542d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://wwwMicrosoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom%3AWin64%2FKnight.ZB!MTB","pattern":"[url:value = 'https://wwwMicrosoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom%3AWin64%2FKnight.ZB!MTB']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9550050d-ac51-5a0e-2d09-0000eab273d9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.kelacyber.com/blog/cyclops-ransomware-gang-unveils-knight-raas/","pattern":"[url:value = 'https://www.kelacyber.com/blog/cyclops-ransomware-gang-unveils-knight-raas/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9b196f8-7ace-62b8-b371-0000d4dcc9a9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/knight/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/knight/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bdffaf5-e25d-c028-ad72-0000bf4632ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cyclops","pattern":"[url:value = 'https://www.ransomlook.io/group/cyclops']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dce4b0aa-6871-c0f4-1648-0000633b151d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wy35mxvqxff4vufq64v4rrahxltn6ry33hjoogydwti6wbqutjaxrvid.onion/clients/chat/","pattern":"[url:value = 'http://wy35mxvqxff4vufq64v4rrahxltn6ry33hjoogydwti6wbqutjaxrvid.onion/clients/chat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1b28d68-7d75-7ec5-8d5e-000019f0eb61","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onion/","pattern":"[url:value = 'http://nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdd9ebe7-1c46-760a-5f0b-00001a5ec361","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://rewterz.com/rewterz-threat-alert-crosslock-ransomware-active-iocs","pattern":"[url:value = 'https://rewterz.com/rewterz-threat-alert-crosslock-ransomware-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4314df71-3c97-9cc5-2403-0000bd3f4a27","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyble.com/blog/crosslock-ransomware-emerges-new-golang-based-malware-on-the-horizon","pattern":"[url:value = 'https://cyble.com/blog/crosslock-ransomware-emerges-new-golang-based-malware-on-the-horizon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--004eae67-3917-f780-7aba-0000180e65fb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.netskope.com/blog/netskope-threat-coverage-crosslock-ransomware","pattern":"[url:value = 'https://www.netskope.com/blog/netskope-threat-coverage-crosslock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16ea99b4-1e26-bc61-f9e2-0000d67d2941","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/crosslock/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/crosslock/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91dae61a-fbe4-8eaf-aa91-00008be50c39","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/crosslock","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/crosslock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2363d9b2-1642-297b-b178-0000b6ed2147","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/crosslock","pattern":"[url:value = 'https://www.ransomlook.io/group/crosslock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95bf36a0-6eba-3536-1f97-0000ffcc2733","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://crosslock5cwfljbw4v37zuzq4talxxhyavjm2lufmjwgbpfjdsh56yd.onion/","pattern":"[url:value = 'http://crosslock5cwfljbw4v37zuzq4talxxhyavjm2lufmjwgbpfjdsh56yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7acfe560-bac5-cf06-776a-00009473567c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://darkreading.com/threat-intelligence/3am-ransomware-adopts-email-bombing-vishing","pattern":"[url:value = 'https://darkreading.com/threat-intelligence/3am-ransomware-adopts-email-bombing-vishing']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30d7b0ca-b4ef-1400-1bac-0000943cbfc7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://sos-vo.org/index.php/news/cybersecurity-snapshots-3am-ransomware","pattern":"[url:value = 'https://sos-vo.org/index.php/news/cybersecurity-snapshots-3am-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ef73af0-766e-6f53-d2da-000047c28fa6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://quorumcyber.com/malware-reports/3am-ransomware-report/","pattern":"[url:value = 'https://quorumcyber.com/malware-reports/3am-ransomware-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--494da9a1-3e2e-6e7b-6b6b-00005b64483d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://news.sophos.com/en-us/2025/05/20/a-familiar-playbook-with-a-twist-3am-ransomware-actors-dropped-virtual-machine-with-vishing-and-quick-assist/","pattern":"[url:value = 'https://news.sophos.com/en-us/2025/05/20/a-familiar-playbook-with-a-twist-3am-ransomware-actors-dropped-virtual-machine-with-vishing-and-quick-assist/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b617d864-0446-ae2f-4a26-0000719aec34","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://tripwire.com/state-of-security/3am-ransomware-what-you-need-know","pattern":"[url:value = 'https://tripwire.com/state-of-security/3am-ransomware-what-you-need-know']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e17c156-a271-f063-f4ed-0000cd7574ea","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://security.com/threat-intelligence/3am-ransomware-lockbit","pattern":"[url:value = 'https://security.com/threat-intelligence/3am-ransomware-lockbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf548ee6-a9a3-1cc9-bb76-0000901fc95b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/3am","pattern":"[url:value = 'https://www.ransomlook.io/group/3am']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df57e93d-c2a0-cf57-6ec4-0000a276bf40","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad.onion/api/show-more","pattern":"[url:value = 'http://threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad.onion/api/show-more']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48a6f6db-ba2a-0862-1129-000008f9dfd1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://threeam7fj33rv5twe5ll7gcrp3kkyyt6ez5stssixnuwh4v3csxdwqd.onion/","pattern":"[url:value = 'http://threeam7fj33rv5twe5ll7gcrp3kkyyt6ez5stssixnuwh4v3csxdwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--276c5cae-22d8-e1a0-1664-0000759a0ac8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ulkvlj5sirgrbnvb4hvbjo2ex2c2ceqe2j4my57fcdozpbq5h5pyu7id.onion","pattern":"[url:value = 'http://ulkvlj5sirgrbnvb4hvbjo2ex2c2ceqe2j4my57fcdozpbq5h5pyu7id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c278ce2-1aa0-fb1e-20fc-00006c2c23c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad.onion","pattern":"[url:value = 'http://threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05d866ff-82dd-5f58-508d-0000f141e781","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/team","pattern":"[url:value = 'https://www.ransomlook.io/group/team']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1671584f-ba29-2f3c-9c6e-0000dad019b3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2nyysjgsfhnwizvbhjeklagbdbjz2z27meao7asl73zcqpb5cr4n4eyd.onion","pattern":"[url:value = 'http://2nyysjgsfhnwizvbhjeklagbdbjz2z27meao7asl73zcqpb5cr4n4eyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae860984-b5db-8d0c-43a6-0000c7536b00","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion/","pattern":"[url:value = 'http://47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dca499e1-a165-7468-95c8-00002d6ea947","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onion/auth/login","pattern":"[url:value = 'http://ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onion/auth/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae880d7f-015d-aff6-e514-0000fd161f32","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.tesorion.nl/en/posts/lorenz-ransomware-rebound-corruption-and-irrecoverable-files/","pattern":"[url:value = 'https://www.tesorion.nl/en/posts/lorenz-ransomware-rebound-corruption-and-irrecoverable-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba9ce023-fd7d-8ef2-85c0-000069ba912e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.tesorion.nl/en/posts/lorenz-ransomware-analysis-and-a-free-decryptor/","pattern":"[url:value = 'https://www.tesorion.nl/en/posts/lorenz-ransomware-analysis-and-a-free-decryptor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb7576d9-a360-c772-1c8e-00002f241069","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cybereason.com/blog/cybereason-vs.-lorenz-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/cybereason-vs.-lorenz-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a804cc1-51d2-42af-11f1-0000d56f3aca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/meet-lorenz-a-new-ransomware-gang-targeting-the-enterprise/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/meet-lorenz-a-new-ransomware-gang-targeting-the-enterprise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e286685-c9ca-8aa5-cd85-0000159af880","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://twitter.com/AltShiftPrtScn/status/1423190900516302860?s=20","pattern":"[url:value = 'https://twitter.com/AltShiftPrtScn/status/1423190900516302860?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6fe3fa9-eed4-edcc-a51c-00002004d6a0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://therecord.media/free-decrypter-available-for-lorenz-ransomware/","pattern":"[url:value = 'https://therecord.media/free-decrypter-available-for-lorenz-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfe5db3a-c35e-3c4f-d20a-00006f262f04","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cybertalk.org/the-worst-outcomes-lorenz-ransomware-a-new-double-extortion-strategy","pattern":"[url:value = 'https://www.cybertalk.org/the-worst-outcomes-lorenz-ransomware-a-new-double-extortion-strategy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85ae2898-6d94-d370-1e9d-00006b458c26","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.zdnet.com/article/lorenz-ransomware-attack-victims-can-now-retrieve-their-files-for-free-with-this-decryption-tool","pattern":"[url:value = 'https://www.zdnet.com/article/lorenz-ransomware-attack-victims-can-now-retrieve-their-files-for-free-with-this-decryption-tool']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d408c1ad-a221-2c0c-191a-0000f9ece574","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lorenz","pattern":"[url:value = 'https://www.ransomlook.io/group/lorenz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae4298b9-faaa-904f-2bde-00001fb3a031","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lorenzezzwvtk3y24wfph4jpho27grrctqvf6yvld7256rnoz7yg2eid.onion/","pattern":"[url:value = 'http://lorenzezzwvtk3y24wfph4jpho27grrctqvf6yvld7256rnoz7yg2eid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--776e786a-07c7-fb85-5a9f-0000fcdab48e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lorenzedzyzyjhzxvlcv347n5piltxamo755pzqpozh5l47kj7mxueid.onion/","pattern":"[url:value = 'http://lorenzedzyzyjhzxvlcv347n5piltxamo755pzqpozh5l47kj7mxueid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8a9cca1-174c-382c-76dd-0000e489f10f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://woe2suafeg6ehxivgvvn4nh6ectbdhdqgc4vzph27mmyn7rjf2c52jid.onion","pattern":"[url:value = 'http://woe2suafeg6ehxivgvvn4nh6ectbdhdqgc4vzph27mmyn7rjf2c52jid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59a55b82-e089-7af8-7287-0000e93459e1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/slug","pattern":"[url:value = 'https://www.ransomlook.io/group/slug']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08137139-185c-c8d3-2d4d-00006d5692d0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ra","pattern":"[url:value = 'https://www.ransomlook.io/group/ra']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad11a85e-95bb-9f8b-001b-00009e3a50aa","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://raworlddecssyq43oim3hxhc5oxvlbaxuj73xbz2pbbowso3l4kn27qd.onion/","pattern":"[url:value = 'http://raworlddecssyq43oim3hxhc5oxvlbaxuj73xbz2pbbowso3l4kn27qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb12574e-cd41-41f0-0cde-000088315f74","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hkpomcx622gnqp2qhenv4ceyrhwvld3zwogr4mnkdeudq2txf55keoad.onion","pattern":"[url:value = 'http://hkpomcx622gnqp2qhenv4ceyrhwvld3zwogr4mnkdeudq2txf55keoad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07f61b49-8576-0ba0-7406-000076d56f55","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/malek","pattern":"[url:value = 'https://www.ransomlook.io/group/malek']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b66c1f9f-7368-5af5-671b-00008b679938","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://195.14.123.2/","pattern":"[url:value = 'http://195.14.123.2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0e53fca-c7d9-8de5-7e55-0000e0f06a03","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mogilevich","pattern":"[url:value = 'https://www.ransomlook.io/group/mogilevich']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ecbe939-8224-f62a-24af-00005cc6c852","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dkgn45pinr7nwvdaehemcrpgcjqf4fooit3c4gjw6dhzrp443ctvnoad.onion","pattern":"[url:value = 'http://dkgn45pinr7nwvdaehemcrpgcjqf4fooit3c4gjw6dhzrp443ctvnoad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d1dffa7-4459-e034-b6a4-0000d8639f7d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://zerophagemalware.com/2017/10/13/rig-ek-via-malvertising-drops-a-miner/","pattern":"[url:value = 'https://zerophagemalware.com/2017/10/13/rig-ek-via-malvertising-drops-a-miner/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ed332d9-24a5-6895-7157-000084849c50","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.arbornetworks.com/blog/asert/medusahttp-ddos-slithers-back-spotlight/","pattern":"[url:value = 'https://www.arbornetworks.com/blog/asert/medusahttp-ddos-slithers-back-spotlight/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbb81d6a-f7d2-0c6f-cdfd-00008be05c31","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf","pattern":"[url:value = 'https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e8fb6e8-c6f6-f7db-927e-00009c1f5307","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://news.drweb.com/show/?i=10302&lng=en","pattern":"[url:value = 'https://news.drweb.com/show/?i=10302&lng=en']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0acc6f65-2fd2-536e-3777-0000caddb59c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html","pattern":"[url:value = 'https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebca0acd-8dd3-023b-3216-0000ec5f8372","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.threatfabric.com/blogs/partners-in-crime-medusa-cabassous.html","pattern":"[url:value = 'https://www.threatfabric.com/blogs/partners-in-crime-medusa-cabassous.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e57c2c17-699e-fb14-3734-00008d9da607","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://twitter.com/ThreatFabric/status/1285144962695340032","pattern":"[url:value = 'https://twitter.com/ThreatFabric/status/1285144962695340032']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49b9046a-cb70-2e58-3481-000067e7c53d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/medusa","pattern":"[url:value = 'https://www.ransomlook.io/group/medusa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b8a6ac3-6d83-1d2d-c85e-0000f5e0848f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x4tqo27mrr5q5wobpuvw6rowmbclwe5h62etslydc6wnona73pmqwaid.onion","pattern":"[url:value = 'http://x4tqo27mrr5q5wobpuvw6rowmbclwe5h62etslydc6wnona73pmqwaid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1005afa-1789-6a8d-804d-00000c710687","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://762a33bcwneu3i6m7g4unj7xoyvl3nolnbeqhm4jfap6d7uczj43mrqd.onion","pattern":"[url:value = 'http://762a33bcwneu3i6m7g4unj7xoyvl3nolnbeqhm4jfap6d7uczj43mrqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22a17cef-e167-9d21-f331-000074937795","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onion/","pattern":"[url:value = 'http://7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a18c8281-7eb8-f21d-34fa-0000f93a017a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hm2hlugduzuxiya5bgrsewfxmrzxbmslvg3t42zdzsorcn2nyfbrh6qd.onion/","pattern":"[url:value = 'http://hm2hlugduzuxiya5bgrsewfxmrzxbmslvg3t42zdzsorcn2nyfbrh6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fde0ed1-880e-02b3-1efa-000087d5c8ab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://medusakxxtp3uo7vusntvubnytaph4d3amxivbgg13hnhpk2nmus34yd.onion/227098164ef1fdb119ef537986bbdf24","pattern":"[url:value = 'http://medusakxxtp3uo7vusntvubnytaph4d3amxivbgg13hnhpk2nmus34yd.onion/227098164ef1fdb119ef537986bbdf24']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77c7ecb0-b747-bb3b-c016-0000c6e3503a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/","pattern":"[url:value = 'http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96bd4eec-1803-49f2-34c8-00008fa4c146","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/","pattern":"[url:value = 'http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a85c350-4560-3c17-79e4-0000e5cf9816","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://osintcorp.net","pattern":"[url:value = 'http://osintcorp.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7b7e0e2-e298-6fe0-0c5b-0000556b9464","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion/","pattern":"[url:value = 'http://62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dab81e69-871f-264a-e121-0000a28bb1ba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion/","pattern":"[url:value = 'http://kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b71c1b90-b41f-a845-28a3-0000b4526a3c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion/","pattern":"[url:value = 'http://dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b06c7249-e4bf-2c25-6df5-0000d230c556","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/shadow","pattern":"[url:value = 'https://www.ransomlook.io/group/shadow']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89b91b82-5b00-3cf6-5b6d-00000d4c4a7b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/space","pattern":"[url:value = 'https://www.ransomlook.io/group/space']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d736e0c-ca9d-79a4-39c9-0000cf1eda28","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/","pattern":"[url:value = 'http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70f6461b-7b47-66f8-8469-000016f8b6e5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/malas","pattern":"[url:value = 'https://www.ransomlook.io/group/malas']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8b1c2ba-9a18-4ccc-f61f-000079150806","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://malas2urovbyyavjzaezkt5ohljvyd5lt7vv7mnsgbf2y4bwlh72doqd.onion/posts/","pattern":"[url:value = 'http://malas2urovbyyavjzaezkt5ohljvyd5lt7vv7mnsgbf2y4bwlh72doqd.onion/posts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39287941-1ea9-abff-4009-00004e66c825","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/trigona","pattern":"[url:value = 'https://www.ransomlook.io/group/trigona']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--971e8ff7-9a4c-773d-3567-000002e9998b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://znuzuy4hkjacew5y2q7mo63hufhzzjtsr2bkjetxqjibk4ctfl7jghyd.onion","pattern":"[url:value = 'http://znuzuy4hkjacew5y2q7mo63hufhzzjtsr2bkjetxqjibk4ctfl7jghyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b946f89d-5d24-827b-9c8e-00004267e1a4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://aeey7hxzgl6zowiwhteo5xjbf6sb36tkbn5hptykgmbsjrbiygv4c4id.onion/","pattern":"[url:value = 'http://aeey7hxzgl6zowiwhteo5xjbf6sb36tkbn5hptykgmbsjrbiygv4c4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35afbe35-2b70-f77e-bb21-0000eaf95faf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://znjkde7j35jed5qqz3sfiv56v6hyfkbluke5ypi2su5vhx2nruswjcad.onion/","pattern":"[url:value = 'http://znjkde7j35jed5qqz3sfiv56v6hyfkbluke5ypi2su5vhx2nruswjcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82ddaade-9093-13e8-28d2-0000dfeba71c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zp6la4xdki3irsenq3t7z7pu2nnaktqgob6aizlzjkdiyw6azjeuhzqd.onion","pattern":"[url:value = 'http://zp6la4xdki3irsenq3t7z7pu2nnaktqgob6aizlzjkdiyw6azjeuhzqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d5718e4-049e-ede7-9e4b-00002d8961c1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onion/api","pattern":"[url:value = 'http://krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onion/api']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6cf91fe-f6f2-0a83-f751-000028ad7fa8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onion/api","pattern":"[url:value = 'http://trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onion/api']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a443efb-67e0-41c3-d683-00007d934771","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/paraguay-warns-of-black-hunt-ransomware-attacks-after-tigo-business-breach/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/paraguay-warns-of-black-hunt-ransomware-attacks-after-tigo-business-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53c84fff-b2dc-7c19-2344-0000a8b06858","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://threats.wiz.io/all-tools/c3rb3r-ransomware","pattern":"[url:value = 'https://threats.wiz.io/all-tools/c3rb3r-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f37639a-c50b-adba-bad6-0000f29fe56c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/c3rb3r-ransomware-ongoing-exploitation-of-cve-2023-22518-targets-unpatched-confluence-servers/","pattern":"[url:value = 'https://www.sentinelone.com/blog/c3rb3r-ransomware-ongoing-exploitation-of-cve-2023-22518-targets-unpatched-confluence-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc3cec1c-34d7-abbd-8865-00003ceedf01","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/c3rb3r","pattern":"[url:value = 'https://www.ransomlook.io/group/c3rb3r']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfe5367c-5daf-2eaa-e13b-0000f0e153a7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c3rb3rnow2alp26exjwlrs7puvftcxqywmpqedlierashbqikyxgg3qd.onion","pattern":"[url:value = 'http://c3rb3rnow2alp26exjwlrs7puvftcxqywmpqedlierashbqikyxgg3qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79450f8c-f334-e45e-894e-00009d770ee3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad.onion/","pattern":"[url:value = 'http://j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca7c85df-1579-5f9d-5244-00006de46670","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_dk/research/23/h/an-overview-of-the-new-rhysida-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_dk/research/23/h/an-overview-of-the-new-rhysida-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebc61b08-2f73-827e-f8d6-00002154b8e2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.hhs.gov/sites/default/files/rhysida-ransomware-sector-alert-tlpclear.pdf","pattern":"[url:value = 'https://www.hhs.gov/sites/default/files/rhysida-ransomware-sector-alert-tlpclear.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b94caef4-cf15-55ce-1d51-0000095502c7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/rhysida","pattern":"[url:value = 'https://www.ransomlook.io/group/rhysida']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c60040ef-73ce-d1a5-ab5a-0000a6b19df0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onion","pattern":"[url:value = 'http://rhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76c00baf-67b5-c3ce-632d-00005ec244fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rhysidaiqemmlrvn2jvncdwhkvuiv7s2iu342xnrpeynxoe6r2dtjfyd.onion","pattern":"[url:value = 'http://rhysidaiqemmlrvn2jvncdwhkvuiv7s2iu342xnrpeynxoe6r2dtjfyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b03cc9c-a08e-a594-3012-0000fe39cdf9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onion","pattern":"[url:value = 'http://rhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28bd7be4-6bb6-5b37-e1ac-0000238652f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/","pattern":"[url:value = 'http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b767b681-68fe-7ed6-8024-000075c8c96b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php","pattern":"[url:value = 'http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02d2306a-27a0-2bb0-bee7-000006ad8e51","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/","pattern":"[url:value = 'http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72823125-5b74-9975-e79c-00000f1b2469","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/losttrust","pattern":"[url:value = 'https://www.ransomlook.io/group/losttrust']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1ee32f2-1717-5557-1c91-0000e8f479cf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hscr6cjzhgoybibuzn2xud7u4crehuoo4ykw3swut7m7irde74hdfzyd.onion/","pattern":"[url:value = 'http://hscr6cjzhgoybibuzn2xud7u4crehuoo4ykw3swut7m7irde74hdfzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2477d279-67f9-68a0-914a-0000d2395557","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.zscaler.com/blogs/security-research/technical-analysis-cryptnet-ransomware","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/technical-analysis-cryptnet-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0946776-978b-e0ee-68c5-000079d4fbb1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cryptnet","pattern":"[url:value = 'https://www.ransomlook.io/group/cryptnet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab7a4702-6b9a-a5ed-9818-0000f81ad08b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cryptr3fmuv4di5uiczofjuypopr63x2gltlsvhur2ump4ebru2xd3yd.onion","pattern":"[url:value = 'http://cryptr3fmuv4di5uiczofjuypopr63x2gltlsvhur2ump4ebru2xd3yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--550a8163-7753-020c-1b90-00007caa7096","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://socradar.io/dark-web-profile-abyss-ransomware","pattern":"[url:value = 'https://socradar.io/dark-web-profile-abyss-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95608cd1-e7a2-2ae1-e4a6-0000a2b9ac23","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/abyss-locker","pattern":"[url:value = 'https://www.sentinelone.com/anthology/abyss-locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1783325c-5c82-d63d-7ea2-000008111486","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.fortinet.com/blog/threat-research/ransomware-roundup-abyss-locker","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/ransomware-roundup-abyss-locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9ee2123-3918-b814-ef0c-000005506732","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blackpointcyber.com/wp-content/uploads/2024/12/Abyss.pdf","pattern":"[url:value = 'https://blackpointcyber.com/wp-content/uploads/2024/12/Abyss.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a35689d2-5ac6-dc98-357b-000012327390","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/abyss-data","pattern":"[url:value = 'https://www.ransomlook.io/group/abyss-data']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1c2c99e-759d-c85f-a9f4-00006ca91f0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jdr3i5np2nyfaa3jut2wnbymrb7dceunpi63no4gvcvr7wrwbqff2wid.onion/","pattern":"[url:value = 'http://jdr3i5np2nyfaa3jut2wnbymrb7dceunpi63no4gvcvr7wrwbqff2wid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97f2c0f0-2922-e9d2-34f0-0000d9fb7297","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://co57gakeanqglrzvpyt2lltalirl3y522hyjxah3aqv4pidlzwdhzwid.onion/","pattern":"[url:value = 'http://co57gakeanqglrzvpyt2lltalirl3y522hyjxah3aqv4pidlzwdhzwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b3da6de-a8d9-7e5d-476e-0000d3540ab1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gzpjpapbvqcom6yrjnijfyzspfb7oyqt5xni4uxapwfsddw4n4v5wqyd.onion/","pattern":"[url:value = 'http://gzpjpapbvqcom6yrjnijfyzspfb7oyqt5xni4uxapwfsddw4n4v5wqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e2af827-3ed0-76a5-6fb8-0000ceaab7c6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l7f3ny5yedcm7zhgxzy34mihk6jvgwg7m6qj3cqw4nvky7xv5wttegyd.onion/","pattern":"[url:value = 'http://l7f3ny5yedcm7zhgxzy34mihk6jvgwg7m6qj3cqw4nvky7xv5wttegyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcdbf98e-b1ef-1918-a905-0000cba22230","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ah73jnvhuoznb4n3srbtspsgrdyyde2xszywcjryjroz4wixhwmdrjad.onion/","pattern":"[url:value = 'http://ah73jnvhuoznb4n3srbtspsgrdyyde2xszywcjryjroz4wixhwmdrjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d40b154-0d0b-2495-0385-000014c11dd6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vnsggttwhcofyeh3nxoynxtg5mk5xl4cd7e3c4x62aqb2rj4rfjh3eqd.onion/","pattern":"[url:value = 'http://vnsggttwhcofyeh3nxoynxtg5mk5xl4cd7e3c4x62aqb2rj4rfjh3eqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48b73d6e-50e5-3c55-f1b6-000089d2cd5d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://euujzkwziy777bg4oyiks2x3s5cxlydao6jhpilzdjmjohja3s4v7jid.onion/","pattern":"[url:value = 'http://euujzkwziy777bg4oyiks2x3s5cxlydao6jhpilzdjmjohja3s4v7jid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef0ddd18-5438-345a-672f-0000ac647066","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://toczr6bmtfbgardwgcgbeqntumkxi3y2tsfbcstybf6xknd6cm6e32ad.onion/","pattern":"[url:value = 'http://toczr6bmtfbgardwgcgbeqntumkxi3y2tsfbcstybf6xknd6cm6e32ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7da5993-4e68-847d-252d-0000065c9e67","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7lpodmzejui2scqfojx3voadc7fgrt2igww6ipjtnztfg6hprnmel5yd.onion/","pattern":"[url:value = 'http://7lpodmzejui2scqfojx3voadc7fgrt2igww6ipjtnztfg6hprnmel5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca679a7d-9317-3984-8f1c-0000f027280c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://y7fupmz3lx64ilnyvxbu73xigzdtc6fl2aee2duuf546duoo4nurv2id.onion/","pattern":"[url:value = 'http://y7fupmz3lx64ilnyvxbu73xigzdtc6fl2aee2duuf546duoo4nurv2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6feb21bd-f0dc-8a1e-7a67-000082b70691","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tycacxbqdhohowofueufbnekscyomymoxbr4wlim5cqpfv72z6popcid.onion/","pattern":"[url:value = 'http://tycacxbqdhohowofueufbnekscyomymoxbr4wlim5cqpfv72z6popcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10dd7f79-3d84-a784-c2a6-0000ff93dd31","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://46vfmzfh3uxc3ojn6z267jmiytfhxzq4x7vvnqtycu5wa6hh3jl2hjyd.onion/","pattern":"[url:value = 'http://46vfmzfh3uxc3ojn6z267jmiytfhxzq4x7vvnqtycu5wa6hh3jl2hjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce928919-960e-2657-d7af-000013c10cf5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yehbrr7tnzrcpcq2fglrf73ug2jqhgngxnyv3clyhrswdwmg45p7fyad.onion","pattern":"[url:value = 'http://yehbrr7tnzrcpcq2fglrf73ug2jqhgngxnyv3clyhrswdwmg45p7fyad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f854466-b630-fe5d-fd33-0000b1eb0fed","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bgifgvekggqjfqx6x45e24vq7nm6in54rk36fo6jg4qf3yvy6lfisgid.onion/","pattern":"[url:value = 'http://bgifgvekggqjfqx6x45e24vq7nm6in54rk36fo6jg4qf3yvy6lfisgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c69e244-01c0-a8ae-837e-0000dbc3286c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jqlcrn2fsfvxlngdq53rqyrwtwfrulup74xyle54bsvo3l2kgpeeijid.onion/","pattern":"[url:value = 'http://jqlcrn2fsfvxlngdq53rqyrwtwfrulup74xyle54bsvo3l2kgpeeijid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70fc4a3e-19e9-6c9e-9686-0000641e94fc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://s5v5hvtk3oyxg3m6afgxeuwlasqku3adeosv7kwwjfvhf22vqiwotrqd.onion/","pattern":"[url:value = 'http://s5v5hvtk3oyxg3m6afgxeuwlasqku3adeosv7kwwjfvhf22vqiwotrqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1d6f7b5-8b10-0559-349c-000003ae791f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ub63kcmphxbm3m64wwhuznbxfap4hlgqtauhnf4rvz23cdnrqr4towid.onion/","pattern":"[url:value = 'http://ub63kcmphxbm3m64wwhuznbxfap4hlgqtauhnf4rvz23cdnrqr4towid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e52bd04-9e5a-fb50-43b0-000027710dc1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zngbsq66uwem4qzyxpqb5rjo2xebnbwdku27nhmquryx6ljnbbedhiad.onion/","pattern":"[url:value = 'http://zngbsq66uwem4qzyxpqb5rjo2xebnbwdku27nhmquryx6ljnbbedhiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab2b8d5-a487-131c-c7ba-00007647441f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yuhflx7yjk52jedcrtb3ne235mmykqfwc6jarby7lxxgv26ep7x4qjqd.onion/","pattern":"[url:value = 'http://yuhflx7yjk52jedcrtb3ne235mmykqfwc6jarby7lxxgv26ep7x4qjqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d34ab77-3f6c-f7b6-7904-0000c98faae1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ieelfdk3qr6as2u5cx3kfo57pdu6s77lis3lafg5lx5ljqf2izial6ad.onion/","pattern":"[url:value = 'http://ieelfdk3qr6as2u5cx3kfo57pdu6s77lis3lafg5lx5ljqf2izial6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ac17bf9-e197-ff17-84cf-00006ecb5f80","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gvzbeu532wwxqze3v3xcxpsbhpvwusnajzahi55dqklbunzgjp5wchad.onion/","pattern":"[url:value = 'http://gvzbeu532wwxqze3v3xcxpsbhpvwusnajzahi55dqklbunzgjp5wchad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81a80441-28c1-84ba-14a8-0000394f4c06","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wpefgvpyuszr4vg444qed734big233itylqclte7usszbdbfyqvb2lqd.onion/","pattern":"[url:value = 'http://wpefgvpyuszr4vg444qed734big233itylqclte7usszbdbfyqvb2lqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf5c1020-5c7e-9e4e-88ca-0000e4240c7f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2fzahjlleflpcyecd245xe3q6tczjkwzcm4fbhd4q4bsun45y2csyayd.onion/","pattern":"[url:value = 'http://2fzahjlleflpcyecd245xe3q6tczjkwzcm4fbhd4q4bsun45y2csyayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5a2e994-5e6d-2012-d81c-0000b908df06","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cfev2mvlqooohl3af2upkgu3ju4qcgqrrgh6sprfxkgh3qldh2ykxzyd.onion/","pattern":"[url:value = 'http://cfev2mvlqooohl3af2upkgu3ju4qcgqrrgh6sprfxkgh3qldh2ykxzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5be0d72d-1acb-d8d7-e9b6-0000aa9021e6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vmmefm7ktazj2bwtmy46o3wxhk42tctasyyqv6ymuzlivszteyhkkyad.onion/","pattern":"[url:value = 'http://vmmefm7ktazj2bwtmy46o3wxhk42tctasyyqv6ymuzlivszteyhkkyad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae09f52e-96cb-a0ed-518e-0000d6b283b6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://udugclljnfcx34amtpddkjggmkfqci5xnlfef2hqtxstufulo3pvauid.onion/","pattern":"[url:value = 'http://udugclljnfcx34amtpddkjggmkfqci5xnlfef2hqtxstufulo3pvauid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2caecc7d-2dac-71df-2ccb-0000fe7ea82c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jtt4lqatjtrj5hxxi33dczkluouf5wivzdmy4v62dnhipk6ixk5mktad.onion/","pattern":"[url:value = 'http://jtt4lqatjtrj5hxxi33dczkluouf5wivzdmy4v62dnhipk6ixk5mktad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b78bfb47-3fc5-ac44-c6ba-00000c81bc82","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mflnjnwfinorxxsgkyfel3fqanbtbbrl5k5mqqjwmrf7o3jc6a4hy3id.onion/","pattern":"[url:value = 'http://mflnjnwfinorxxsgkyfel3fqanbtbbrl5k5mqqjwmrf7o3jc6a4hy3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82d9d1f5-9acc-a1ec-a6a3-000020556a39","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nka6xgyyu77ksb5xmmovp4en2hrkg53mfq2osql526oe7nybnlggfgid.onion/","pattern":"[url:value = 'http://nka6xgyyu77ksb5xmmovp4en2hrkg53mfq2osql526oe7nybnlggfgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d941b25-6f73-eec6-c839-000094a45d5f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4nsmlpz4qceow7bfrmarxdqaj7chcqobin3mzb27uhscb2yvjs6j4xqd.onion/","pattern":"[url:value = 'http://4nsmlpz4qceow7bfrmarxdqaj7chcqobin3mzb27uhscb2yvjs6j4xqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed3264fb-ac94-a816-7274-000084a12651","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kceqbaoxmx2czutxty3mq35m5mv46dq66hpszrhbhduj7uwhu6ax3qad.onion/","pattern":"[url:value = 'http://kceqbaoxmx2czutxty3mq35m5mv46dq66hpszrhbhduj7uwhu6ax3qad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c4030ca-1717-6248-699c-0000c1d42127","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://frheu6drsqpehmuyrdxdrfu5bzqwxps4zlmnuxlcnxskwxcwqsyhwxyd.onion/","pattern":"[url:value = 'http://frheu6drsqpehmuyrdxdrfu5bzqwxps4zlmnuxlcnxskwxcwqsyhwxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72843a73-bd61-cd47-f813-00006dbd0a95","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wflff64dxxqvfhd7poarkvkphmibdjyyhv7h4zqo5m52ggsgncmbrbqd.onion/","pattern":"[url:value = 'http://wflff64dxxqvfhd7poarkvkphmibdjyyhv7h4zqo5m52ggsgncmbrbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f3cb607-3e5c-3fa7-f3ce-00006cc9269d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2ikvareyuw2wjnc4vb5yteq7d2tkg6k3gevnixzqtkn3cpvej6ajj4yd.onion/","pattern":"[url:value = 'http://2ikvareyuw2wjnc4vb5yteq7d2tkg6k3gevnixzqtkn3cpvej6ajj4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea1fd684-7c6d-094f-2ce5-000048209974","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kn4spxunete4ddz7375i2wpnj4vvkir7wdmcg2pc5yod56lmb54nbayd.onion/","pattern":"[url:value = 'http://kn4spxunete4ddz7375i2wpnj4vvkir7wdmcg2pc5yod56lmb54nbayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c8b65cf-4255-4706-49fa-00000c6551c5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3pb6cefz6hubgyb2ph7ua7yjzjpxwapbbp5zomz7xmvrjhjfykjwu6id.onion/","pattern":"[url:value = 'http://3pb6cefz6hubgyb2ph7ua7yjzjpxwapbbp5zomz7xmvrjhjfykjwu6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--813c0ed8-451a-9924-e2de-0000c60070ae","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wyz32kscr2ythqpyjwqfxcaxn5576fdurr7jag44gggnmi4cvhykhvid.onion/","pattern":"[url:value = 'http://wyz32kscr2ythqpyjwqfxcaxn5576fdurr7jag44gggnmi4cvhykhvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e413f12-3c5d-c25b-e522-0000b2d169c4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cuft7z2xlfogrtx4ddqnjqyerye2qtagksow2fip4xbb5iw7dsgtvhqd.onion/","pattern":"[url:value = 'http://cuft7z2xlfogrtx4ddqnjqyerye2qtagksow2fip4xbb5iw7dsgtvhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a64e812f-5fbf-d4c4-0d74-0000749b8148","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2j45tydxcvm44jbyr6krhx77rzey3jtif5qdjak2gik4usoljvvhqaid.onion/","pattern":"[url:value = 'http://2j45tydxcvm44jbyr6krhx77rzey3jtif5qdjak2gik4usoljvvhqaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c047d6c2-4d8f-517e-6ead-00005987b1ea","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l3yeoyhnphtymqua5env7qitedmqv5ahe7waxgndwa64z2c2h3cjjhqd.onion/","pattern":"[url:value = 'http://l3yeoyhnphtymqua5env7qitedmqv5ahe7waxgndwa64z2c2h3cjjhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5643a60a-3c6f-650e-5636-0000ee69cb6b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wka7ma7rzgmzmtn65dhv5zp5p6e3uv5sydnns7xsf6kpf7noukhchhqd.onion/","pattern":"[url:value = 'http://wka7ma7rzgmzmtn65dhv5zp5p6e3uv5sydnns7xsf6kpf7noukhchhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--305af00b-ec9f-5e87-9838-00006721f328","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2mhkqjcw4auxop7auchz2iijcbj63qccwodtokofbb2ul5oejkkt6xyd.onion/","pattern":"[url:value = 'http://2mhkqjcw4auxop7auchz2iijcbj63qccwodtokofbb2ul5oejkkt6xyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c131ee9-1d7c-c40f-f1e6-000002bad09c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jtjz6utbmabwcatyomwxaeum7ey7nxs7yooqflxhctnksjqsnammonqd.onion/","pattern":"[url:value = 'http://jtjz6utbmabwcatyomwxaeum7ey7nxs7yooqflxhctnksjqsnammonqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2872126a-f9a9-0a86-0a3b-000077c96bb3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gmxnejtsg3uiwopmnsooxbi3p2nukwemkvm7bg44tgbbnuuuyofqjfyd.onion/","pattern":"[url:value = 'http://gmxnejtsg3uiwopmnsooxbi3p2nukwemkvm7bg44tgbbnuuuyofqjfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--495f109b-3afb-5f36-c92a-0000b4264cc2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://t7ogwvu74a6flssns55yv7zw2xvssqbhrdbxqrwbahumyzwklnvqayid.onion/","pattern":"[url:value = 'http://t7ogwvu74a6flssns55yv7zw2xvssqbhrdbxqrwbahumyzwklnvqayid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--973042bd-54f5-fd55-584d-0000dd663551","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ufvi7hpcawesdklmommeeq4iokhq2km4hay3dwh4rirth5xaomle35id.onion/","pattern":"[url:value = 'http://ufvi7hpcawesdklmommeeq4iokhq2km4hay3dwh4rirth5xaomle35id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24ba08d1-a191-9e2f-a8b3-00009b50ca17","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion","pattern":"[url:value = 'http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ad344ff-e7d6-1791-66a5-0000c1217856","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/raznatovic","pattern":"[url:value = 'https://www.ransomlook.io/group/raznatovic']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e874e961-ecfe-3957-4db2-000065b719d1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://ransomed.vc/market.html","pattern":"[url:value = 'https://ransomed.vc/market.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c568cebd-cf95-34fd-7930-00002fe03b82","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://f6amq3izzsgtna4vw24rpyhy3ofwazlgex2zqdssavevvkklmtudxjad.onion/","pattern":"[url:value = 'http://f6amq3izzsgtna4vw24rpyhy3ofwazlgex2zqdssavevvkklmtudxjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af4be6fd-d3be-54ac-7c39-0000a04069f0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/rabbit","pattern":"[url:value = 'https://www.ransomlook.io/group/rabbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6888dbc-88df-6da7-30a2-0000557caf08","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/killsec","pattern":"[url:value = 'https://www.ransomlook.io/group/killsec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cfb7df4-32a7-8378-7704-0000f645b2d1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion/","pattern":"[url:value = 'http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71fc266b-2baa-842f-6437-0000c7215c0d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/werewolves","pattern":"[url:value = 'https://www.ransomlook.io/group/werewolves']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb85417f-7352-5d19-e6f3-0000df6b63c3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://weerwolven.biz/en/","pattern":"[url:value = 'https://weerwolven.biz/en/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f817eae1-caae-e126-8516-00007b146160","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/blacksuit-ransomware-a-new-name-for-royal-gang/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/blacksuit-ransomware-a-new-name-for-royal-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--368a89ea-1532-4e78-2717-0000b72f59d2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/labs/blacksuit-ransomware-a-former-conti-affiliate-rebrands-and-evolves/","pattern":"[url:value = 'https://www.sentinelone.com/labs/blacksuit-ransomware-a-former-conti-affiliate-rebrands-and-evolves/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c97a83b8-2e77-cb23-a88f-00009f45b965","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/f/blacksuit-ransomware-and-its-similarities-to-royal.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/f/blacksuit-ransomware-and-its-similarities-to-royal.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--294e6090-4acd-094c-835b-0000fdfcfa47","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/black","pattern":"[url:value = 'https://www.ransomlook.io/group/black']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fe9b0e8-9bd3-0dac-38ff-00006e94305d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://weg7sdx54bevnvuLapqu6bpzwztryeflq3s23trgbmnhkbpqz637f2yd.onion","pattern":"[url:value = 'http://weg7sdx54bevnvuLapqu6bpzwztryeflq3s23trgbmnhkbpqz637f2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7954d627-14a6-d81e-7c37-00007210e2c6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5bol522hpd3yknxfct2o35ilimxyo46licxxitjvajtvcedltfrj53qd.onion/","pattern":"[url:value = 'http://5bol522hpd3yknxfct2o35ilimxyo46licxxitjvajtvcedltfrj53qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb97f65c-7dfc-214f-9339-0000bd5dd24d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wxqhwn52dnzbrtqeywg35jfvzbpwkw7edlxxoil7ag44plraezw5z5id.onion","pattern":"[url:value = 'http://wxqhwn52dnzbrtqeywg35jfvzbpwkw7edlxxoil7ag44plraezw5z5id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c714b5f5-1b90-82fa-e5ca-0000c4117ad2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wjdnuogx3mrnnutshrx7nbvjuwqfxnrb32rifaozygwdvs325s75keqd.onion","pattern":"[url:value = 'http://wjdnuogx3mrnnutshrx7nbvjuwqfxnrb32rifaozygwdvs325s75keqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--435b2cae-8790-03a1-143b-0000e218d655","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onion","pattern":"[url:value = 'http://2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77d497d6-d5ba-1775-a3cc-0000c2cc064b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ng2gzceugc2df6hp6s7wtg7hpupw37vqkvamaydhagv2qbrswdqlq6ad.onion/","pattern":"[url:value = 'http://ng2gzceugc2df6hp6s7wtg7hpupw37vqkvamaydhagv2qbrswdqlq6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9f50b9e-9abb-04af-bdce-00002dd80fc5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vm2rbvfkcqsx2xusltbxziwbsrunjegk6qeywf3bxpjlznq622s3iead.onion/","pattern":"[url:value = 'http://vm2rbvfkcqsx2xusltbxziwbsrunjegk6qeywf3bxpjlznq622s3iead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db044ac4-930a-073f-f89d-00006f2b187f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k6wtpxwq72gpeil5hqofae7yhbtxphbkyoe2g7rwmpx5sadc4sgsfvid.onion/","pattern":"[url:value = 'http://k6wtpxwq72gpeil5hqofae7yhbtxphbkyoe2g7rwmpx5sadc4sgsfvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78d0a2d6-5d32-f4cb-21ba-0000679000eb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ybo3xr25btxs47nmwykoudoe23nyv6ftkcpjdo4gilfzww4djpurtgid.onion/","pattern":"[url:value = 'http://ybo3xr25btxs47nmwykoudoe23nyv6ftkcpjdo4gilfzww4djpurtgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37c7abab-a31f-7de1-0965-000069a8c529","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://betrvom4agzebo27bt7o3hk35tvr7ppw3hrx5xx4ecvijwfsb4iufoyd.onion/","pattern":"[url:value = 'http://betrvom4agzebo27bt7o3hk35tvr7ppw3hrx5xx4ecvijwfsb4iufoyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f128f5f-3ef8-d278-b15a-0000dc34d990","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cyfafnmijhiqxxfhtofmn5lgk3w5ana6xzpc6gk5uvdfadqflvznpjyd.onion/","pattern":"[url:value = 'http://cyfafnmijhiqxxfhtofmn5lgk3w5ana6xzpc6gk5uvdfadqflvznpjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72ac673c-192d-83f5-d7d5-00002cdb4b8b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ro4h37fieb6oyfrwoi5u5wpvaalnegsxzxnwzwzw43anxqmv6hjcsfyd.onion/","pattern":"[url:value = 'http://ro4h37fieb6oyfrwoi5u5wpvaalnegsxzxnwzwzw43anxqmv6hjcsfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6441fb4e-e7f3-ec9d-5b6e-000078e1ac70","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ptsfbwx5j7kyk5r6n6uz4faic43jtb55sbls7py5wztwbxkyvsikguid.onion/","pattern":"[url:value = 'http://ptsfbwx5j7kyk5r6n6uz4faic43jtb55sbls7py5wztwbxkyvsikguid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18615a22-1d7b-6862-f7e8-0000b55e3328","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qjdremetxo2zpli32exwb5uct6cjljyj7v52d5thn7usmj5mlyxdojqd.onion/","pattern":"[url:value = 'http://qjdremetxo2zpli32exwb5uct6cjljyj7v52d5thn7usmj5mlyxdojqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f22bf53-81ef-5ce6-e398-00002cb126cb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nz2ihtemh2zli2wc3bovzps55clanspsqx5htu2plolby45a7pk4d3qd.onion/","pattern":"[url:value = 'http://nz2ihtemh2zli2wc3bovzps55clanspsqx5htu2plolby45a7pk4d3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5b1296e-c24b-a1e8-9c8f-00004e1fbfb0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://c7jpc6h2ccrdwmhofuij7kz6sr2fg2ndtbvvqy4fse23cf7m2e5hvqid.onion","pattern":"[url:value = 'http://c7jpc6h2ccrdwmhofuij7kz6sr2fg2ndtbvvqy4fse23cf7m2e5hvqid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a07ffee2-855b-968a-8514-0000e105a714","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: README.BlackSuit.txt","pattern":"[domain-name:value = 'README.BlackSuit.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5bbd964-d6f3-4aea-06da-0000b7e132f5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/noescape","pattern":"[url:value = 'https://www.ransomlook.io/group/noescape']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d6ecd3a-9357-84d0-ab5a-000009d4c0b9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion/archive","pattern":"[url:value = 'http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion/archive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55323c96-6a2f-5f45-a3d9-0000b6cca9c6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion/","pattern":"[url:value = 'http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6eb9019a-cc32-8c3a-1d51-0000af54428f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://noescaperjh3gg6oy7rck57fiefyuzmj7kmvojxgvlmwd5pdzizrb7ad.onion/login","pattern":"[url:value = 'http://noescaperjh3gg6oy7rck57fiefyuzmj7kmvojxgvlmwd5pdzizrb7ad.onion/login']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f5c1f40-9900-9c1a-2861-00002b6bdba0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.europol.europa.eu/media-press/newsroom/news/key-figures-behind-phobos-and-8base-ransomware-arrested-in-international-cybercrime-crackdown","pattern":"[url:value = 'https://www.europol.europa.eu/media-press/newsroom/news/key-figures-behind-phobos-and-8base-ransomware-arrested-in-international-cybercrime-crackdown']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86197f57-0394-b1c3-a912-00005149b0e4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.axios.com/2025/02/11/fbi-europol-8base-ransomware-takedown","pattern":"[url:value = 'https://www.axios.com/2025/02/11/fbi-europol-8base-ransomware-takedown']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76553d41-7bc3-62cf-6854-0000f4c74fea","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.eye.security/blog/8base-ransomware-investigation-uncovers-surprising-insights","pattern":"[url:value = 'https://www.eye.security/blog/8base-ransomware-investigation-uncovers-surprising-insights']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--490c959e-05b7-e210-906e-0000067be269","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.hhs.gov/sites/default/files/8base-ransomware-analyst-note.pdf","pattern":"[url:value = 'https://www.hhs.gov/sites/default/files/8base-ransomware-analyst-note.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b30b267-e8af-2c3f-f47d-000049c464c6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.fortinet.com/blog/threat-research/ransomware-roundup-8base","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/ransomware-roundup-8base']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccb426bf-82ff-3a9a-fb5e-000035a608fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://cyberint.com/blog/research/all-about-that-8base-ransomware-group-the-details/","pattern":"[url:value = 'https://cyberint.com/blog/research/all-about-that-8base-ransomware-group-the-details/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb1e61d7-1120-aacb-8b2d-0000fa590165","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/8base-ransomware-group/","pattern":"[url:value = 'https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/8base-ransomware-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--053fff25-ee83-8c50-18f6-0000efb211ef","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/anthology/8base/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/8base/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fab32b2-fd15-fd2d-adca-00009ed841ee","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1648ff9f-5e7a-6cde-0a79-0000e91a8ea5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/8base","pattern":"[url:value = 'https://www.ransomlook.io/group/8base']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdf81a8d-c0d7-8cb7-a8c6-00001ed04d35","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion/contact","pattern":"[url:value = 'http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion/contact']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01a5ce50-9148-900e-070d-00006b0fc6b8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xfycpauc22t5jsmfjcaz2oydrrrfy75zuk6chr32664bsscq4fgyaaqd.onion/","pattern":"[url:value = 'http://xfycpauc22t5jsmfjcaz2oydrrrfy75zuk6chr32664bsscq4fgyaaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ff6ecbf-2c3a-ca71-1578-00009c611705","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://92.118.36.204/","pattern":"[url:value = 'http://92.118.36.204/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bba4c79c-0c44-6db6-720a-0000557f22f9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cyberint.com/blog/other/cloak-ransomware-whos-behind-the-cloak/","pattern":"[url:value = 'https://www.cyberint.com/blog/other/cloak-ransomware-whos-behind-the-cloak/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d880673-9845-57ac-64b1-000017f83f4e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/","pattern":"[url:value = 'https://www.sentinelone.com/blog/threat-actor-interplay-good-days-victim-portals-and-their-ties-to-cloak/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a142a179-ebe2-7408-3f17-00008098bbc4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.halcyon.ai/blog/cloak-ransomware-variant-exhibits-advanced-persistence-evasion-and-vhd-extraction-capabilities","pattern":"[url:value = 'https://www.halcyon.ai/blog/cloak-ransomware-variant-exhibits-advanced-persistence-evasion-and-vhd-extraction-capabilities']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--beba58ce-4913-eb40-f3ed-000036917394","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.thaiCERT.or.th/en/2025/03/25/cloak-ransomware-attacks-virginia-attorney-generals-office/","pattern":"[url:value = 'https://www.thaiCERT.or.th/en/2025/03/25/cloak-ransomware-attacks-virginia-attorney-generals-office/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c3cc62f-32d0-7738-7314-000075a84870","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/cloak","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/cloak']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c8606a8-7705-0717-a95f-0000719cc8c9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/cloak","pattern":"[url:value = 'https://www.ransomlook.io/group/cloak']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4cda9b3-9e4b-1d1a-8359-0000a97ebc8e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cfmjv7md32ovswerbaqvxtlznqk647p5coqghbrhyy6euexrffyo6zyd.onion","pattern":"[url:value = 'http://cfmjv7md32ovswerbaqvxtlznqk647p5coqghbrhyy6euexrffyo6zyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6867089f-4a9e-8106-4c67-00001936c4f8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://67cw3reg2revettu2xfhaaaxhoukctplr6u6mhzri5x6uflet5bq56ad.onion","pattern":"[url:value = 'http://67cw3reg2revettu2xfhaaaxhoukctplr6u6mhzri5x6uflet5bq56ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8d6da60-fa77-843c-e46f-0000a8c6d442","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vir3qwnhwtdriaejfsav6fu5y5ikqlyp5ml345eenlk4pxgabqpf4iid.onion/","pattern":"[url:value = 'http://vir3qwnhwtdriaejfsav6fu5y5ikqlyp5ml345eenlk4pxgabqpf4iid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78ae8662-d1b6-fec7-cfbf-0000e392ebba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uss2a5zyeth7sop57zhgqcyafmnbkmoknps3i7anusze77zppp4bf5yd.onion/","pattern":"[url:value = 'http://uss2a5zyeth7sop57zhgqcyafmnbkmoknps3i7anusze77zppp4bf5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7c045ab-0ab6-ef2b-780a-000037318e38","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://heac3upmfv33scnkeek64dqdx2cblv7z256aezluyvgtwsxi2o3coiid.onion/","pattern":"[url:value = 'http://heac3upmfv33scnkeek64dqdx2cblv7z256aezluyvgtwsxi2o3coiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7be7cc1b-9e0f-4ce5-7bb9-0000bd24e6dd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xyy2fymbdytltylyuicasuvw7vw3gtgm3cvvjskh4jnzfg3gp7dqgnqd.onion","pattern":"[url:value = 'http://xyy2fymbdytltylyuicasuvw7vw3gtgm3cvvjskh4jnzfg3gp7dqgnqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d2c1bfd-5f6a-e10d-9ee4-0000d2840249","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sclj2rax5ljisew3v4msecylzo7iieqw25kcl7io4szei4qcujxixaid.onion","pattern":"[url:value = 'http://sclj2rax5ljisew3v4msecylzo7iieqw25kcl7io4szei4qcujxixaid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2aa369c0-78a9-de87-7ea3-00009e39f178","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://d2wqt4kek62s35hjeankc75nis4zn4e5i6zdtmfkyeevr7fygpf2iiid.onion","pattern":"[url:value = 'http://d2wqt4kek62s35hjeankc75nis4zn4e5i6zdtmfkyeevr7fygpf2iiid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5c1dd4e-da74-ed9f-70b9-00005687acc5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://37izr5yow5d673agew22miyy3inbqncuv7gfp5372yciuzvadqef66yd.onion","pattern":"[url:value = 'http://37izr5yow5d673agew22miyy3inbqncuv7gfp5372yciuzvadqef66yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9547730d-0e2c-f71c-588d-00001004286e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qx2b2on5phkj4jczfpzfkb5cuhxn7wfqbgdu27pmxyzamoim3jqff6qd.onion","pattern":"[url:value = 'http://qx2b2on5phkj4jczfpzfkb5cuhxn7wfqbgdu27pmxyzamoim3jqff6qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c606d379-d517-db88-5e30-0000ec20255e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://e7gxrudyx2o733zlernyqqv623wyky5teor5xhnnx2g6dt4vf6jwn2yd.onion","pattern":"[url:value = 'http://e7gxrudyx2o733zlernyqqv623wyky5teor5xhnnx2g6dt4vf6jwn2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80744b66-e9f1-ac83-d02d-0000fcc9d157","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://u66kitj46wmr5onijbbkg7cq45crcs66c563kyqy6klxm5c2nz42ujid.onion","pattern":"[url:value = 'http://u66kitj46wmr5onijbbkg7cq45crcs66c563kyqy6klxm5c2nz42ujid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7735d690-6f54-2054-ad7f-000088b45b93","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ztqugnw4upfmd6mu3l6sdz2mfvzxzouhwgqqowyjeedgsmz733dqq2ad.onion","pattern":"[url:value = 'http://ztqugnw4upfmd6mu3l6sdz2mfvzxzouhwgqqowyjeedgsmz733dqq2ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4e6a79f-3620-2aff-dc0f-0000aa16d7e4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qixf7fqw237ikunw4ey22jsc4deltducf6zn4mq4ldyqab3ij3gehlyd.onion","pattern":"[url:value = 'http://qixf7fqw237ikunw4ey22jsc4deltducf6zn4mq4ldyqab3ij3gehlyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b69206f-a111-a821-a6a1-0000161734f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ljrswxeei4isir3s5i7xmlzpx6sabmkgd7mvjrimcqwu7rqpn7bdjfad.onion","pattern":"[url:value = 'http://ljrswxeei4isir3s5i7xmlzpx6sabmkgd7mvjrimcqwu7rqpn7bdjfad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4b862a5-a151-180e-ce15-0000b9b4e87a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jrmayo7rvsx6sbv36djpdge6iwuem67dhccpctera2ykmqr6kplhayad.onion","pattern":"[url:value = 'http://jrmayo7rvsx6sbv36djpdge6iwuem67dhccpctera2ykmqr6kplhayad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a28e1d5f-1ac7-34b2-89b1-000066faeeba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cii64fki62v2mudocjvgarzlmnpqrfp6xb7korapmdd7qmjpnccgduyd.onion","pattern":"[url:value = 'http://cii64fki62v2mudocjvgarzlmnpqrfp6xb7korapmdd7qmjpnccgduyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--511c1d8b-514a-c607-8682-0000f27b81cd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hmxt5u75kj5qxqjqhckgaoda6zndgxcazleersyioat4iuq3ldgmkcid.onion","pattern":"[url:value = 'http://hmxt5u75kj5qxqjqhckgaoda6zndgxcazleersyioat4iuq3ldgmkcid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc80f45f-e7c7-7ba9-73ee-00000efe8b76","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://pbbeck4xcy3jzbu6lv5db3c5n3n44wngmpb5jj3yo4px32mlznziwbid.onion","pattern":"[url:value = 'http://pbbeck4xcy3jzbu6lv5db3c5n3n44wngmpb5jj3yo4px32mlznziwbid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff7893ac-287a-dc23-e1ea-000020a6c182","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hsn2e745m36crxj2gmnrp432vbsyarhwvq3fgcyus345dp3oqlrltuad.onion","pattern":"[url:value = 'http://hsn2e745m36crxj2gmnrp432vbsyarhwvq3fgcyus345dp3oqlrltuad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--306d923e-073a-77fc-0523-0000aaf77879","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qyywpuxysuur4exynwwwhu6nbd2f5vpj3h4tjbltfhwd4blamd4fppqd.onion","pattern":"[url:value = 'http://qyywpuxysuur4exynwwwhu6nbd2f5vpj3h4tjbltfhwd4blamd4fppqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21ce804f-d6c1-e82f-a306-0000c8eff88e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://occwme3xtlnzk3nlhn5ewsgodswrp6pysmmk7kcxqgj4hyiwkhoqcuyd.onion","pattern":"[url:value = 'http://occwme3xtlnzk3nlhn5ewsgodswrp6pysmmk7kcxqgj4hyiwkhoqcuyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19b7e419-b8e2-d0bb-d89b-00008896cd8f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://am3mzzguimx45wxywpukvwf3gobt3r4bidxzntjpsmqqge4s3vi2vvid.onion","pattern":"[url:value = 'http://am3mzzguimx45wxywpukvwf3gobt3r4bidxzntjpsmqqge4s3vi2vvid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95f8a56d-1224-8c2f-1040-0000d46f2fca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ziburuf5kh4phq5i6nmukpke7uruflhlvfexfmjwiwgghapz6ug3ajyd.onion","pattern":"[url:value = 'http://ziburuf5kh4phq5i6nmukpke7uruflhlvfexfmjwiwgghapz6ug3ajyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07408e99-1413-d1f5-aa28-0000d5683283","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nbfxtlikrnicuht5yvvhlujpnh3spzjmek6eujeyck2ws34yytxjdhyd.onion","pattern":"[url:value = 'http://nbfxtlikrnicuht5yvvhlujpnh3spzjmek6eujeyck2ws34yytxjdhyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4940351c-6844-d6d1-fd7c-000035a79cd5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://a6gq22ngckken4xksz5ytl66sqeylh45ktke5pnbzfdksw5sfum5lvqd.onion","pattern":"[url:value = 'http://a6gq22ngckken4xksz5ytl66sqeylh45ktke5pnbzfdksw5sfum5lvqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a213edd1-37ad-2c35-5f8b-00001753d674","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vsdp5gqwrunytxw4f6dbxznux66aaewlwyenw3rantba4lwyzbckgfid.onion","pattern":"[url:value = 'http://vsdp5gqwrunytxw4f6dbxznux66aaewlwyenw3rantba4lwyzbckgfid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdeb3dd9-0498-d9da-a293-00002b1e38e2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l3bbtg2p2gp2x43e2nngzkf7ab52k4mef3saowrl6m5notkts7p2vfyd.onion","pattern":"[url:value = 'http://l3bbtg2p2gp2x43e2nngzkf7ab52k4mef3saowrl6m5notkts7p2vfyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eab5a053-7d41-a8f6-76e8-00008f802e47","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://b53cqorlo7uftd3ymxguwnn7rfoz54ryoojjqxowdsaw2bahvuppntyd.onion","pattern":"[url:value = 'http://b53cqorlo7uftd3ymxguwnn7rfoz54ryoojjqxowdsaw2bahvuppntyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--178d81a2-4e40-442f-5f34-00009f1b9a20","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ey2eak3vq5zbeu4s56m25mm4kvszy2is7gyjs6tsfzmhptbyijkzn2yd.onion","pattern":"[url:value = 'http://ey2eak3vq5zbeu4s56m25mm4kvszy2is7gyjs6tsfzmhptbyijkzn2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bf73949-539a-9901-afbe-0000a660196f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://necnstpnzuaovjocmiuv7ned7bstczit3kkvotqxl53xo5rfohndlvid.onion","pattern":"[url:value = 'http://necnstpnzuaovjocmiuv7ned7bstczit3kkvotqxl53xo5rfohndlvid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e660daf-0d46-d142-137f-0000372de5bd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://piatupks5hai3oafo66xlj2eg2fbzjqy2j7gy3nyhqmnthlrwvrsolad.onion","pattern":"[url:value = 'http://piatupks5hai3oafo66xlj2eg2fbzjqy2j7gy3nyhqmnthlrwvrsolad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b899fe4e-2ed6-4077-f6ab-00008d9e020f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://puzhh5aykks65qneqantprbqjt6k5bnigmwqwv6yvkxvkfu4ivva5mid.onion","pattern":"[url:value = 'http://puzhh5aykks65qneqantprbqjt6k5bnigmwqwv6yvkxvkfu4ivva5mid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8101823c-51a4-b784-8b4e-0000a7b59384","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vicjwr6abknvcfjomocyb3koloidahc3hidwt5sq2ytwk7yepwfzlsid.onion","pattern":"[url:value = 'http://vicjwr6abknvcfjomocyb3koloidahc3hidwt5sq2ytwk7yepwfzlsid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9be21bfb-b011-f5cc-73c6-0000aad591ca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://glrw7ip5gz2fv2njbiqfvg5uiwavllw5zuixko4yrpj5hta7fjwqpjqd.onion","pattern":"[url:value = 'http://glrw7ip5gz2fv2njbiqfvg5uiwavllw5zuixko4yrpj5hta7fjwqpjqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0647a57-1e4c-3819-b624-0000028a4966","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jpef6snenchj3rxgugsozky3i34q66vmcoqy7neyu37xxiwxrad5doid.onion","pattern":"[url:value = 'http://jpef6snenchj3rxgugsozky3i34q66vmcoqy7neyu37xxiwxrad5doid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d127b074-dbda-5f93-bfda-0000e6419e20","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7puvv4qtcrigzbxshqibkpibzbmrs6thb7s6uf3tisqfp3t2ddpp66id.onion/","pattern":"[url:value = 'http://7puvv4qtcrigzbxshqibkpibzbmrs6thb7s6uf3tisqfp3t2ddpp66id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1981da55-1102-6e11-f674-00007f6937cf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6mw4yczxeqoiq7rgwnpi75qxsjd5jykuutpatflybodwlckoarhfdlid.onion/","pattern":"[url:value = 'http://6mw4yczxeqoiq7rgwnpi75qxsjd5jykuutpatflybodwlckoarhfdlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02497991-2e14-3a49-5859-0000f95aace0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lulzsec","pattern":"[url:value = 'https://www.ransomlook.io/group/lulzsec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96177518-c712-c6bc-c6d2-000037d8bf84","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dfi7ynmrugokn4fgvpbz5unt4d6k2i5abyez7wnoxxa2ifaw6s5puzqd.onion/TOPDz/data/","pattern":"[url:value = 'http://dfi7ynmrugokn4fgvpbz5unt4d6k2i5abyez7wnoxxa2ifaw6s5puzqd.onion/TOPDz/data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ec9d980-a1b6-e219-d5ad-0000a7015a52","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dfi7ynmrugokn4fgvpbz5unt4d6k2i5abyez7wnoxxa2ifaw6s5puzqd.onion/","pattern":"[url:value = 'http://dfi7ynmrugokn4fgvpbz5unt4d6k2i5abyez7wnoxxa2ifaw6s5puzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee3b10a0-9a17-c958-7f28-0000d6c7e355","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.nccgroup.com/us/newsroom/ncc-group-monthly-threat-pulse-review-of-may-2024/","pattern":"[url:value = 'https://www.nccgroup.com/us/newsroom/ncc-group-monthly-threat-pulse-review-of-may-2024/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6c782e0-6531-6cd8-9ed7-000051213812","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sos-vo.org/news/cybersecurity-snapshots-dan0n-and-arcus-media-ransomware-groups","pattern":"[url:value = 'https://www.sos-vo.org/news/cybersecurity-snapshots-dan0n-and-arcus-media-ransomware-groups']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de7e304f-c68f-80f9-ca11-0000e74be545","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dan0n","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/dan0n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bec4f0c8-c67b-7749-f88b-0000e37f65fc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/dan0n","pattern":"[url:value = 'https://www.ransomlook.io/group/dan0n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cde0591-183d-cd68-1675-000014bb9c83","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2c7nd54guzi6xhjyqrj5kdkrq2ngm2u3e6oy4nfhn3wm3r54ul2utiqd.onion/","pattern":"[url:value = 'http://2c7nd54guzi6xhjyqrj5kdkrq2ngm2u3e6oy4nfhn3wm3r54ul2utiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c32c37a8-57ab-c81d-5906-000081c28562","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.youtube.com/watch?v=hgz5gZB3DxE","pattern":"[url:value = 'https://www.youtube.com/watch?v=hgz5gZB3DxE']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d37a12cd-2105-f151-5b42-0000a525a89f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blogs.blackberry.com/en/2021/11/threat-thursday-karma-ransomware","pattern":"[url:value = 'https://blogs.blackberry.com/en/2021/11/threat-thursday-karma-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64663cf0-48d5-4ef8-4400-000096908b88","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.cyble.com/2021/08/24/a-deep-dive-analysis-of-karma-ransomware/","pattern":"[url:value = 'https://blog.cyble.com/2021/08/24/a-deep-dive-analysis-of-karma-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6020385-c292-716f-6663-0000d6abae9c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/karma","pattern":"[url:value = 'https://www.ransomlook.io/group/karma']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5ec9610-9cad-9a00-92c9-000066f765e4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/siegedsec","pattern":"[url:value = 'https://www.ransomlook.io/group/siegedsec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82522e57-0b08-0175-7212-000013e744ed","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nv5p2mmpctvyqdyyi5zwh4gnifq2uxdx4etvnmaheqlrw6ordrjwxryd.onion/","pattern":"[url:value = 'http://nv5p2mmpctvyqdyyi5zwh4gnifq2uxdx4etvnmaheqlrw6ordrjwxryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8c7e382-44a2-9b47-00e7-000066947dc4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/mydata","pattern":"[url:value = 'https://www.ransomlook.io/group/mydata']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6670f68-4484-8d18-4026-0000e6fc37e4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3v4zoso2ghne47usnhyoe4dsezmfqhfv5v5iuep4saic5nnfpc6phrad.onion/","pattern":"[url:value = 'http://3v4zoso2ghne47usnhyoe4dsezmfqhfv5v5iuep4saic5nnfpc6phrad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14794ee2-52da-4283-d8cd-00001933ea67","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2id7ik6lkd3jjjjlaarr3wckrxidp3bgl2jn5nhqciouk2ehuyakdiqd.onion/","pattern":"[url:value = 'http://2id7ik6lkd3jjjjlaarr3wckrxidp3bgl2jn5nhqciouk2ehuyakdiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad3f8f5e-5712-b3ba-b85b-00009829ef00","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ot3vo3od2pajc7ymxdk6wimur7j7pgs2agvqlzyculowk3yoxzene2id.onion/","pattern":"[url:value = 'http://ot3vo3od2pajc7ymxdk6wimur7j7pgs2agvqlzyculowk3yoxzene2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7778dd15-1ea0-2a9b-7809-000084d3661e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2id7ik6lkd3jjjjlaarr3wckrxidp3bgl2jn5nhqciouk2ehuyakdiqd.onion","pattern":"[url:value = 'http://2id7ik6lkd3jjjjlaarr3wckrxidp3bgl2jn5nhqciouk2ehuyakdiqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--576d6863-a06c-2fe6-4ae9-000020c0ccca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ot3vo3od2pajc7ymxdk6wimur7j7pgs2agvqlzyculowk3yoxzene2id.onion","pattern":"[url:value = 'http://ot3vo3od2pajc7ymxdk6wimur7j7pgs2agvqlzyculowk3yoxzene2id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9455caa3-ff82-8054-48f2-0000055c3cbc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xszpovfd3q52omk5larjf4y7rziov2oee4u4amcm32wwsxc7ublmdtid.onion/","pattern":"[url:value = 'http://xszpovfd3q52omk5larjf4y7rziov2oee4u4amcm32wwsxc7ublmdtid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be60f731-a041-4d0c-f4b3-0000c790dc95","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id.onion/blog","pattern":"[url:value = 'http://mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id.onion/blog']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3bc14b1-80e6-e892-9a76-0000dc93f9d8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/red","pattern":"[url:value = 'https://www.ransomlook.io/group/red']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5bdf878-97a0-a09e-606a-0000c721d877","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://33zo6hifw4usofzdnz74fm2zmhd3zsknog5jboqdgblcbwrmpcqzzbid.onion/","pattern":"[url:value = 'http://33zo6hifw4usofzdnz74fm2zmhd3zsknog5jboqdgblcbwrmpcqzzbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c0eda51-ddfc-6aa5-bc94-0000056701d7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ic3.gov/Media/News/2023/231103.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2023/231103.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d068c9d-9b6b-bf72-d2da-00007fe81c52","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/labs/hunters-international-ransomware-a-possible-hive-successor/","pattern":"[url:value = 'https://www.sentinelone.com/labs/hunters-international-ransomware-a-possible-hive-successor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5c9e4a2-0a6a-9145-07a5-0000f6208089","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hunters-international-ransomware-likely-a-rebrand-of-hive/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hunters-international-ransomware-likely-a-rebrand-of-hive/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c8632e1-b002-d339-dc0c-0000b5fd8d31","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/hunters","pattern":"[url:value = 'https://www.ransomlook.io/group/hunters']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb4030d6-7ab5-a1e2-9534-0000d4e87bb4","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hunters33dootzzwybhxyh6xnmumopeoza6u4hkontdqu7awnhmix7ad.onion","pattern":"[url:value = 'http://hunters33dootzzwybhxyh6xnmumopeoza6u4hkontdqu7awnhmix7ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb0b0b18-38c0-ea9e-8d3c-00009265b79e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hunters55wwmd25ycahnbn5xh45hvtwbmby6ly4p6qee5pughbyrajqd.onion","pattern":"[url:value = 'http://hunters55wwmd25ycahnbn5xh45hvtwbmby6ly4p6qee5pughbyrajqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15a5b1be-797c-b7bf-a08b-000060d45e3f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://huntersinternational.su","pattern":"[url:value = 'http://huntersinternational.su']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc34e5f5-ccfa-16f6-98b0-000045c40755","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://huntersinternational.net","pattern":"[url:value = 'https://huntersinternational.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcf74eff-ef27-8048-1d68-000007cd74ab","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion","pattern":"[url:value = 'https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5843884-b141-10f2-860a-0000ef000de5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion/","pattern":"[url:value = 'http://toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3866407b-2e14-a075-9769-0000f87a494f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/metaencryptor","pattern":"[url:value = 'https://www.ransomlook.io/group/metaencryptor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6142fd9-1978-4857-1748-00007ee8a7f7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://metacrptmytukkj7ajwjovdpjqzd7esg5v3sg344uzhigagpezcqlpyd.onion/","pattern":"[url:value = 'http://metacrptmytukkj7ajwjovdpjqzd7esg5v3sg344uzhigagpezcqlpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f202cd2d-7b87-e1fd-72a0-000054b958c0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.salvagedata.com/blog/darkrace-ransomware","pattern":"[url:value = 'https://www.salvagedata.com/blog/darkrace-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--452cc0db-cd1f-5b3e-4bdf-00008c882497","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://petikvx.github.io/2024/06/20/darkrace-ransomware.html","pattern":"[url:value = 'https://petikvx.github.io/2024/06/20/darkrace-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3958cb49-c190-4482-7445-0000c683249b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.helpnetsecurity.com/2024/07/08/decryptor-donex-muse-darkrace-fake-lockbit-3-0/","pattern":"[url:value = 'https://www.helpnetsecurity.com/2024/07/08/decryptor-donex-muse-darkrace-fake-lockbit-3-0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52d5145e-508a-f408-2ae9-00004a43b748","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/vinfo/be/threat-encyclopedia/malware/ransom.win32.darkrace.thcofbd","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/be/threat-encyclopedia/malware/ransom.win32.darkrace.thcofbd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4160305f-2972-49c1-8df7-000001627bc9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/darkrace-ransomware","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/darkrace-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f34d21f9-912c-6d7f-03b7-0000ca9125cc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/darkrace","pattern":"[url:value = 'https://www.ransomlook.io/group/darkrace']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dad8988-8690-4991-ab7b-00005976f3dc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tox.chat/download.html\\nTox","pattern":"[url:value = 'http://tox.chat/download.html\\\\nTox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7882cd50-a3a6-f93b-9e84-0000e5282069","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.torproject.org/\\nWrite","pattern":"[url:value = 'https://www.torproject.org/\\\\nWrite']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d361a073-14af-160a-3333-000036737e53","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion/\\n\\n","pattern":"[url:value = 'http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion/\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16870fe6-c664-5496-ae3f-0000ad5de3e6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/lambda","pattern":"[url:value = 'https://www.ransomlook.io/group/lambda']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7638fdc9-bab4-12df-da6a-0000e318cf79","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://krjv3wondknwdrlvzp6ktqcqkrlvpme2xjt3fu7ojqpaqgl3sm33bdqd.onion/","pattern":"[url:value = 'http://krjv3wondknwdrlvzp6ktqcqkrlvpme2xjt3fu7ojqpaqgl3sm33bdqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f1610ed-20b2-856e-66e6-0000eb5aa142","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nn5ua7gc7jkllpoztymtfcu64yjm7znlsriq3a6v5kw7l6jvirnczyyd.onion","pattern":"[url:value = 'http://nn5ua7gc7jkllpoztymtfcu64yjm7znlsriq3a6v5kw7l6jvirnczyyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1be869b9-8970-7e0d-ddce-000024173a8e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/hellogookie","pattern":"[url:value = 'https://www.ransomlook.io/group/hellogookie']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8433acb1-e5a2-3dfc-6502-00008d8843fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gookie256cvccntvenyxrvn7ht73bs6ss3oj2ocfkjt5y6vq6gfi2tad.onion/","pattern":"[url:value = 'http://gookie256cvccntvenyxrvn7ht73bs6ss3oj2ocfkjt5y6vq6gfi2tad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ae63172-a0fe-171e-762b-00002c37b905","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/zero","pattern":"[url:value = 'https://www.ransomlook.io/group/zero']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92fccf29-d9d4-6882-7172-00003b834de5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zhuobnfsddn2myfxxdqtpxk367dqnntjf3kq7mrzdgienfxjyllq4rqd.onion/","pattern":"[url:value = 'http://zhuobnfsddn2myfxxdqtpxk367dqnntjf3kq7mrzdgienfxjyllq4rqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59043f2d-4f0f-d786-169d-00009b507e61","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://otx.alienvault.com/pulse/6719efafaae058b238f9ca50","pattern":"[url:value = 'https://otx.alienvault.com/pulse/6719efafaae058b238f9ca50']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce9f48dc-10c2-fa69-4743-000028f5c2ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.vectra.ai/threat-actors/eraleig-apt73-bashe","pattern":"[url:value = 'https://www.vectra.ai/threat-actors/eraleig-apt73-bashe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--194f90d7-671d-eb7f-b442-0000eb92b019","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cloudsek.com/blog/unmasking-media-hungry-ransomware-groups-bashe-apt73","pattern":"[url:value = 'https://www.cloudsek.com/blog/unmasking-media-hungry-ransomware-groups-bashe-apt73']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ed02903-084b-53aa-134b-000034a5b6a6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/eraleign","pattern":"[url:value = 'https://www.ransomlook.io/group/eraleign']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edfefc08-917a-8692-cad2-000018696551","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qku4reiyfcs2vqq5tow2uprhyqhweo56lrgs6457svr3ej4ton5frkad.onion","pattern":"[url:value = 'http://qku4reiyfcs2vqq5tow2uprhyqhweo56lrgs6457svr3ej4ton5frkad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7bf322a-bb44-3b8b-2ef0-000077027c33","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bashei5oy4zvmf2letnupwhgprdkjyssm3zxj2oyr6wfezkf3elehzqd.onion","pattern":"[url:value = 'http://bashei5oy4zvmf2letnupwhgprdkjyssm3zxj2oyr6wfezkf3elehzqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22b19ec3-8895-3bc9-9351-0000343b491b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bashefe5uezp2jtxpk24b2pyfnnfyguicgrgqufgu57mfluegotbeayd.onion","pattern":"[url:value = 'http://bashefe5uezp2jtxpk24b2pyfnnfyguicgrgqufgu57mfluegotbeayd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdd1a610-a4aa-1cb1-575d-0000e1d91f0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bashedl53memptddxzb4kr5mnkzse4fmhpqeq7jb4srndswar46nofid.onion","pattern":"[url:value = 'http://bashedl53memptddxzb4kr5mnkzse4fmhpqeq7jb4srndswar46nofid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4e3c31d-1e37-f51b-a8b6-0000395c4216","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bashed52orwi7qoyvmcfkdnuaogta4inpojfd6cthzkp4qpsq64ux4ad.onion","pattern":"[url:value = 'http://bashed52orwi7qoyvmcfkdnuaogta4inpojfd6cthzkp4qpsq64ux4ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b85604e5-96eb-a84c-0024-0000bd3b6698","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://7bbqrijcds5sgji3kiwo5o5qgxfgoyufykhzfdo6xl3qbdes2e7tdyad.onion","pattern":"[url:value = 'http://7bbqrijcds5sgji3kiwo5o5qgxfgoyufykhzfdo6xl3qbdes2e7tdyad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--804b89c1-e6f0-8483-a316-00006f540243","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://basherq53eniermxovo3bkduw5qqq5bkqcml3qictfmamgvmzovykyqd.onion","pattern":"[url:value = 'http://basherq53eniermxovo3bkduw5qqq5bkqcml3qictfmamgvmzovykyqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bc0f8d7-f860-834a-fcdf-00003bb1cf45","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bashe4aec32kr6zbifwd5x6xgjsmhg4tbowrbx4pneqhc5mqooyifpid.onion/","pattern":"[url:value = 'http://bashe4aec32kr6zbifwd5x6xgjsmhg4tbowrbx4pneqhc5mqooyifpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4e35c4c-e6d4-ff22-5b2a-0000a2fb9044","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://basheqtvzqwz4vp6ks5lm2ocq7i6tozqgf6vjcasj4ezmsy4bkpshhyd.onion/","pattern":"[url:value = 'http://basheqtvzqwz4vp6ks5lm2ocq7i6tozqgf6vjcasj4ezmsy4bkpshhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdc82e5f-9e5b-85ae-44c8-00000d2e6f40","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wn6vonooq6fggjdgyocp7bioykmfjket7sbp47cwhgubvowwd7ws5pyd.onion/","pattern":"[url:value = 'http://wn6vonooq6fggjdgyocp7bioykmfjket7sbp47cwhgubvowwd7ws5pyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b3ee62b-533c-2e63-c0e7-0000092ba555","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://eraleignews.com/","pattern":"[url:value = 'http://eraleignews.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a387b30-a982-ed9e-bab4-000034d4b8e7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/2024/04/04/akira-ransomware","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/2024/04/04/akira-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--839c55f9-d9bc-3fa1-6ac5-000070167b0c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/akira-ransomware-now-targets-linux-vmware-esxi-servers","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/akira-ransomware-now-targets-linux-vmware-esxi-servers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d034078-7273-f2cb-2b91-0000c7e46274","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/labs/akira-ransomware-attacks-vpn-appliances","pattern":"[url:value = 'https://www.sentinelone.com/labs/akira-ransomware-attacks-vpn-appliances']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea12832b-4b21-edce-5201-000023795685","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/megazord","pattern":"[url:value = 'https://www.ransomlook.io/group/megazord']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--036026f8-8b75-c96e-2df1-0000c1cd85b9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://github.com/crocodyli/ThreatActors-TTPs/tree/main/Akira","pattern":"[url:value = 'https://github.com/crocodyli/ThreatActors-TTPs/tree/main/Akira']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e26b94f-8081-948e-31a6-000068ba1f11","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/akira","pattern":"[url:value = 'https://www.ransomlook.io/group/akira']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a82f65d1-4a67-e6f4-c2d1-0000cb66b8ba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/l","pattern":"[url:value = 'https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/l']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d3911d5-4827-1855-f8de-000073e81960","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/l","pattern":"[url:value = 'http://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/l']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5e10924-884b-b8d8-4e16-0000cdfdc2e0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/","pattern":"[url:value = 'https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--462104fd-f73b-d46e-5242-0000616f7031","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/n","pattern":"[url:value = 'https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47d0f4e7-7403-f619-ff42-0000aed875a1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/","pattern":"[url:value = 'https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6c2efb5-d847-0be9-c768-00009b6f354c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/yanluowang","pattern":"[url:value = 'https://www.ransomlook.io/group/yanluowang']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61e0b147-e478-9a98-c683-0000dc77a30b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-yanluowang-ransomware-victims/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-yanluowang-ransomware-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52a67da3-3cb7-f1be-f34c-00008a6ca7a3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-targeted-ransomware","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-targeted-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad291638-1cd7-da7d-b5a0-00008024dc90","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://securelist.com/how-to-recover-files-encrypted-by-yanlouwang/106332/","pattern":"[url:value = 'https://securelist.com/how-to-recover-files-encrypted-by-yanlouwang/106332/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c923d1bc-93bf-9a49-5dca-00000276c73f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://github.com/albertzsigovits/malware-notes/tree/master/Ransomware-Windows-Yanluowang","pattern":"[url:value = 'https://github.com/albertzsigovits/malware-notes/tree/master/Ransomware-Windows-Yanluowang']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef41589e-4308-1854-e21a-0000704276e1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jukswsxbh3jsxuddvidrjdvwuohtsy4kxg2axbppiyclomt2qciyfoad.onion/","pattern":"[url:value = 'http://jukswsxbh3jsxuddvidrjdvwuohtsy4kxg2axbppiyclomt2qciyfoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed986b0d-afb6-8ae3-6e9e-000084737f0a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/xinof","pattern":"[url:value = 'https://www.ransomlook.io/group/xinof']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88c35904-3482-31ab-83b5-00009a6b98ed","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/xinglocker","pattern":"[url:value = 'https://www.ransomlook.io/group/xinglocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--807a99fc-6e04-4ef2-7c53-000058fb66eb","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://itsecuritywire.com/quick-bytes/xinglocker-spreading-worm-using-mountlocker","pattern":"[url:value = 'https://itsecuritywire.com/quick-bytes/xinglocker-spreading-worm-using-mountlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee2475c4-dc51-8f7a-1885-00000c9b12be","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.izoologic.com/2021/06/19/xing-locker-team-ransomgroup-is-on-a-roll-they-recently-hit-sharafi-group-investments","pattern":"[url:value = 'https://www.izoologic.com/2021/06/19/xing-locker-team-ransomgroup-is-on-a-roll-they-recently-hit-sharafi-group-investments']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5826773a-5c16-216c-56f8-00006ff94f7c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x4mjvffmytkw3hyu.onion/","pattern":"[url:value = 'http://x4mjvffmytkw3hyu.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0576616a-d7ff-e3ce-157b-000074b685b2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3klsbd4dwj3yqgo4xpogfgwqkljbnbdxjryeqks2cjion5jj33wvkqyd.onion/","pattern":"[url:value = 'http://3klsbd4dwj3yqgo4xpogfgwqkljbnbdxjryeqks2cjion5jj33wvkqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a24276d9-7473-14e9-b31a-00009799b57f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yk7erwdvj4vxcgiq3gmcufkben4bk4ixddl5j2xvu7gurtdq754jmiad.onion/","pattern":"[url:value = 'http://yk7erwdvj4vxcgiq3gmcufkben4bk4ixddl5j2xvu7gurtdq754jmiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d50bb6d-f7a5-85d8-a050-0000d8233b07","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z4cn6lpet4y4r6mdlbpklpcrjdruwb6kiuvxn6gsiuoub23z6prlx6ad.onion/","pattern":"[url:value = 'http://z4cn6lpet4y4r6mdlbpklpcrjdruwb6kiuvxn6gsiuoub23z6prlx6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9cb9bbc-14e9-ed8c-443f-0000a6310a8a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ibih5znjxf2cqgo737xmooyvmxhac45wd4rivh6n5hd7fysn42g3fayd.onion/","pattern":"[url:value = 'http://ibih5znjxf2cqgo737xmooyvmxhac45wd4rivh6n5hd7fysn42g3fayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdb042ec-5d08-be54-3ef8-00005da0f2ac","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ikrah6fb4e6r2raxkyvyoxp22jam5z6ak5ajfnzxutmassoagvr2bhad.onion/","pattern":"[url:value = 'http://ikrah6fb4e6r2raxkyvyoxp22jam5z6ak5ajfnzxutmassoagvr2bhad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbc44be2-f895-298b-e886-0000d194d1cc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tpze4yo74m6qflef.onion/","pattern":"[url:value = 'http://tpze4yo74m6qflef.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--686167d6-a45d-973f-f7c0-00006d7ba0ea","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qfgh2lpslhjb33z3wsenmqrxcdragelinvcpowlgkbjca6yig5zloeyd.onion/","pattern":"[url:value = 'http://qfgh2lpslhjb33z3wsenmqrxcdragelinvcpowlgkbjca6yig5zloeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a037d524-8cbe-c7b9-3779-00008fc03f67","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hceesrsg6f5p4gcph4j6jv6vl4mkmaik735oz4r45lgjfyedsxfoprad.onion/","pattern":"[url:value = 'http://hceesrsg6f5p4gcph4j6jv6vl4mkmaik735oz4r45lgjfyedsxfoprad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d8d9a3e-216b-dbcd-eec3-0000c2241054","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://duxht3zdnb2dmq34o5w3tyzpy2kgylidnpaxsn2a7lcxoofb6hqmu7qd.onion/","pattern":"[url:value = 'http://duxht3zdnb2dmq34o5w3tyzpy2kgylidnpaxsn2a7lcxoofb6hqmu7qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b516a32-fa0c-dcb3-6859-000050e79634","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zckdr5wmbzxphoem77diqb2ome2a54o23jl2msz3kmotjlpdnjhmn6yd.onion","pattern":"[url:value = 'http://zckdr5wmbzxphoem77diqb2ome2a54o23jl2msz3kmotjlpdnjhmn6yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aff30e1-a8b8-f96d-9d08-0000ae12260d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vsop","pattern":"[url:value = 'https://www.ransomlook.io/group/vsop']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca9e6510-406f-2391-7823-0000e76dc7b5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mrdxtxy6vqeqbmb4rvbvueh2kukb3e3mhu3wdothqn7242gztxyzycid.onion/","pattern":"[url:value = 'http://mrdxtxy6vqeqbmb4rvbvueh2kukb3e3mhu3wdothqn7242gztxyzycid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70e76953-5f6d-77a0-e1f9-000010dd7202","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vicesociety","pattern":"[url:value = 'https://www.ransomlook.io/group/vicesociety']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--159f87c2-c062-0700-c488-0000722f87cc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.talosintelligence.com/2021/08/vice-society-ransomware-printnightmare.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2021/08/vice-society-ransomware-printnightmare.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92ff0c0e-7675-df0f-ffb2-00007f5fc8b7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ecdmr42a34qovoph557zotkfvth4fsz56twvwgiylstjup4r5bpc4oad.onion/","pattern":"[url:value = 'http://ecdmr42a34qovoph557zotkfvth4fsz56twvwgiylstjup4r5bpc4oad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be9ff6e5-7e6f-d28b-3288-000079099fb5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tahnytazh47jpikpajm2so2jdsjrkx6gfcu4p7bu7u3vfarnpvshgeyd.onion/","pattern":"[url:value = 'http://tahnytazh47jpikpajm2so2jdsjrkx6gfcu4p7bu7u3vfarnpvshgeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6ae6690-5ab4-aadf-d826-00000bacbf66","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xu66gzit6zp22qvixpenlxu2ok7vzrpqvgkuupkiukpz47va47ewbwad.onion","pattern":"[url:value = 'http://xu66gzit6zp22qvixpenlxu2ok7vzrpqvgkuupkiukpz47va47ewbwad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ab5970e-4bac-cd97-749d-00007be33370","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://wmp2rvrkecyx72i3x7ejhyd3yr6fn5uqo7wfus7cz7qnwr6uzhcbrwad.onion","pattern":"[url:value = 'http://wmp2rvrkecyx72i3x7ejhyd3yr6fn5uqo7wfus7cz7qnwr6uzhcbrwad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61376fe6-7090-c9ca-08ee-000003c13bba","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd.onion/","pattern":"[url:value = 'http://ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26789e3f-6a0e-16d6-bc5e-00006a5db9bf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ml3mjpuhnmse4kjij7ggupenw34755y4uj7t742qf7jg5impt5ulhkid.onion/","pattern":"[url:value = 'http://ml3mjpuhnmse4kjij7ggupenw34755y4uj7t742qf7jg5impt5ulhkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--956a576a-9781-bade-7a27-0000e9ab4818","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/vfokx","pattern":"[url:value = 'https://www.ransomlook.io/group/vfokx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--764ba013-9f94-86ff-d02d-0000a51f7c00","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/v","pattern":"[url:value = 'https://www.ransomlook.io/group/v']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37d5f30a-9f5c-d325-3cf2-000030c9546a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/unsafe","pattern":"[url:value = 'https://www.ransomlook.io/group/unsafe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3b87cbe-ea3d-1a73-1bd4-00007d869b23","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://unsafeipw6wbkzzmj7yqp7bz6j7ivzynggmwxsm6u2wwfmfqrxqrrhyd.onion/","pattern":"[url:value = 'http://unsafeipw6wbkzzmj7yqp7bz6j7ivzynggmwxsm6u2wwfmfqrxqrrhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e73c1876-9eda-ae88-82bc-0000097eb575","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/unknown","pattern":"[url:value = 'https://www.ransomlook.io/group/unknown']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--678e6055-0d2d-2e36-4316-0000f1fc6c12","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://darktorhvabc652txfc575oendhykqcllb7bh7jhhsjduocdlyzdbmqd.onion/","pattern":"[url:value = 'http://darktorhvabc652txfc575oendhykqcllb7bh7jhhsjduocdlyzdbmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88c52451-30e4-4a3c-aaa0-000083eed638","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/stormous","pattern":"[url:value = 'https://www.ransomlook.io/group/stormous']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93b54e4d-8046-bea0-42f4-000059c57e26","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zib7duoiglvzvnpjs5faly6bio4xhwiby2lupsnxrkjnx46gmwdfyrid.onion/","pattern":"[url:value = 'http://zib7duoiglvzvnpjs5faly6bio4xhwiby2lupsnxrkjnx46gmwdfyrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11ec8679-01a6-cf38-eec2-00006b3387fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6sf5xa7eso3e3vk46i5tpcqhnlayczztj7zjktzaztlotyy75zs6j7qd.onion","pattern":"[url:value = 'http://6sf5xa7eso3e3vk46i5tpcqhnlayczztj7zjktzaztlotyy75zs6j7qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebe90b67-d0d5-2410-955f-000083cc1bf7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd.onion","pattern":"[url:value = 'http://h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e338596-8dd2-ed6f-0f01-0000f4cc8cca","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3slz4povugieoi3tw7sblxoowxhbzxeju427cffsst5fo2tizepwatid.onion","pattern":"[url:value = 'http://3slz4povugieoi3tw7sblxoowxhbzxeju427cffsst5fo2tizepwatid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c82a5483-316e-a06b-6922-00001269b139","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/spook","pattern":"[url:value = 'https://www.ransomlook.io/group/spook']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5b50f03-05ee-4ba3-545d-0000caa3a09e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sparta","pattern":"[url:value = 'https://www.ransomlook.io/group/sparta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b59fdcf9-4266-def9-5c6f-0000035e0982","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://z33da2c5d6t4ekkv4pxao7znpc2w2m47llzvg76g6xxgyd5wqqmfrtqd.onion","pattern":"[url:value = 'http://z33da2c5d6t4ekkv4pxao7znpc2w2m47llzvg76g6xxgyd5wqqmfrtqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbe410c1-7d37-81cc-4867-000089be8d12","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zj2ex44e2b2xi43m2txk4uwi3l55aglsarre7repw7rkfwpj54j46iqd.onion","pattern":"[url:value = 'http://zj2ex44e2b2xi43m2txk4uwi3l55aglsarre7repw7rkfwpj54j46iqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--717b2c7f-71d7-8fd2-ac4f-0000553da9a8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/solidbit","pattern":"[url:value = 'https://www.ransomlook.io/group/solidbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fa539b2-c48a-f852-8795-00009a94b552","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/h/solidbit-ransomware-enters-the-raas-scene-and-takes-aim-at-gamer.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/h/solidbit-ransomware-enters-the-raas-scene-and-takes-aim-at-gamer.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faac99ac-488b-41c3-a7c4-00005bf73fc0","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/sabbath","pattern":"[url:value = 'https://www.ransomlook.io/group/sabbath']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba08893a-bc24-de5c-d463-000039108e62","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.mandiant.com/resources/sabbath-ransomware-affiliate","pattern":"[url:value = 'https://www.mandiant.com/resources/sabbath-ransomware-affiliate']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12116f4e-9b01-594d-6939-000006a7b2ec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/rransom","pattern":"[url:value = 'https://www.ransomlook.io/group/rransom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e57c5d15-3071-b025-4eb0-0000b83d3ade","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/royal","pattern":"[url:value = 'https://www.ransomlook.io/group/royal']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03b1be8d-b623-14b0-ab0a-0000dbbbcd52","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yef4xoqj2jq554rqetf2ikmpdtewdlbnx5xrtjtjqaotvfw77ipb6pad.onion/","pattern":"[url:value = 'http://yef4xoqj2jq554rqetf2ikmpdtewdlbnx5xrtjtjqaotvfw77ipb6pad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3841169a-94fb-a658-96d0-000019b1bc61","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k6s24pz55gtvtzzpg4riv7zb74vts425bl42zrpmice5ud3a65itj6ad.onion/","pattern":"[url:value = 'http://k6s24pz55gtvtzzpg4riv7zb74vts425bl42zrpmice5ud3a65itj6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b43c60d8-5a7d-bb8a-3d78-00003d7e36b2","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://72u5vd67xdff354hhge6wjuvsixxwo3c6bvrdlqstgmjfptpbzwrsmad.onion","pattern":"[url:value = 'http://72u5vd67xdff354hhge6wjuvsixxwo3c6bvrdlqstgmjfptpbzwrsmad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf9751d3-659d-73fc-eccb-0000b672a48a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://royal4ezp7xrbakkus3oofjw6gszrohpodmdnfbe5e4w3og5sm7vb3qd.onion","pattern":"[url:value = 'http://royal4ezp7xrbakkus3oofjw6gszrohpodmdnfbe5e4w3og5sm7vb3qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c84a4b73-3d06-dccd-12fa-00002745ad2f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/relic","pattern":"[url:value = 'https://www.ransomlook.io/group/relic']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6296cc26-1f58-c664-1732-0000b695d1ad","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://chatc46k7dqtvvrgfqjs6vxrwnmudko2ptiqvlb7doqxxqtjc22tsiad.onion/?auth_id=","pattern":"[url:value = 'http://chatc46k7dqtvvrgfqjs6vxrwnmudko2ptiqvlb7doqxxqtjc22tsiad.onion/?auth_id=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d821b0a2-3d50-2d74-45f6-00008626729e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ranzy","pattern":"[url:value = 'https://www.ransomlook.io/group/ranzy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6019d55a-aaca-701f-e16a-00000d797732","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.ransomlook.io/group/ransomhouse","pattern":"[url:value = 'https://www.ransomlook.io/group/ransomhouse']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45c7fb25-037d-a10a-e37e-000038b8ae85","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ukdtdlnhqd5s2vjf37ppentd665fziy6hx7vo2teprwkankxnncurbqd.onion/","pattern":"[url:value = 'http://ukdtdlnhqd5s2vjf37ppentd665fziy6hx7vo2teprwkankxnncurbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c33ce86a-f5e3-04a7-2ad9-000008fe0ef8","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ec6vufhtlxgi3anptyflknb4kpylrooxgxfxpt4ybeklxvhjyzo5hiid.onion/","pattern":"[url:value = 'http://ec6vufhtlxgi3anptyflknb4kpylrooxgxfxpt4ybeklxvhjyzo5hiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a98cee36-6f5a-8943-42fb-0000f063cd4c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tpo4hhd2vlagaekjrahueakxvmjikfrxrxjev43cnp5gb4ljq67s5did.onion/","pattern":"[url:value = 'http://tpo4hhd2vlagaekjrahueakxvmjikfrxrxjev43cnp5gb4ljq67s5did.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28e736e3-4ddd-7555-190b-0000e8a0cdd1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://t6pz3lfor4iiryloxvbcjdweri5wlapz4trgejutgfmjywgmly3tkkad.onion/","pattern":"[url:value = 'http://t6pz3lfor4iiryloxvbcjdweri5wlapz4trgejutgfmjywgmly3tkkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72683058-4516-6e65-c4a1-00000af6e54d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vnlavzuaid5livo7pvoi4vrzumxdjij36j2g42y4scawz5uu7rvbb4id.onion/","pattern":"[url:value = 'http://vnlavzuaid5livo7pvoi4vrzumxdjij36j2g42y4scawz5uu7rvbb4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99d79aa2-13ee-740e-ba72-0000bd93e9de","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://djgo53imoatb7pnuxfqbzyztlvs6c7ukxsisqmoe3akgsnm4wpftj7qd.onion/","pattern":"[url:value = 'http://djgo53imoatb7pnuxfqbzyztlvs6c7ukxsisqmoe3akgsnm4wpftj7qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d153163-1f5a-2200-511e-00001567d3c3","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vc6vhxxlg2tzyjr7zxh5trlpg5wwdmmk4olju3pwwwxkhc37xepjcjid.onion/","pattern":"[url:value = 'http://vc6vhxxlg2tzyjr7zxh5trlpg5wwdmmk4olju3pwwwxkhc37xepjcjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8740f289-a0ab-7686-f64b-00004ac4a789","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zq66s26zmbealswy3q3rffiu33mokc454knfajmztn3gdg5cpzgnjtqd.onion/","pattern":"[url:value = 'http://zq66s26zmbealswy3q3rffiu33mokc454knfajmztn3gdg5cpzgnjtqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--449908d3-9c21-9b9e-912f-00003ab36f6b","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://da763kyxwe3mf67gui5tb5igvpnt4w6cps5svrw2wkizyrzqgamdxtid.onion/","pattern":"[url:value = 'http://da763kyxwe3mf67gui5tb5igvpnt4w6cps5svrw2wkizyrzqgamdxtid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b0c56b3-a510-c020-600a-0000d639b325","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k3cjkwjpizsevar2u2nlgcufyvm4qrxt5tbl2jj6ec5nrburotsi2pad.onion/","pattern":"[url:value = 'http://k3cjkwjpizsevar2u2nlgcufyvm4qrxt5tbl2jj6ec5nrburotsi2pad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84e40565-8c8a-c227-3fe1-0000607a9ec5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://bfyonafayb2cufmvuf66sap2ht3inp4kfnfberiaoe5wrrep6mk4tmad.onion/","pattern":"[url:value = 'http://bfyonafayb2cufmvuf66sap2ht3inp4kfnfberiaoe5wrrep6mk4tmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--633afbb9-6b99-f6c3-a1db-00000fbd6196","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://s62ttv3adgplyinn42qetov7zrltff563qncpm67cwz73fesw7cw77yd.onion/","pattern":"[url:value = 'http://s62ttv3adgplyinn42qetov7zrltff563qncpm67cwz73fesw7cw77yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4ed52d7-008a-40e4-adaf-00002a86c7dc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3kn2i4ojapdjbq6jmty65h6g3b7n7a6mvjco64fqlyrp5d4aapewshid.onion/","pattern":"[url:value = 'http://3kn2i4ojapdjbq6jmty65h6g3b7n7a6mvjco64fqlyrp5d4aapewshid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffced338-1c38-b620-f0c6-000008c78812","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://532czmzrh6qmtdlb5qgkx5h7k5sltwnfvesz2r4mz64aalybgkctaead.onion/","pattern":"[url:value = 'http://532czmzrh6qmtdlb5qgkx5h7k5sltwnfvesz2r4mz64aalybgkctaead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d688d29e-9159-461f-0212-000053967c0d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://g7gg4zgd2grbrkdlibnnjzjvvnrwnwbznalxle3q5dzrsxsjoihiwsid.onion/","pattern":"[url:value = 'http://g7gg4zgd2grbrkdlibnnjzjvvnrwnwbznalxle3q5dzrsxsjoihiwsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a43b1c5a-b3d8-7336-5b75-0000c2215a15","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://5vjjiplv4jgrmfdgwcusmvezy575qsg2jpvsc2327lq4qckuwthwksad.onion/","pattern":"[url:value = 'http://5vjjiplv4jgrmfdgwcusmvezy575qsg2jpvsc2327lq4qckuwthwksad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24cce278-1464-0d14-d8f5-0000500e6397","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sstqoba32bw5mnrwm27rbkiap37g2y5qjcmosuhph5nuu2ffvn66jjyd.onion/","pattern":"[url:value = 'http://sstqoba32bw5mnrwm27rbkiap37g2y5qjcmosuhph5nuu2ffvn66jjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c59ef3ab-a402-477c-fe8e-0000097dfbd7","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sdt4obvwnm64vfwnes45flcmumrec6243kukweocvadcyxhgzlabfxqd.onion/","pattern":"[url:value = 'http://sdt4obvwnm64vfwnes45flcmumrec6243kukweocvadcyxhgzlabfxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ec7ed02-abaf-5628-12b7-000019224bec","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://q6galqnjt7urxigo5niyj2u7r3lyon6vgjl2u2w2vme4gdqits4rcgid.onion/","pattern":"[url:value = 'http://q6galqnjt7urxigo5niyj2u7r3lyon6vgjl2u2w2vme4gdqits4rcgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fbc4e54-11d6-07dc-2ce3-000033ee5ea1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6odtogvgsoxe4jjyymtdezascllx5kqtirvd2v74344xlqynzhguxdad.onion/","pattern":"[url:value = 'http://6odtogvgsoxe4jjyymtdezascllx5kqtirvd2v74344xlqynzhguxdad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--564a9236-d1c4-d847-dc0f-000001ee9ccc","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vxes6h3473wxne3ngbm7qufqz7yrfnqytkmz2or4c3lk56at5n6c4ead.onion/","pattern":"[url:value = 'http://vxes6h3473wxne3ngbm7qufqz7yrfnqytkmz2or4c3lk56at5n6c4ead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85d2ceda-5f09-44c0-2256-000049ccbcf5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://hunph22c2k7etozzdipkmgxzvcfn4boj2imlbtlsw4eiqi4hl7laksad.onion/","pattern":"[url:value = 'http://hunph22c2k7etozzdipkmgxzvcfn4boj2imlbtlsw4eiqi4hl7laksad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aed9abdc-9ae4-4380-e6ed-0000c2198606","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://gcktgfv5brwdyzwykxwgbfhho3oecbbddgrzr5jpzwn44q2wssettaad.onion/","pattern":"[url:value = 'http://gcktgfv5brwdyzwykxwgbfhho3oecbbddgrzr5jpzwn44q2wssettaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9cfb9f2-83de-ab66-8dc9-00007cea2819","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uvfooehu6f2q3wcccuffagahp4w7qbypjjmffseqypjgorkqpuwql4ad.onion/","pattern":"[url:value = 'http://uvfooehu6f2q3wcccuffagahp4w7qbypjjmffseqypjgorkqpuwql4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1975dbc3-05f2-4793-5130-0000253cf4c9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://77uadf5cgivrz77fvnbbrhcvgckimzrvogqzxknhlfs5eoq7lpipu6id.onion/","pattern":"[url:value = 'http://77uadf5cgivrz77fvnbbrhcvgckimzrvogqzxknhlfs5eoq7lpipu6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--553f88dc-e70d-f908-64b2-000035d9b6d1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://sv2rykeah2bm7vz47l5k3f5otbptgyyeooalayn57p6ncpwbehbk5sid.onion/","pattern":"[url:value = 'http://sv2rykeah2bm7vz47l5k3f5otbptgyyeooalayn57p6ncpwbehbk5sid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c76ef5a-84f0-e2ba-b2bf-0000f5ddd5fe","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://fql4rjc3cojkhqxebgivm6wwimlri5muxlgb4g34sroeghg3bsc3btqd.onion/","pattern":"[url:value = 'http://fql4rjc3cojkhqxebgivm6wwimlri5muxlgb4g34sroeghg3bsc3btqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--647d2027-f13c-337a-d426-000072443c8c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6mrsgpztpbiqvfh6atsfsdmecpicppol3tukrgot3n2kgz4k3gmakzqd.onion/","pattern":"[url:value = 'http://6mrsgpztpbiqvfh6atsfsdmecpicppol3tukrgot3n2kgz4k3gmakzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d32bc68d-30c6-6316-91a1-00002c874426","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://xwgvbowiwiscowkagkpw4qjx62li4z4lhzkyyzhda46kcanddxlrn6ad.onion/","pattern":"[url:value = 'http://xwgvbowiwiscowkagkpw4qjx62li4z4lhzkyyzhda46kcanddxlrn6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d596a04-38b6-f5c8-ba87-00007eda8792","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k43uuv3dxxbilh66glvhmv6ym2xkggn743al22e74tb2v2fcq6sbzpad.onion/","pattern":"[url:value = 'http://k43uuv3dxxbilh66glvhmv6ym2xkggn743al22e74tb2v2fcq6sbzpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f70215e-ce08-3a11-24d7-00004ece2254","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mbarp6qt6kpkuruwkwqrxqbizna3is3mv3c6ocjrrwxl5ndnkhalkzid.onion/","pattern":"[url:value = 'http://mbarp6qt6kpkuruwkwqrxqbizna3is3mv3c6ocjrrwxl5ndnkhalkzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--779e0122-aba7-c9d1-d3b8-0000c1135855","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://x3iaxenhnhfvezxmocl5ijtkeiom3cchwks5ecvtv6zzkf673rdtetqd.onion/","pattern":"[url:value = 'http://x3iaxenhnhfvezxmocl5ijtkeiom3cchwks5ecvtv6zzkf673rdtetqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77319ca6-e32f-1447-8387-0000a5a9a127","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nkqfcj26xcdfjezwircbrmlhttr4rbnybsa3wycnpf47g73thbhc3lyd.onion/","pattern":"[url:value = 'http://nkqfcj26xcdfjezwircbrmlhttr4rbnybsa3wycnpf47g73thbhc3lyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--327b99f6-a05c-5f26-e0e1-0000226bd319","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3bqilvjhoamv442irjwdd7fkdvhfg2uw6km4msvmv6ho3lw5crk7uwad.onion/","pattern":"[url:value = 'http://3bqilvjhoamv442irjwdd7fkdvhfg2uw6km4msvmv6ho3lw5crk7uwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fffd5f5-a5b8-6a95-527e-000096342a5d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://am7c55v7dmhdbfjyydxf6ccp2cluypvszxmcbdnkpu5vpsp4xqkh2ryd.onion/","pattern":"[url:value = 'http://am7c55v7dmhdbfjyydxf6ccp2cluypvszxmcbdnkpu5vpsp4xqkh2ryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f76df0e-34ca-2190-fd78-0000412e6502","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ecg6r6hpb7dzutga3jsrwm3z2jfvxbkncx2ftfw5eqpbua573s5esaid.onion/","pattern":"[url:value = 'http://ecg6r6hpb7dzutga3jsrwm3z2jfvxbkncx2ftfw5eqpbua573s5esaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13a93c6e-1a93-fa98-5f7e-00006ac6c124","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qbopuabaqyjdcb74xe2pwbvqnqdzvdvyiqhho5optgtmxinwmrhq7qad.onion/","pattern":"[url:value = 'http://qbopuabaqyjdcb74xe2pwbvqnqdzvdvyiqhho5optgtmxinwmrhq7qad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2076e078-2e0f-298a-1dbe-0000498c5b83","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://4626donogy6tdfvh6hwuwxvpyni3uwwx26v4pp7eswp5ipwqgpuidyyd.onion/","pattern":"[url:value = 'http://4626donogy6tdfvh6hwuwxvpyni3uwwx26v4pp7eswp5ipwqgpuidyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87653263-dfdd-f83a-0bd0-00006e4ff1f6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cusz5oqgec5a7wsoi5rxv27oswfliropmc2sg5tov4mc7ozkbxsj7kyd.onion/","pattern":"[url:value = 'http://cusz5oqgec5a7wsoi5rxv27oswfliropmc2sg5tov4mc7ozkbxsj7kyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bebd4fc-6cd6-6a01-ab1b-00009a24f46a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://skbpwl43abthuqxvoy5mzabn7lj4afa64xhpbuw2i4k7vvqvmbotw5id.onion/","pattern":"[url:value = 'http://skbpwl43abthuqxvoy5mzabn7lj4afa64xhpbuw2i4k7vvqvmbotw5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e40c2ff3-398f-82c0-4fd0-0000585efc85","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yqotxqmc4gjofhiyp7wvhwqcbc3cszrsvjt4n3uqq3i3pilxhmdxtzqd.onion/","pattern":"[url:value = 'http://yqotxqmc4gjofhiyp7wvhwqcbc3cszrsvjt4n3uqq3i3pilxhmdxtzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5474090e-9825-512d-efd1-00007842669c","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iadt27m7yxkouefkcgdettyepemal4jins3htxkhpvhl7w2dgapprnid.onion/","pattern":"[url:value = 'http://iadt27m7yxkouefkcgdettyepemal4jins3htxkhpvhl7w2dgapprnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e7f1fe7-dc0b-fa39-5235-0000553be1d6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nklp3mw3ne5h5ndzo6l2riesmseg2wcbj2tgethqmrsknly4q23ziuqd.onion/","pattern":"[url:value = 'http://nklp3mw3ne5h5ndzo6l2riesmseg2wcbj2tgethqmrsknly4q23ziuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cff71eca-2786-a1a1-556f-00009fd60e97","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vvocdlrov5pc5ej5iuba35vfjehegbdcgnthkt5xr7acekjb4l7y74id.onion/","pattern":"[url:value = 'http://vvocdlrov5pc5ej5iuba35vfjehegbdcgnthkt5xr7acekjb4l7y74id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f70b3c1c-7022-65fd-9029-0000056bbf3a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vwgq5uld5govh3va4ybcda47cye2wd2jnaqy5si56qm3t47dtafy2zqd.onion/","pattern":"[url:value = 'http://vwgq5uld5govh3va4ybcda47cye2wd2jnaqy5si56qm3t47dtafy2zqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eea5e712-5055-c7ba-7eea-00005c570012","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ns7ed6yloo7w5p2lh3mg5bcmkv3aip6wwn7kagb7pxouetm4ymfvsiad.onion/","pattern":"[url:value = 'http://ns7ed6yloo7w5p2lh3mg5bcmkv3aip6wwn7kagb7pxouetm4ymfvsiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcc5ccf7-5997-7e00-9cc4-0000c8bc8e5a","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ajs5cguwcrm7hocjyswds6hm6hamfrp2zoqfywq7or2j6yvycfo2mpid.onion/","pattern":"[url:value = 'http://ajs5cguwcrm7hocjyswds6hm6hamfrp2zoqfywq7or2j6yvycfo2mpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8efcd261-12ec-58e0-33cd-0000ba66fd9d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://qq4kljefxqsslnl45bxho57meuwpxgn2vdgonlzhmlebnywhst5fupyd.onion/","pattern":"[url:value = 'http://qq4kljefxqsslnl45bxho57meuwpxgn2vdgonlzhmlebnywhst5fupyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5f46ec7-113e-950f-f29a-00002138b582","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://tl7m4jpgd5zrrv5lvkl33viucmgztwu6vvr3wqqb7pvlp7i2mavq2jyd.onion/","pattern":"[url:value = 'http://tl7m4jpgd5zrrv5lvkl33viucmgztwu6vvr3wqqb7pvlp7i2mavq2jyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c6a34ba-2a77-f611-169f-00002af245e5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://am26uhnrvhikyekz7h5qgjhv6x4arnzpcr2tw4wxqdg7hw525xs4o2qd.onion","pattern":"[url:value = 'http://am26uhnrvhikyekz7h5qgjhv6x4arnzpcr2tw4wxqdg7hw525xs4o2qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa846f28-2250-03f2-88bb-0000ca98620d","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://dbxgloxt65pvn37ec2of3np4rzo2ksgntxtxbpc4q3sxiur2aiohwqyd.onion/","pattern":"[url:value = 'http://dbxgloxt65pvn37ec2of3np4rzo2ksgntxtxbpc4q3sxiur2aiohwqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b69bf05-ba3b-1d13-f9a5-0000a58eecb5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://3wahjydjf6min3z67a3254l3uoftkccvn3or3itdppjiz4oogceuy6ad.onion/","pattern":"[url:value = 'http://3wahjydjf6min3z67a3254l3uoftkccvn3or3itdppjiz4oogceuy6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56c18494-6886-4632-2708-0000bde0fabd","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cwywajs3ounh4rioelodfprm72544iokpmttlbitzxmjgqoummdpmqid.onion/","pattern":"[url:value = 'http://cwywajs3ounh4rioelodfprm72544iokpmttlbitzxmjgqoummdpmqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cccc9326-c403-adfa-fd74-000000082872","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://rthvusw7vbnulb27tsiacrlewiykoda4wvefeshtsj4bx53o4j6mfrid.onion/","pattern":"[url:value = 'http://rthvusw7vbnulb27tsiacrlewiykoda4wvefeshtsj4bx53o4j6mfrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4edc0e73-fc49-7ef8-b22b-0000b3272098","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://naurcsrhvsnxotv5awcsmddlcwgv447fvolmkyo6gfgszvtofijd6oid.onion/","pattern":"[url:value = 'http://naurcsrhvsnxotv5awcsmddlcwgv447fvolmkyo6gfgszvtofijd6oid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6e15646-20f9-931d-e565-0000bb8d9c56","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nlqnxzqixcwazwyib4bft2m6ikjrtihh4qgdtnmpmbi3meio5jj2xsad.onion/","pattern":"[url:value = 'http://nlqnxzqixcwazwyib4bft2m6ikjrtihh4qgdtnmpmbi3meio5jj2xsad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6797c546-7ffd-376d-19d4-000058879157","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://cqwdv5rxut5l3blbeg74ddfo6ya65xsxqan7vawffdng6ynd2kulfkqd.onion/","pattern":"[url:value = 'http://cqwdv5rxut5l3blbeg74ddfo6ya65xsxqan7vawffdng6ynd2kulfkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f84af7fd-084e-b2b5-3478-0000849e7a21","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://secxrosqawaefsio3biv2dmi2c5yunf3t7ilwf54czq3v4bi7w6mbfad.onion/","pattern":"[url:value = 'http://secxrosqawaefsio3biv2dmi2c5yunf3t7ilwf54czq3v4bi7w6mbfad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b97c8ee-eb0b-8f35-7778-00003a42e39e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://zv7u2tclxajbgae6ba4jkisnkfkts3lk7lxlypmuqktrk42qmo2c7hqd.onion/","pattern":"[url:value = 'http://zv7u2tclxajbgae6ba4jkisnkfkts3lk7lxlypmuqktrk42qmo2c7hqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e5163ad-d7c7-32aa-aa48-0000776ad2c5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://k2xhcuvhwh5cyua5vwa4xjeyvyfatzkrh5yn5kc5munvglzge4cod2ad.onion/","pattern":"[url:value = 'http://k2xhcuvhwh5cyua5vwa4xjeyvyfatzkrh5yn5kc5munvglzge4cod2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76c6559e-8b5b-18e9-300b-0000b6301eb6","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://kinkwgtp4sfj3tovixjlvsklktjul7v5o55lkf6cgmlnugqlletzsxad.onion/","pattern":"[url:value = 'http://kinkwgtp4sfj3tovixjlvsklktjul7v5o55lkf6cgmlnugqlletzsxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f659ca2c-3480-b0a6-a136-0000e6832c48","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://6ibv6c5n6orfgzpt4apgqtrbr3ot2ninpbpi6hwolq2lzcgj6lzj4rid.onion/","pattern":"[url:value = 'http://6ibv6c5n6orfgzpt4apgqtrbr3ot2ninpbpi6hwolq2lzcgj6lzj4rid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9e24adf-1421-da4e-5ed5-0000363113c1","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://43xvcojnfpqlbjxrbuuulyh3xtqrkl3qboi67xxd4jsigmpccbhxcoid.onion/","pattern":"[url:value = 'http://43xvcojnfpqlbjxrbuuulyh3xtqrkl3qboi67xxd4jsigmpccbhxcoid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5932db0f-f958-ba43-a7b7-000055314f9e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://l2abuimje7jrypvv57p2ihf36rza2etoobyvsddgxqrsssn7tyb7txid.onion/","pattern":"[url:value = 'http://l2abuimje7jrypvv57p2ihf36rza2etoobyvsddgxqrsssn7tyb7txid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e43eeb0-9bf8-2ca7-ce80-00001e007578","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://yj2xh4wxcjncsgj7642jzky7uf4mrjcp6zrcdgxylxbepyvgv4meljqd.onion/","pattern":"[url:value = 'http://yj2xh4wxcjncsgj7642jzky7uf4mrjcp6zrcdgxylxbepyvgv4meljqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57184636-46f6-aad1-a258-000061dfac0e","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://ozokx66qqmtvjbkbkudtfnrfy5euwug2gbekqm6ug42j76knmtzcrkid.onion/","pattern":"[url:value = 'http://ozokx66qqmtvjbkbkudtfnrfy5euwug2gbekqm6ug42j76knmtzcrkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60f6abd0-fec5-4e8f-6444-000060d242f5","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://d7akeguwmrxmrg7tgzx7a73mksq3zpcjjk2c4jibfhmvrhhd6oprsfyd.onion/","pattern":"[url:value = 'http://d7akeguwmrxmrg7tgzx7a73mksq3zpcjjk2c4jibfhmvrhhd6oprsfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d0394c6-365e-636e-e4e9-0000ed70b165","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2xipgq7vsu6d6llgg4tr4wxwdc5tbmmtx3jxfax3kx2dorkcnzsimwqd.onion/","pattern":"[url:value = 'http://2xipgq7vsu6d6llgg4tr4wxwdc5tbmmtx3jxfax3kx2dorkcnzsimwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--199341f3-9236-91b5-7a5f-0000c3903484","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://jt772jtwpfrluifvz34ti43kfgv6lz7bgiviwopl73slo6a3wetch4yd.onion/","pattern":"[url:value = 'http://jt772jtwpfrluifvz34ti43kfgv6lz7bgiviwopl73slo6a3wetch4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dad9f6a6-02ad-d2e8-0bcd-0000946a48ed","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://nxml7szv4m3hd6gtjjg62xejyusbbqvmb3thfwaa6wimablrzuk7p3qd.onion/","pattern":"[url:value = 'http://nxml7szv4m3hd6gtjjg62xejyusbbqvmb3thfwaa6wimablrzuk7p3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8757b951-74ae-128c-4d83-00005900d008","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://lc6wrbsdvaayqkhj47bjkj7mfnaiyvsnufmdnkhai6de3uxhu6bssgyd.onion/","pattern":"[url:value = 'http://lc6wrbsdvaayqkhj47bjkj7mfnaiyvsnufmdnkhai6de3uxhu6bssgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b48e591-d10d-c001-48d4-000053a959e9","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://utijlj5t2xamyekjr3ur7vpdnttaqit57fher2nzibih3nqil75jhjyd.onion/","pattern":"[url:value = 'http://utijlj5t2xamyekjr3ur7vpdnttaqit57fher2nzibih3nqil75jhjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17da83d9-321e-310a-c975-00000086bb44","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://n7f7ic7islqbyw3vzans3mddgaooirbf4i75tvsfvxjvni7vxanwczad.onion/","pattern":"[url:value = 'http://n7f7ic7islqbyw3vzans3mddgaooirbf4i75tvsfvxjvni7vxanwczad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56f6da05-f44e-5e93-ab35-0000ddb4fdaf","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uiecrea6byqjfppofxjcku2rjs6qxeqblnc7ljveopbtd4ih635saiid.onion/","pattern":"[url:value = 'http://uiecrea6byqjfppofxjcku2rjs6qxeqblnc7ljveopbtd4ih635saiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dff654f5-e5d0-4bf0-23c5-0000cd703b33","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://iwtkvmhwx7g743ytqj6yiibbb33a3ycezssyn6gai2hny7b2ynez6sad.onion/","pattern":"[url:value = 'http://iwtkvmhwx7g743ytqj6yiibbb33a3ycezssyn6gai2hny7b2ynez6sad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05c721d3-67cd-22f2-3fb2-0000f2268c32","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://mdpkohdcvgyiexi4yihiufdi2wmau5yd6wjr7rituvwntifxuh43deyd.onion/","pattern":"[url:value = 'http://mdpkohdcvgyiexi4yihiufdi2wmau5yd6wjr7rituvwntifxuh43deyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da41f1cb-836f-218b-54b0-000065f09d2f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://vokr3ancppaevval5hwpqpm43szyj7nysfoxqfsrc274jabs5m2227yd.onion/","pattern":"[url:value = 'http://vokr3ancppaevval5hwpqpm43szyj7nysfoxqfsrc274jabs5m2227yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b29085d8-799f-bb80-287a-0000c117dede","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://w6kf2ktnbzx3hha25snxdwg57ydqdskzcs5tdrdztajb2vn7jk5hzrid.onion/","pattern":"[url:value = 'http://w6kf2ktnbzx3hha25snxdwg57ydqdskzcs5tdrdztajb2vn7jk5hzrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5732e482-9129-0d5f-a9a8-0000e402ed7f","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://uax2s63op7lboqhuxscjfiwcea4retnus6z2ph33cd44dyqdsyosj6id.onion/","pattern":"[url:value = 'http://uax2s63op7lboqhuxscjfiwcea4retnus6z2ph33cd44dyqdsyosj6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--568a7e31-7022-d8e6-241f-00006d0ef419","created":"2026-08-06T13:13:02-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: http://2ntyvlixm5zzhn2zgowgbbu5s6forpttomntefg5dapivr5qwokkyvyd.onion/","pattern":"[url:value = 'http://2ntyvlixm5zzhn2zgowgbbu5s6forpttomntefg5dapivr5qwokkyvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:02-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--903164bc-bb96-ac7a-79bb-0000687decd3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dfhu2iceszxurn7lf5mb5xhainmb7vulpizncjomtn4w5j5cv3pz52qd.onion/","pattern":"[url:value = 'http://dfhu2iceszxurn7lf5mb5xhainmb7vulpizncjomtn4w5j5cv3pz52qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bb9327c-39d2-926a-7caa-0000f6508bf8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rivdgsucnasob3iiux5j4g4ybqz6flxgx2vz4h6i2wfu42hbbmwwcuqd.onion/","pattern":"[url:value = 'http://rivdgsucnasob3iiux5j4g4ybqz6flxgx2vz4h6i2wfu42hbbmwwcuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--661ed1de-6d69-f4b4-3ddb-0000114d94cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ib3ru7m66tg37w6o7zxe4upntw2p7236c63wb5n3beeapiuor535vhad.onion/","pattern":"[url:value = 'http://ib3ru7m66tg37w6o7zxe4upntw2p7236c63wb5n3beeapiuor535vhad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b48eb476-36ac-a659-b007-00002ea39463","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tlr5h3my4jyvwgmyrvu2oadls2o3f377cz2bqnu3g7oaycofiweqjfyd.onion/","pattern":"[url:value = 'http://tlr5h3my4jyvwgmyrvu2oadls2o3f377cz2bqnu3g7oaycofiweqjfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fe7e028-1621-b1b8-af33-0000a238d6ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2f7k6jhxwbpiyuomb27eywzollahlje2xph3t5wckupkoeluantatbad.onion/","pattern":"[url:value = 'http://2f7k6jhxwbpiyuomb27eywzollahlje2xph3t5wckupkoeluantatbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2966c98b-5e55-fcea-749a-0000a7ff198c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://x3rx5uqoohqzfcnq3neiqwunb6eh5yc4ybu26nxwqqltclkvdvwbprad.onion/","pattern":"[url:value = 'http://x3rx5uqoohqzfcnq3neiqwunb6eh5yc4ybu26nxwqqltclkvdvwbprad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--198366d9-47d3-fe3e-01d6-0000313855b3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kp5amzgfhwmpn26vnmx7h445x4xb7ofaxitonovt6mlewq5bpawkq7id.onion/","pattern":"[url:value = 'http://kp5amzgfhwmpn26vnmx7h445x4xb7ofaxitonovt6mlewq5bpawkq7id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b75a42fa-a491-3b61-9b02-000005d42672","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zz7ez3cgy6o4eehu5bc2cs7t4jvq7j7duragx3pfrgnafxui7l2ybzqd.onion/","pattern":"[url:value = 'http://zz7ez3cgy6o4eehu5bc2cs7t4jvq7j7duragx3pfrgnafxui7l2ybzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33ed17c2-e6db-69ac-c0c3-0000bd651de0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7izw24yz3udwtvfoq4lshv2ibow6jahx4lojoxsdt2nkqzzpr7osoxad.onion/","pattern":"[url:value = 'http://7izw24yz3udwtvfoq4lshv2ibow6jahx4lojoxsdt2nkqzzpr7osoxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95cb8480-243a-532c-5baa-0000461a18cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://374ydckkglmslkqy3coatm5nn2rk3hg43lgci4wrhizhr47zfyfbdead.onion/","pattern":"[url:value = 'http://374ydckkglmslkqy3coatm5nn2rk3hg43lgci4wrhizhr47zfyfbdead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2551a10c-2f01-cdad-da2d-0000561c5025","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fmrsmdsuokgzj5oujoqcod23gnvkqptg3vzbcqz6vw2ci7gonigijuyd.onion/","pattern":"[url:value = 'http://fmrsmdsuokgzj5oujoqcod23gnvkqptg3vzbcqz6vw2ci7gonigijuyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08f1a3bb-1ae3-640b-e715-000072ed79f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gomf6ssy2bgsxlfbawncxdydwa4m76i4gzbwusmdwepuamx46uu6eqyd.onion/","pattern":"[url:value = 'http://gomf6ssy2bgsxlfbawncxdydwa4m76i4gzbwusmdwepuamx46uu6eqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f36b7e6-bf13-5a53-cb3d-00003d274415","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qiu5vqx2k3oyq3aeyz3pieh6g6yjzo7l5zofidxfvnahy3vgb2vuy6ad.onion/","pattern":"[url:value = 'http://qiu5vqx2k3oyq3aeyz3pieh6g6yjzo7l5zofidxfvnahy3vgb2vuy6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--203fd178-da14-d7d9-7c78-000080d1a505","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2ynd4lgi277los7ykngk3my3rx3ehitx4agrpomrilwjic4iqisbikid.onion/","pattern":"[url:value = 'http://2ynd4lgi277los7ykngk3my3rx3ehitx4agrpomrilwjic4iqisbikid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1442ba0c-b5c0-f52f-d0c7-00007b94da50","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4hmvksa7vw5x3mytrguzcjxvj3alfbapxaekudmiigpztqxxv7dynnqd.onion/","pattern":"[url:value = 'http://4hmvksa7vw5x3mytrguzcjxvj3alfbapxaekudmiigpztqxxv7dynnqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0671e5c3-c501-32c1-e6ea-000063942bb2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xbpdja46coptbjt4a62lintyk547q54k7gubekbtsyqxivie4vln7syd.onion/","pattern":"[url:value = 'http://xbpdja46coptbjt4a62lintyk547q54k7gubekbtsyqxivie4vln7syd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--485a85de-b735-313b-1a51-0000be2b8938","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2yce6tllc6xin4kucqr4aynscfjsg7l7pgz3pv7rat5o3vjeruxpknid.onion/","pattern":"[url:value = 'http://2yce6tllc6xin4kucqr4aynscfjsg7l7pgz3pv7rat5o3vjeruxpknid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5190d3ef-0a44-940b-324e-00000cd2d7fa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zdgj7z7dhmn5xgtrj4wh4gsf35hzst6blunfm3xf5iqpq6msiluxmmid.onion/","pattern":"[url:value = 'http://zdgj7z7dhmn5xgtrj4wh4gsf35hzst6blunfm3xf5iqpq6msiluxmmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2617a61a-805b-3d75-7a72-00009e49fd86","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jhtym7doz6dt5xdq4dd5wuhmyaa6dtesv4lrnasb5scwofguffiewcqd.onion/","pattern":"[url:value = 'http://jhtym7doz6dt5xdq4dd5wuhmyaa6dtesv4lrnasb5scwofguffiewcqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc828703-9ffd-3503-acaa-0000814417cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yiqfcld3loz7rh4kcmxrf4azyeqa7sonfyxqlnjjbxmmfxhzbm2vsjad.onion/","pattern":"[url:value = 'http://yiqfcld3loz7rh4kcmxrf4azyeqa7sonfyxqlnjjbxmmfxhzbm2vsjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--393dd806-3a81-a9c3-2189-0000e1723a23","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tbgdp3msmgiddu7yhdo2fsuhlaggcoj3oez7wdmofznqm4dhevpekeyd.onion/","pattern":"[url:value = 'http://tbgdp3msmgiddu7yhdo2fsuhlaggcoj3oez7wdmofznqm4dhevpekeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd16c8c5-2a0e-68ed-c39a-000094e5f9ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zlwljlbtakummd6biufuvljgqwbpvmrftd5kjtzxwjtn27jdzeahm5ad.onion/","pattern":"[url:value = 'http://zlwljlbtakummd6biufuvljgqwbpvmrftd5kjtzxwjtn27jdzeahm5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a5ee706-37e1-6499-44a4-00006d1720ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m5ubrfq5bgwcckdxb3g3fcughlfntzv6kcvhw7bdkqsx7johtljefaqd.onion/","pattern":"[url:value = 'http://m5ubrfq5bgwcckdxb3g3fcughlfntzv6kcvhw7bdkqsx7johtljefaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d076ea3-6907-d188-c5fd-00004a527540","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4dmex5fuyap32y6lkpglp5cy3ivoua452o57cezsxhfdlnhgvlw6sxid.onion/","pattern":"[url:value = 'http://4dmex5fuyap32y6lkpglp5cy3ivoua452o57cezsxhfdlnhgvlw6sxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8b45dc3-a71e-fae3-7994-0000a48639f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4s2org6ns4uhmamkr2tshq6f6auusktjjdoo23rskwhxfdlxlnx5rnyd.onion/","pattern":"[url:value = 'http://4s2org6ns4uhmamkr2tshq6f6auusktjjdoo23rskwhxfdlxlnx5rnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b703f1f-3d3f-5c14-8d83-0000ebd7fa78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vksaeydmtcfee2qiwbdxb7lijqtwxzy55g4ft72vjvmjvxyuppskdwad.onion/","pattern":"[url:value = 'http://vksaeydmtcfee2qiwbdxb7lijqtwxzy55g4ft72vjvmjvxyuppskdwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--989c7938-0c20-d13d-8f14-0000d94aecce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://oxbwvjzd2oc4cb4jkrnpwbuvabyj2pgmoh6q73jsuq35skfbta3p3uad.onion/","pattern":"[url:value = 'http://oxbwvjzd2oc4cb4jkrnpwbuvabyj2pgmoh6q73jsuq35skfbta3p3uad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b720d504-6806-b090-b42e-0000345efc57","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4sw54rh5et4adx7oj6sl2kqkra243dq3dyhlxmoyt7vez6vncufv2gyd.onion/","pattern":"[url:value = 'http://4sw54rh5et4adx7oj6sl2kqkra243dq3dyhlxmoyt7vez6vncufv2gyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90c983b8-641c-b13a-a27b-0000cd2d5b0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tgcj6ad5dqmuayc7ldm3zw4bz3hx45nf54oe7vqtfs4hai4wsgbnseyd.onion/","pattern":"[url:value = 'http://tgcj6ad5dqmuayc7ldm3zw4bz3hx45nf54oe7vqtfs4hai4wsgbnseyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70f042ce-b10c-271c-f874-000010b5210f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://obrze5nyt6pmx4ptffqliah7hxqb3je6jlghg7ynoy653nqvye43koid.onion/","pattern":"[url:value = 'http://obrze5nyt6pmx4ptffqliah7hxqb3je6jlghg7ynoy653nqvye43koid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13d7726d-dc5e-e4ae-0a6d-0000b1c741cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7kobff7iod6tmnyjgoqc4o367ufky2cvda4knnlvo2hakdzy4v4gffqd.onion/","pattern":"[url:value = 'http://7kobff7iod6tmnyjgoqc4o367ufky2cvda4knnlvo2hakdzy4v4gffqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d324b1c-62b7-5c0d-26ae-00003a10d869","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lejfkugm7arhigu2vhtcursl564e73gjrq23upuaccuafbj73rgbnfid.onion/","pattern":"[url:value = 'http://lejfkugm7arhigu2vhtcursl564e73gjrq23upuaccuafbj73rgbnfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bf7c501-4772-66e6-4f33-000060e06b16","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://77k3qrvleqx3jn5mx73fpmhcfpk3pdrjs7tkgaxcsf4ojgizfhvmlhid.onion/","pattern":"[url:value = 'http://77k3qrvleqx3jn5mx73fpmhcfpk3pdrjs7tkgaxcsf4ojgizfhvmlhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0d2808a-0bcb-2ea3-4a26-00004b8af0ab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hqvcotd73c6hjfc3ogukvc37jgs2krmowyposqudq2rodtawmatxpyad.onion/","pattern":"[url:value = 'http://hqvcotd73c6hjfc3ogukvc37jgs2krmowyposqudq2rodtawmatxpyad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c01a64e0-6e79-8c52-1c0a-0000a167c217","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lxgnxg3cdv4uq2ps4e5i66bykvol6rw7bsvr5chdpksusiqwhyx7cxqd.onion/","pattern":"[url:value = 'http://lxgnxg3cdv4uq2ps4e5i66bykvol6rw7bsvr5chdpksusiqwhyx7cxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c45fcca4-08aa-9982-db1a-0000b69c64f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftgvamayqmlyjkpf3dosoyfafbfpxxtxagsnt45sqauulckwupr2guid.onion/","pattern":"[url:value = 'http://ftgvamayqmlyjkpf3dosoyfafbfpxxtxagsnt45sqauulckwupr2guid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4791c23e-f9b2-4397-e688-0000a4479b6d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uzf4tt7buqhj5xzb7jnnmsd4wtufua4qyzjgjf4sn2vwniiqz5oi5lid.onion/","pattern":"[url:value = 'http://uzf4tt7buqhj5xzb7jnnmsd4wtufua4qyzjgjf4sn2vwniiqz5oi5lid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db8e7a5d-2ce7-718a-cca9-00004fc2c7cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pi25hxaofhsoxjh5g4e6iqcasoynlwygevqkbemzaalkyxwpgk77tqid.onion/","pattern":"[url:value = 'http://pi25hxaofhsoxjh5g4e6iqcasoynlwygevqkbemzaalkyxwpgk77tqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d600e80-a0aa-5a5e-9d0c-0000c6721285","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gxru2ucw4yxkicwdiee6wpqwkogh2x3scfcnhcgb4lcyo4uid44734qd.onion/","pattern":"[url:value = 'http://gxru2ucw4yxkicwdiee6wpqwkogh2x3scfcnhcgb4lcyo4uid44734qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fafb779-2237-4805-b3ac-000042bb9068","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://enppltlenqakx4lyekcz5xmlhybemrii7l4gjnijs2mqvwr26jp73fad.onion/","pattern":"[url:value = 'http://enppltlenqakx4lyekcz5xmlhybemrii7l4gjnijs2mqvwr26jp73fad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--782c042e-e09f-3410-616b-0000901187db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jv2txdk66t6ijaugve3kte67yuahfaebrivy4okuqqvriaagsvi4pgad.onion/","pattern":"[url:value = 'http://jv2txdk66t6ijaugve3kte67yuahfaebrivy4okuqqvriaagsvi4pgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57df733a-0dc3-edd9-bf81-0000cff4c0cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://py5fgtglinssndrkrnbwgwjzxlsxl5zbyr3ypdiijgsllht2smznwpqd.onion/","pattern":"[url:value = 'http://py5fgtglinssndrkrnbwgwjzxlsxl5zbyr3ypdiijgsllht2smznwpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a884c9de-a3f3-ad43-569e-0000838c7602","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mo3nqtrrrvguce64bvenu25uciry7buw2hzke4wxm22jhr57zmsj65qd.onion/","pattern":"[url:value = 'http://mo3nqtrrrvguce64bvenu25uciry7buw2hzke4wxm22jhr57zmsj65qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b41588b-232b-553f-dc00-00006aaf179e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ondvd45cnciqs7fzu5ewm5li2ib75bppxjaapcyilceauq5xpmzbswad.onion/","pattern":"[url:value = 'http://ondvd45cnciqs7fzu5ewm5li2ib75bppxjaapcyilceauq5xpmzbswad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c0dbaae-733c-1a8e-7c0b-0000470b0f07","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pol7t4rw4dymnyruiqkckbeul2xxntn7x3sek3yw553pxbwag3n4eeid.onion/","pattern":"[url:value = 'http://pol7t4rw4dymnyruiqkckbeul2xxntn7x3sek3yw553pxbwag3n4eeid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14b6e485-2034-b3a4-2bd3-00000b98bc80","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xf7e5nnpiemhu6lpb5f723i4amgshhj33ny6c5ctbdjtc5duwtortoad.onion/","pattern":"[url:value = 'http://xf7e5nnpiemhu6lpb5f723i4amgshhj33ny6c5ctbdjtc5duwtortoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c115d4c-d27f-91ce-793d-0000e85332bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://atpimkcvvlvyizwazff6r5ioq6nnb7txijdwvlq4i6d5b7adx6c5egyd.onion/","pattern":"[url:value = 'http://atpimkcvvlvyizwazff6r5ioq6nnb7txijdwvlq4i6d5b7adx6c5egyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2de6296d-b561-28a9-b749-0000b956c556","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5aidibsmc4wt5l3lw4k5wtfqopbckllb3pntw7xw4qiem4a3eeacrlyd.onion/","pattern":"[url:value = 'http://5aidibsmc4wt5l3lw4k5wtfqopbckllb3pntw7xw4qiem4a3eeacrlyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34f27bb6-6509-f0d3-4273-0000aaddf435","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kcikcoor63fa4qw6gx7yp2jxnvxbsxxdwd2znz72izt74rpdjfha2yqd.onion/","pattern":"[url:value = 'http://kcikcoor63fa4qw6gx7yp2jxnvxbsxxdwd2znz72izt74rpdjfha2yqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76af58d6-fdef-60a7-c3e4-00004979657f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vxpudlncob2ouf6pnic5khdwdb3j52ersb636c4xm3s2p2wxg6vyi4yd.onion/","pattern":"[url:value = 'http://vxpudlncob2ouf6pnic5khdwdb3j52ersb636c4xm3s2p2wxg6vyi4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a92ff4eb-03ab-1109-5bdd-00008ac063a6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zabhu2tvl3elihuccjzl4n35m27smgyxc5zkbgz3rcewjn6tjt2ihiad.onion/","pattern":"[url:value = 'http://zabhu2tvl3elihuccjzl4n35m27smgyxc5zkbgz3rcewjn6tjt2ihiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--923d158b-21c4-5773-c68f-000076cb1b58","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://otxn2ad3ypniexesajgomjnpwbkdjdit7uii2zv5v4c4u76r2rnlrtyd.onion/","pattern":"[url:value = 'http://otxn2ad3ypniexesajgomjnpwbkdjdit7uii2zv5v4c4u76r2rnlrtyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b0498fd-47fe-21b3-c150-0000f79f611d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://texnb5y3cjaf2srwfjkafdzznqc3idjlncqiiobhq4yzlqw6sgvbljqd.onion/","pattern":"[url:value = 'http://texnb5y3cjaf2srwfjkafdzznqc3idjlncqiiobhq4yzlqw6sgvbljqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d1e3546-e584-a425-4d12-0000d85f4b34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dj7ww4rxmvy5vsqxqn557p3nzjmt64q4fg57tteono6ezzm3nsmhgpad.onion/","pattern":"[url:value = 'http://dj7ww4rxmvy5vsqxqn557p3nzjmt64q4fg57tteono6ezzm3nsmhgpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0be11a2-360a-2513-03e3-0000518a718b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3vl65cye5nopltxxds73drcjddfq5wxwc2o5sm2rq3gddbs3ce7vn5ad.onion/","pattern":"[url:value = 'http://3vl65cye5nopltxxds73drcjddfq5wxwc2o5sm2rq3gddbs3ce7vn5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--771d6686-09cb-ffde-27ba-0000416f8213","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uiw34f2i7x5lz2l2r33a23h3q5h3dzvrmwyz5m65uwdgkdkappn7jkyd.onion/","pattern":"[url:value = 'http://uiw34f2i7x5lz2l2r33a23h3q5h3dzvrmwyz5m65uwdgkdkappn7jkyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07992b21-eb0d-d51e-3c0a-0000325abff7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://74zmq5sfydbci37dwwqd3ybkosw7wsuq5ymmc3fvyely45mtkvamh5yd.onionn/","pattern":"[url:value = 'http://74zmq5sfydbci37dwwqd3ybkosw7wsuq5ymmc3fvyely45mtkvamh5yd.onionn/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fbcec2f-74a5-ea55-a1cf-0000f77b071b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cxkk2csneiefspqrv75vw5766sw56t67tluuekk6mm2k4f7vagh7qbyd.onion/","pattern":"[url:value = 'http://cxkk2csneiefspqrv75vw5766sw56t67tluuekk6mm2k4f7vagh7qbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3e5736c-fd41-dea3-57fa-000061c94b8b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mc2pt7cfb4p3xojzsmyzt2pe7chobgkbddpdqxdscks6ttbki77xl2id.onion/","pattern":"[url:value = 'http://mc2pt7cfb4p3xojzsmyzt2pe7chobgkbddpdqxdscks6ttbki77xl2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5883bb14-5f43-bc7d-84f7-00009cd9ebb3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://j3pbdpnbkib7evm4rhzq64vdxqd3tfgr2x25v65hfefmlukah5nfpeyd.onion/","pattern":"[url:value = 'http://j3pbdpnbkib7evm4rhzq64vdxqd3tfgr2x25v65hfefmlukah5nfpeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fcc0c61-b79c-1363-dfe0-000083042571","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cwiukccdpixacamo24wkdkv4pgu62xtnbfuvauvqr5zjcr4jg2w4dcyd.onion/","pattern":"[url:value = 'http://cwiukccdpixacamo24wkdkv4pgu62xtnbfuvauvqr5zjcr4jg2w4dcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b0570f0-eee3-126c-91f9-00001ee7bb2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4bzbm2ifa2hffdb5celerb43mdbqoi6hcso3b2y4b6stdiiu2dww5bqd.onion/","pattern":"[url:value = 'http://4bzbm2ifa2hffdb5celerb43mdbqoi6hcso3b2y4b6stdiiu2dww5bqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a90052e1-bc4b-82fa-575e-0000d4dbc046","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://scuj56wenkc4oltbf35mxjqprwpyw7hfy4pwfwb54nfjs2ukemfodnyd.onion/","pattern":"[url:value = 'http://scuj56wenkc4oltbf35mxjqprwpyw7hfy4pwfwb54nfjs2ukemfodnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5682208-a619-0198-a2f5-00001ebebbb9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bqj4qln6jluwlsa32qjen2wlpgnqold4hgpkxny4x3vtsiecvdphwtqd.onion/","pattern":"[url:value = 'http://bqj4qln6jluwlsa32qjen2wlpgnqold4hgpkxny4x3vtsiecvdphwtqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--333bd230-5561-aab5-2a27-0000d218eeb4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://agx3kdwbkrff5csgkuf7rl3uytbgraqyb5kmr2ltp7pnza4puxgsyeid.onion/","pattern":"[url:value = 'http://agx3kdwbkrff5csgkuf7rl3uytbgraqyb5kmr2ltp7pnza4puxgsyeid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a09a4202-6e5f-25df-c15d-00002567c6bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cdalrbmvj36y24xbejqxgg6htzcgrbyf52ikoqgjwxvf566uycawa6id.onion/","pattern":"[url:value = 'http://cdalrbmvj36y24xbejqxgg6htzcgrbyf52ikoqgjwxvf566uycawa6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--248c05b6-96b6-f91e-1300-0000acdcfc66","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kd4zqe5ao4wio7shv747uszayc2xtpvoxirs3pnm7nrld5462jzf43qd.onion/","pattern":"[url:value = 'http://kd4zqe5ao4wio7shv747uszayc2xtpvoxirs3pnm7nrld5462jzf43qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40af168f-036e-14a7-a792-000044ee12fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://oplhizp4lkdxmrydoz4ixngotsqialrexmuficduihuktq4777tlb3qd.onion/","pattern":"[url:value = 'http://oplhizp4lkdxmrydoz4ixngotsqialrexmuficduihuktq4777tlb3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bc81bc4-e342-1dd3-221e-00005e59fa01","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lpx3qaviraf2k7uozkf2qi47beenvt4dwyr2f3zgdwjglyywhtikiead.onion/","pattern":"[url:value = 'http://lpx3qaviraf2k7uozkf2qi47beenvt4dwyr2f3zgdwjglyywhtikiead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22a14f03-de61-bdb3-d7b7-000020003b61","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rfbka2dt27wyuzymonzzx2zeaohx7sejti4gpihhc22hv74hya4h4vyd.onion/","pattern":"[url:value = 'http://rfbka2dt27wyuzymonzzx2zeaohx7sejti4gpihhc22hv74hya4h4vyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f43306b-3c09-788d-1082-0000806747c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ggyosmcjq5vw7qimqhn2bf2gbr5zhdqmrfl35nnki6q5dmvblcqsmhyd.onion/","pattern":"[url:value = 'http://ggyosmcjq5vw7qimqhn2bf2gbr5zhdqmrfl35nnki6q5dmvblcqsmhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c72fb2f-809f-b13e-d4bb-00008e246c59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7yrwf73tckb4mtt2kms4qc7nr7rzghu3jdzycm4w4qq2nwrybi7hq7ad.onion/","pattern":"[url:value = 'http://7yrwf73tckb4mtt2kms4qc7nr7rzghu3jdzycm4w4qq2nwrybi7hq7ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b29284cd-836f-9365-a4e6-00002cefef28","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uv4sykhrapb2t3mnhw6imkbdym4fh6vstwcdsvbtzrvdwzcd5zzlylqd.onion/","pattern":"[url:value = 'http://uv4sykhrapb2t3mnhw6imkbdym4fh6vstwcdsvbtzrvdwzcd5zzlylqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dfe1b92-fb58-3414-1229-0000f9d23dcc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://omdcwhef4ztuwhdiv3dbcgz2iyh2yb3gkkbusgvegbyjcacctahpxryd.onion/","pattern":"[url:value = 'http://omdcwhef4ztuwhdiv3dbcgz2iyh2yb3gkkbusgvegbyjcacctahpxryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8cb7a24-d558-91ae-d1ea-00001254213e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uvl645c47e5bozdzrrtjtm6pea5oltef63tsewz5ucmubvsj5i7meiid.onion/","pattern":"[url:value = 'http://uvl645c47e5bozdzrrtjtm6pea5oltef63tsewz5ucmubvsj5i7meiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4f0b087-95e2-8b75-f845-0000497414eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://57yqe2tksgsmmwaqrxf45uaqy45t3hxu3dcnywjdks6lhtfztkpx57yd.onion/","pattern":"[url:value = 'http://57yqe2tksgsmmwaqrxf45uaqy45t3hxu3dcnywjdks6lhtfztkpx57yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--186c1a3e-090b-9d0c-81be-00002eaa5a84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t7ezcjqq7h24gwswhyde72x4gkqxsjeyt2fxz44kcls6ipm4wd6bmsid.onion/","pattern":"[url:value = 'http://t7ezcjqq7h24gwswhyde72x4gkqxsjeyt2fxz44kcls6ipm4wd6bmsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc911f3b-43f1-72d6-b590-0000961ae24f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blofpgq5q3talt3y2w3y6r3focrtrk7ugmwl3e6a4pjuf5t2tivkxbqd.onion/","pattern":"[url:value = 'http://blofpgq5q3talt3y2w3y6r3focrtrk7ugmwl3e6a4pjuf5t2tivkxbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b132b5d1-7896-5800-269d-000029581165","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3nr2abdugd4mqabdmhialw3nbhol2qpywsphkocrhp6f7yxp3cps5iad.onion/","pattern":"[url:value = 'http://3nr2abdugd4mqabdmhialw3nbhol2qpywsphkocrhp6f7yxp3cps5iad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a39cf7ae-9268-2b79-83ce-000085d49d72","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hyinn53atxthbme4n76ry76jiaohqd6uk35jwni32g6dqtqkaejgquid.onion/","pattern":"[url:value = 'http://hyinn53atxthbme4n76ry76jiaohqd6uk35jwni32g6dqtqkaejgquid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--601b04e2-2859-8be5-6b50-0000b0194de8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jjgql4ddcs3hk5ptmfrpjriplialbjwi5a4tekffbfzv6n6oj5bmklid.onion/","pattern":"[url:value = 'http://jjgql4ddcs3hk5ptmfrpjriplialbjwi5a4tekffbfzv6n6oj5bmklid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac56bbff-f3b5-3ef0-75a8-0000cfd7f25d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://oujq7kjgzj4r3fyvsb2wtz6bxycrvawqdtj6zqgljw7u4hwqsak34jqd.onion/","pattern":"[url:value = 'http://oujq7kjgzj4r3fyvsb2wtz6bxycrvawqdtj6zqgljw7u4hwqsak34jqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--167f12e6-657c-9960-894a-0000e157f5d4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pnhyueueqsog3gbjuq3o7ixqbcdctpqnzv4uujsg3j76nt2bsm2p3rid.onion/","pattern":"[url:value = 'http://pnhyueueqsog3gbjuq3o7ixqbcdctpqnzv4uujsg3j76nt2bsm2p3rid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73dc84e0-7caf-73e1-7c76-00008d1e56cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nw4f4x2gix7y7y3nizwj2fnf5u4tqy2mwej62r6tdqye4s5ogrtftuid.onion/","pattern":"[url:value = 'http://nw4f4x2gix7y7y3nizwj2fnf5u4tqy2mwej62r6tdqye4s5ogrtftuid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a886384a-efdf-8308-6e7c-00009a3fd7fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://swnoxbuqfh7dmbqzaigqllkkljspipnvft3a4offxh3m5zwxg6ob46ad.onion/","pattern":"[url:value = 'http://swnoxbuqfh7dmbqzaigqllkkljspipnvft3a4offxh3m5zwxg6ob46ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f673af59-5df2-0443-a4ca-00007788d0c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bffujdbkhxfs2y63haztye4txuqgbkttmtxuxzkrlnruyioak5aoohid.onion/","pattern":"[url:value = 'http://bffujdbkhxfs2y63haztye4txuqgbkttmtxuxzkrlnruyioak5aoohid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e681fd52-0a0b-59f8-c77e-0000a0e393d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://aw5q5nzdok52cgprlzik4n44qstoajrlbixqqukqqcennjyas4x4opad.onion/","pattern":"[url:value = 'http://aw5q5nzdok52cgprlzik4n44qstoajrlbixqqukqqcennjyas4x4opad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ab48500-a067-daef-25d8-00007e8e5ebf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://helc2q6kbiyz4cwegzlp5anigkbjsbowjxrjxv3j27rjbvycgr2qd2qd.onion/","pattern":"[url:value = 'http://helc2q6kbiyz4cwegzlp5anigkbjsbowjxrjxv3j27rjbvycgr2qd2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55aa8b5a-6c3d-e526-465f-00007b29e5eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vopa354z4toilkjn4ileaf6rinkzn2givaokvj4yguq5kbiqoulxnzyd.onion/","pattern":"[url:value = 'http://vopa354z4toilkjn4ileaf6rinkzn2givaokvj4yguq5kbiqoulxnzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--270c839e-7745-be60-fc61-00001ae357d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m7vtnbsgctdcsccqmpnmi6igg3pcuiliqqqsq6uonkzg4blpa4eysiad.onion/","pattern":"[url:value = 'http://m7vtnbsgctdcsccqmpnmi6igg3pcuiliqqqsq6uonkzg4blpa4eysiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6eea9d0-9e49-51aa-ef13-00004188b8b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nuhnnxg3owawo36mwdffyblbzplhthfswny55mh7yhbxq74en6jihyad.onion/","pattern":"[url:value = 'http://nuhnnxg3owawo36mwdffyblbzplhthfswny55mh7yhbxq74en6jihyad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10945ebd-0d21-3536-fd15-0000eaaa0f7a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://q2bwuip5xq4qjn2vyevprcddhk26cigyqfqfu6yki7korjys2rposaad.onion/","pattern":"[url:value = 'http://q2bwuip5xq4qjn2vyevprcddhk26cigyqfqfu6yki7korjys2rposaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1642ddf5-ac53-9e1d-6f59-0000eb3d6f6d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xlirefmk3w2gsk3n5mkddinbfdatk6lhi7fj36knubhtoxiaqyus44yd.onion/","pattern":"[url:value = 'http://xlirefmk3w2gsk3n5mkddinbfdatk6lhi7fj36knubhtoxiaqyus44yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b36847f6-f91d-881c-7e65-0000b96e7ad7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ge74uts2ybu22kzwahiayovxelbq5fwhywl73agev5w4fef2e5ikplid.onion/","pattern":"[url:value = 'http://ge74uts2ybu22kzwahiayovxelbq5fwhywl73agev5w4fef2e5ikplid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01efaefd-4051-9434-3937-0000495bcba2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gfkngfw25qwhd2sn43x7cflcehk3bb7v2uifjndr2sc3k2abhqs22rad.onion/","pattern":"[url:value = 'http://gfkngfw25qwhd2sn43x7cflcehk3bb7v2uifjndr2sc3k2abhqs22rad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cef85698-cb30-0d33-1ad2-000058f12cd4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://b4k2fi62ctrid4k73itusuvcz5x5yczk27bpqdrsvwu3nl5mnz5dg3id.onion/","pattern":"[url:value = 'http://b4k2fi62ctrid4k73itusuvcz5x5yczk27bpqdrsvwu3nl5mnz5dg3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3a8b68c-5ada-874f-5f02-000076cb854d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://q2injs6dqvzemu2kkfpk7u3lsrcn4rddip3h2a7oc6uqwq6vjnduamad.onion/","pattern":"[url:value = 'http://q2injs6dqvzemu2kkfpk7u3lsrcn4rddip3h2a7oc6uqwq6vjnduamad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b166024-3c4b-589c-fb9a-00005a1b751f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/","pattern":"[url:value = 'http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2da932fe-a9ca-139d-7027-000009565464","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion","pattern":"[url:value = 'http://xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50b7035f-865d-1e04-3192-0000edbe599f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ransomcartel","pattern":"[url:value = 'https://www.ransomlook.io/group/ransomcartel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b9729b5-878a-5579-4868-00001dcee0d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cartelraqonekult2cxbzzz2ukiff7v6cav3w373uuhenybgqulxm5id.onion/","pattern":"[url:value = 'http://cartelraqonekult2cxbzzz2ukiff7v6cav3w373uuhenybgqulxm5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3be3eb7a-424d-e22c-ef9d-0000299931f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://u67aylig7i6l657wxmp274eoilaowhp3boljowa6bli63rxyzfzsbtyd.onion/","pattern":"[url:value = 'http://u67aylig7i6l657wxmp274eoilaowhp3boljowa6bli63rxyzfzsbtyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e809b22a-c354-e94c-0aa5-00006e83f2ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ramp","pattern":"[url:value = 'https://www.ransomlook.io/group/ramp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d41433c-bf3a-88c6-2296-000003883417","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ramp4u.io/","pattern":"[url:value = 'http://ramp4u.io/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32ad6733-952c-7fcd-8866-000050803c60","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/qlocker","pattern":"[url:value = 'https://www.ransomlook.io/group/qlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d38f543-d67b-9c02-5602-0000c763db4c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gvka2m4qt5fod2fltkjmdk4gxh5oxemhpgmnmtjptms6fkgfzdd62tad.onion/","pattern":"[url:value = 'http://gvka2m4qt5fod2fltkjmdk4gxh5oxemhpgmnmtjptms6fkgfzdd62tad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb8df2a6-b2e2-2afe-7ce6-00009c001865","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/qilin","pattern":"[url:value = 'https://www.ransomlook.io/group/qilin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96e5e628-8024-125b-1cbc-00001a6c10fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://of75lswvbla4iwbokpz7cyhypje65c33smpxozel344a7tyy3nyw7iqd.onion/","pattern":"[url:value = 'http://of75lswvbla4iwbokpz7cyhypje65c33smpxozel344a7tyy3nyw7iqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f467b4ec-fafe-c986-8730-000007f1f3d9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5sgebn2tata7qccie4vnxnb3bdrm5yaced4n6a72duojumm4jnjx3nad.onion/","pattern":"[url:value = 'http://5sgebn2tata7qccie4vnxnb3bdrm5yaced4n6a72duojumm4jnjx3nad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--004df8fc-9540-7fda-1899-00009ca09982","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pkq3dcon2m6k5pikrgt25jyakx2mud7z4xxa2nbiywzdsp7ea3bpzrid.onion/","pattern":"[url:value = 'http://pkq3dcon2m6k5pikrgt25jyakx2mud7z4xxa2nbiywzdsp7ea3bpzrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aca6d04-83af-afc2-6505-0000589dd35c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ppkc7hvvwou6dba7up5i3gapxrexyhvcvqfnuch24tbhyw6aabus76id.onion/","pattern":"[url:value = 'http://ppkc7hvvwou6dba7up5i3gapxrexyhvcvqfnuch24tbhyw6aabus76id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8304075-e569-4968-20c1-000070ec9004","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7wv4zsx2dghwf5cnsryruzd3cljpqoa42c2t7oz6rtwzrunohmda6pid.onion/","pattern":"[url:value = 'http://7wv4zsx2dghwf5cnsryruzd3cljpqoa42c2t7oz6rtwzrunohmda6pid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c58c2b27-ac9e-917e-143e-00005b0a276c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7zmcatunkz7vfylppn6u5rk4mwxkabce5obklzb4nhd5rokf7tamz5yd.onion/","pattern":"[url:value = 'http://7zmcatunkz7vfylppn6u5rk4mwxkabce5obklzb4nhd5rokf7tamz5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2a3264d-dae0-976b-b270-000000352ae9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t2yo7hhysohycpmkyum5z2vjmgrvp5ammbdgbjiwygth3qaydwidfnad.onion/","pattern":"[url:value = 'http://t2yo7hhysohycpmkyum5z2vjmgrvp5ammbdgbjiwygth3qaydwidfnad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3534142c-ff3e-9ab7-4ff3-0000ca3bd9ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://r2yitibhyvqoriwjc4rfmk32pcjtjdlniqybylq6wdzeips26mhc7sqd.onion/","pattern":"[url:value = 'http://r2yitibhyvqoriwjc4rfmk32pcjtjdlniqybylq6wdzeips26mhc7sqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15ad22d6-45e7-dfba-872a-000072a7954c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wns72bruvywwz6oqpzhgngywqpe2tfsqphuzvg2kiynu26vtodp4bmid.onion/","pattern":"[url:value = 'http://wns72bruvywwz6oqpzhgngywqpe2tfsqphuzvg2kiynu26vtodp4bmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b77a95e2-e3f6-47a2-b58a-0000e2f6a7aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6odt2nvero37jb4hotyw7kxqzbcxsjj52e5iznd44rzos7c4se22erad.onion/","pattern":"[url:value = 'http://6odt2nvero37jb4hotyw7kxqzbcxsjj52e5iznd44rzos7c4se22erad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b05e33b3-d9d4-0abe-b35c-00004bd61c94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3rac73vlekbbxtfzpkro4za2iifqd4r4vixk3ox5hjgielwaoxzed4ad.onion/","pattern":"[url:value = 'http://3rac73vlekbbxtfzpkro4za2iifqd4r4vixk3ox5hjgielwaoxzed4ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94222a1b-c9ab-3965-8678-00005e0e8467","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://72bdcqjz5pqlcsh5jhvwo33nnegwcvutchigxfptwnbh274ppyge6tid.onion/","pattern":"[url:value = 'http://72bdcqjz5pqlcsh5jhvwo33nnegwcvutchigxfptwnbh274ppyge6tid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b5b5ede-672e-d6ff-9863-0000abe0a559","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m7oqr6ud3smibvwihcewdrd3725zufalfo3wjsngwcmyfursgdk4p2ad.onion/","pattern":"[url:value = 'http://m7oqr6ud3smibvwihcewdrd3725zufalfo3wjsngwcmyfursgdk4p2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6df04fc2-0852-8644-98e2-0000ac01a63b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bogjlybsedwarit7tf6lri5rpovue3jqthwc5jwlhnilylzpn6rxx3yd.onion/","pattern":"[url:value = 'http://bogjlybsedwarit7tf6lri5rpovue3jqthwc5jwlhnilylzpn6rxx3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97851b74-8c07-cc40-d495-0000936a3980","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://aj6j4fuwulvqccdlqn7zo4hwnwwg4mghvqinqq34c4sh63oigfjwvxqd.onion/","pattern":"[url:value = 'http://aj6j4fuwulvqccdlqn7zo4hwnwwg4mghvqinqq34c4sh63oigfjwvxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d478ae73-639c-166e-fadf-0000cc9bfb1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://opwi7j2c6n3v3uztpqadrcyvrnkdhkmjt2qszmjgvlmhsthmzkr5rmqd.onion/","pattern":"[url:value = 'http://opwi7j2c6n3v3uztpqadrcyvrnkdhkmjt2qszmjgvlmhsthmzkr5rmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55380c90-a816-0bb3-da51-00008dd20a99","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cttuobz53jm3i7h5ueopjbzsgee4lhligw62x6uwm2nnu6ypgjijooad.onion/","pattern":"[url:value = 'http://cttuobz53jm3i7h5ueopjbzsgee4lhligw62x6uwm2nnu6ypgjijooad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fd8cc6f-056f-ea85-9d31-000058ba0b78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pbsdmkdyz774xa6zdydqqckx2ov4vaiy2l3ynkaz7jvuago7rmayngad.onion/","pattern":"[url:value = 'http://pbsdmkdyz774xa6zdydqqckx2ov4vaiy2l3ynkaz7jvuago7rmayngad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17f7a322-9a39-a3b2-e213-0000694c5fa2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3cdubz25xu4qa6vbm2z24wwcesazlz2fkwdpoiclsm34f72xyze6zvqd.onion/","pattern":"[url:value = 'http://3cdubz25xu4qa6vbm2z24wwcesazlz2fkwdpoiclsm34f72xyze6zvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9de5f1e9-6a26-7c30-d616-00008f826817","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cv6ow2w4j55shqukmuvuy6y5vu7peezv73etmmpetdf4sxtegvghokid.onion/","pattern":"[url:value = 'http://cv6ow2w4j55shqukmuvuy6y5vu7peezv73etmmpetdf4sxtegvghokid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e6af24c-a85b-b361-1062-0000061b3a3d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5we5da7cyjc6ajznlxm6nb2z6tsrc3tpxwtdvfjlcxeiadt7cr6dquyd.onion/","pattern":"[url:value = 'http://5we5da7cyjc6ajznlxm6nb2z6tsrc3tpxwtdvfjlcxeiadt7cr6dquyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fab77c8-780e-033b-1611-00004ab01748","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5mlkomvedkknnnz24ujloyc2nng3ptbygtriwdnwfzfgvnk4rumrxfqd.onion/","pattern":"[url:value = 'http://5mlkomvedkknnnz24ujloyc2nng3ptbygtriwdnwfzfgvnk4rumrxfqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c77d54c-bf68-666c-50c9-0000bfd8e4c3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6aqz2sigsr6qwwfkw2rexwap3hq445skkqdhl5soq6rww67cg6s5d3id.onion/","pattern":"[url:value = 'http://6aqz2sigsr6qwwfkw2rexwap3hq445skkqdhl5soq6rww67cg6s5d3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb2db782-c0ed-653c-1b6a-0000f89cee81","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wqh3weavjwvuok76ffue6a33hvvnzjelmx74z5ptb6lgmg7ky5ayxgad.onion/","pattern":"[url:value = 'http://wqh3weavjwvuok76ffue6a33hvvnzjelmx74z5ptb6lgmg7ky5ayxgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--066458f4-42ea-a585-ad96-00007e06ecb9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://btqswtq6f3hsftand7czaq4nur7kutaprvbau24d7jxtq4g4zqueiqid.onion/","pattern":"[url:value = 'http://btqswtq6f3hsftand7czaq4nur7kutaprvbau24d7jxtq4g4zqueiqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dafa423-5c6e-6ef0-5cba-0000427f7aae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://k4ed6sjnzwwogc2gtbbqn62bqr7vxezpa5f26au3iekntgmmedmep5id.onion/","pattern":"[url:value = 'http://k4ed6sjnzwwogc2gtbbqn62bqr7vxezpa5f26au3iekntgmmedmep5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--050ff695-b79b-3c1a-3896-0000ddf7641a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sqlr34glt2wwomsxynb5xs6oxfspsxqmpaog5ipyilxjcnq3lsygdoqd.onion/","pattern":"[url:value = 'http://sqlr34glt2wwomsxynb5xs6oxfspsxqmpaog5ipyilxjcnq3lsygdoqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f61cacc2-e5e0-d06b-ddb7-000070eea8dc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://irn47vggbnbmykomwrrmpspdrjt4k2sezbw6pvu6dnw6isfrhvnfipid.onion/","pattern":"[url:value = 'http://irn47vggbnbmykomwrrmpspdrjt4k2sezbw6pvu6dnw6isfrhvnfipid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a74a006-4976-558d-db6b-00000994305a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://s3suplpvzivdlv6smtbz5t6ygeptq6buyxi4eerxisxdw36rusu6u7ad.onion/","pattern":"[url:value = 'http://s3suplpvzivdlv6smtbz5t6ygeptq6buyxi4eerxisxdw36rusu6u7ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18d013ad-9d54-462e-7ab4-0000c2ea18c3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mpazkeiwkmp6cmlrr6tthjlbxiv4dx522szg4m6w3btmmm4q4qcddnid.onion/","pattern":"[url:value = 'http://mpazkeiwkmp6cmlrr6tthjlbxiv4dx522szg4m6w3btmmm4q4qcddnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8603b8c-792e-ea3f-589b-00006d5929e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4irxs37itbvbr6xwbdvwok47zouts2t4g7oswq7hzmydrlctudm2alyd.onion/","pattern":"[url:value = 'http://4irxs37itbvbr6xwbdvwok47zouts2t4g7oswq7hzmydrlctudm2alyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23739e0c-6b44-55b4-bee0-0000dba23bfb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wteumafxv4frl5dcdpedn4cczmdpng4i4zrgx54gup6sh5qtydem3kad.onion/","pattern":"[url:value = 'http://wteumafxv4frl5dcdpedn4cczmdpng4i4zrgx54gup6sh5qtydem3kad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b8f2586-82b7-de8b-f142-0000843a6cf1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gypxk5tpahoboxwtgcugc4dysnpavesfjtvhkmb2emwga66tukqxivyd.onion/","pattern":"[url:value = 'http://gypxk5tpahoboxwtgcugc4dysnpavesfjtvhkmb2emwga66tukqxivyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6111cbd-f690-73c9-81d8-0000b5375584","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5gyqtm5s7nywuglrwdcolddvwtjz2cxwlwjfzzl54nhlvy54oyyxrhqd.onion/","pattern":"[url:value = 'http://5gyqtm5s7nywuglrwdcolddvwtjz2cxwlwjfzzl54nhlvy54oyyxrhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70117375-1722-4e08-cd48-0000c8eee5a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://b24mgd2odcxgnhtcuzv65okz6werzn5jj6elwjnvkxqyk46q4i7wybid.onion/","pattern":"[url:value = 'http://b24mgd2odcxgnhtcuzv65okz6werzn5jj6elwjnvkxqyk46q4i7wybid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--257cf5ca-e906-1531-5008-000058367ef2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xlmxcglxvrjbh7pl45i3vxclc2ubmupg4ocpyvbv4dydujjt3n3h4iqd.onion/","pattern":"[url:value = 'http://xlmxcglxvrjbh7pl45i3vxclc2ubmupg4ocpyvbv4dydujjt3n3h4iqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba4f0929-70b9-df8d-eb0e-0000f44bdf33","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xm3ocoxwvdxhazma2jlo63a5gx4v6pq6glziisnr2yfvhdrbftfznrad.onion/","pattern":"[url:value = 'http://xm3ocoxwvdxhazma2jlo63a5gx4v6pq6glziisnr2yfvhdrbftfznrad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--553768df-ffdb-df44-1ad7-0000673a7356","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mgeu63cg6hsq2wuqpax25syekvhn4hunvgwv5gkzl4t7gsfs4negdpyd.onion/","pattern":"[url:value = 'http://mgeu63cg6hsq2wuqpax25syekvhn4hunvgwv5gkzl4t7gsfs4negdpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f89241e7-8518-6d70-4aaf-0000afb80f5f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2b53yjyng6hywq357sjfeln5d5qc6booypyaa4balftuaxvzkaom5lqd.onion/","pattern":"[url:value = 'http://2b53yjyng6hywq357sjfeln5d5qc6booypyaa4balftuaxvzkaom5lqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f892b03e-6ff1-7a8d-0de2-00002047d11c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2llagsjwp4scv2egnz6ngocfghybzpovkfpfcan7kexro73azsygn4id.onion/","pattern":"[url:value = 'http://2llagsjwp4scv2egnz6ngocfghybzpovkfpfcan7kexro73azsygn4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05ba49a8-f33f-1ec9-6ed0-00002912e7ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://clriuchoqbykvgsxn6zv6g4lzirhjtocyhr5p6y65yjwpui6h2a7kdqd.onion/","pattern":"[url:value = 'http://clriuchoqbykvgsxn6zv6g4lzirhjtocyhr5p6y65yjwpui6h2a7kdqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90ea1aaa-552f-1039-cfff-0000d06b6c35","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pqbny7o2ssuxjl2gqymko53i7zwkctwss3rdcf7zvdpsc3mf2u4wdjyd.onion/","pattern":"[url:value = 'http://pqbny7o2ssuxjl2gqymko53i7zwkctwss3rdcf7zvdpsc3mf2u4wdjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fe9573c-0496-be53-5432-0000f52bc84a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ud4jyiep6nn5fg23stkqgexnukavfi22zr4odfwbk342rtforzuqtkqd.onion/","pattern":"[url:value = 'http://ud4jyiep6nn5fg23stkqgexnukavfi22zr4odfwbk342rtforzuqtkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81c6563e-a662-d981-a8c9-0000446510e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kjx2gxjvkodbxwhnynob3tfs7vvgepmystregon26lhjqj2owzixowid.onion/","pattern":"[url:value = 'http://kjx2gxjvkodbxwhnynob3tfs7vvgepmystregon26lhjqj2owzixowid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--748d0840-dc92-960d-c868-0000df3cbd8f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://esnpzpzm7nuqqxuzws7h2mprqr4nvgwapn4szhrpdc2ncbw7tusateyd.onion/","pattern":"[url:value = 'http://esnpzpzm7nuqqxuzws7h2mprqr4nvgwapn4szhrpdc2ncbw7tusateyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b523da8-8e16-e3e1-fa1e-0000cc90319b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yvbus6jhvq3d43blp3kmgurr7b33srejop5laqzfm3pwjs7nwfc4opid.onion/","pattern":"[url:value = 'http://yvbus6jhvq3d43blp3kmgurr7b33srejop5laqzfm3pwjs7nwfc4opid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f900cfb-d572-342e-a24e-0000115d05d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lsj2i7u477aufbucozhvnsgm6m6pmhethtughyy3l7ol2xd5drfjyuyd.onion/","pattern":"[url:value = 'http://lsj2i7u477aufbucozhvnsgm6m6pmhethtughyy3l7ol2xd5drfjyuyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71a1a74a-a6fd-4731-3cf5-0000c9ecf499","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://va6nlvckdptcqg7lstgz3r4ngw2pgl5mwdg4lxlocce2e4py2vr2ceyd.onion/","pattern":"[url:value = 'http://va6nlvckdptcqg7lstgz3r4ngw2pgl5mwdg4lxlocce2e4py2vr2ceyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a2f384c-c631-a344-6538-000031b8b092","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://djmr46jucdawayh3hvx2nq66iyt5h4xk6tctb2soynylwttpc5o5ivqd.onion/","pattern":"[url:value = 'http://djmr46jucdawayh3hvx2nq66iyt5h4xk6tctb2soynylwttpc5o5ivqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11ee39b0-6685-39f4-f1cd-0000781ef96a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wqtn7sael2wpscqogrfpef22frgawqeaoryjavqtbwcelk5kg2dszdid.onion/","pattern":"[url:value = 'http://wqtn7sael2wpscqogrfpef22frgawqeaoryjavqtbwcelk5kg2dszdid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fd28f14-85f3-b0de-2ecd-00003b9f7951","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3rim2ptavbrrgga2gkva7y7ds3rns3umajsztkirsf3zsz7pcfhbegyd.onion/","pattern":"[url:value = 'http://3rim2ptavbrrgga2gkva7y7ds3rns3umajsztkirsf3zsz7pcfhbegyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0d430f3-c200-130f-ade4-00001d0ca8a9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l3uhnb3ogkof7qbf2tjwuix2llkrdge4ulstj3xf5zv6b65wiiwu74id.onion/","pattern":"[url:value = 'http://l3uhnb3ogkof7qbf2tjwuix2llkrdge4ulstj3xf5zv6b65wiiwu74id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e33ec132-edfa-f0c8-51d9-0000c0198f17","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vfssj4t2ccjjkllnxh74nejtaycfuzgbqn27svdwkkmi74wwtn666zqd.onion/","pattern":"[url:value = 'http://vfssj4t2ccjjkllnxh74nejtaycfuzgbqn27svdwkkmi74wwtn666zqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b06260c4-93de-cdcd-c4f0-0000a4911051","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dafroyuy5o5gv6zdvg6z4e3nuz3soar66n345sbvnenlw7o2fzw4kyqd.onion/","pattern":"[url:value = 'http://dafroyuy5o5gv6zdvg6z4e3nuz3soar66n345sbvnenlw7o2fzw4kyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e42bf3c-f9ca-87dc-eac9-00002288cb8f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3a6qvawccboloqyj6w4jozpdeaexvmioqfb3qqeugfm75r3tzyroukqd.onion/","pattern":"[url:value = 'http://3a6qvawccboloqyj6w4jozpdeaexvmioqfb3qqeugfm75r3tzyroukqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8e644bf-9fd4-b89e-27ea-0000e7083167","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4zm55zisi555jxttutlsqfgarupllviiruvspk7mywd4btitnc2g5fyd.onion/","pattern":"[url:value = 'http://4zm55zisi555jxttutlsqfgarupllviiruvspk7mywd4btitnc2g5fyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--918f6cb9-22e3-8ba7-c199-00008ab63aba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3vqoufzccyzfnzk7v7eaw4r2ycj24vaiagh2oj47u5dyosko4pe23bid.onion/","pattern":"[url:value = 'http://3vqoufzccyzfnzk7v7eaw4r2ycj24vaiagh2oj47u5dyosko4pe23bid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21781a78-33fa-b98e-6e07-000040677fb2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gse6ahazqyjfrbn3okepiwwk26vod6ejqnrottisvyilyk7spmm74uyd.onion/","pattern":"[url:value = 'http://gse6ahazqyjfrbn3okepiwwk26vod6ejqnrottisvyilyk7spmm74uyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbc4e915-0630-29f5-2476-0000fd2e6af2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7etv2zdtriq3ghxhckzgrflekrki3tgfjf73up6uobq5gw7b4oybutqd.onion/","pattern":"[url:value = 'http://7etv2zdtriq3ghxhckzgrflekrki3tgfjf73up6uobq5gw7b4oybutqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02ee8332-7e07-1075-36a5-0000848570a5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kqgjcecichrspy26dpzlagb3iz3dvwz7n52rtxrmizcg626pxexf6wid.onion/","pattern":"[url:value = 'http://kqgjcecichrspy26dpzlagb3iz3dvwz7n52rtxrmizcg626pxexf6wid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3ad0b8e-c078-f96f-dd94-0000544e7509","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cr6ey2trir44myajh7pu4ljqlefmd34kcgjwdpu4y22m4ivit66wl4yd.onion/","pattern":"[url:value = 'http://cr6ey2trir44myajh7pu4ljqlefmd34kcgjwdpu4y22m4ivit66wl4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a369441-b14d-0d05-b1cb-00005fb978c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dkeb73ishuf4puox4gscwtehindvjphujpcrnkfadbgmflxfjeaorayd.onion/","pattern":"[url:value = 'http://dkeb73ishuf4puox4gscwtehindvjphujpcrnkfadbgmflxfjeaorayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87c367f6-55dd-231e-c408-00006dee2421","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://min32ui6aqaf42bwizkfw5cxjiaasmtfuochi5npzwi7vljhcv2xbtyd.onion/","pattern":"[url:value = 'http://min32ui6aqaf42bwizkfw5cxjiaasmtfuochi5npzwi7vljhcv2xbtyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4366bca1-1267-a59d-aded-0000c06d5763","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7i2alg2nifi7tmqpzonijlvgg624wibkbd2kjliyvqggs3pbxnpgrkad.onion/","pattern":"[url:value = 'http://7i2alg2nifi7tmqpzonijlvgg624wibkbd2kjliyvqggs3pbxnpgrkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e67c3159-6bd5-9355-437c-000008f56ad2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fdinjg325vnlkpwlmlezv5wfvj7c4zrkwnjcult3k6wzfbqnih3xs3qd.onion/","pattern":"[url:value = 'http://fdinjg325vnlkpwlmlezv5wfvj7c4zrkwnjcult3k6wzfbqnih3xs3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72322335-bbf0-b306-c1e9-0000a0a84446","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cua54ykxywaymhcdvgslphln35vhtr6zkqhlv2mp2awh5wwty3sscnyd.onion/","pattern":"[url:value = 'http://cua54ykxywaymhcdvgslphln35vhtr6zkqhlv2mp2awh5wwty3sscnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--966dcb27-e128-510c-d690-0000d279063d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5excxn43rfuvqn2enr7j4vibhwqf6abfcy257kxoy4sukttkwmp4rsid.onion/","pattern":"[url:value = 'http://5excxn43rfuvqn2enr7j4vibhwqf6abfcy257kxoy4sukttkwmp4rsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15f01e9c-0f5b-3733-b249-00006983c9ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gezok5g4gsp6ig3hcezfzv6umz2fvx644miypojibuqxswo5saebweid.onion/","pattern":"[url:value = 'http://gezok5g4gsp6ig3hcezfzv6umz2fvx644miypojibuqxswo5saebweid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--066bcfce-c767-dc74-ba68-0000f9458db3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://y2twi4ccpkncrvcmnpaxaifcbpfd5alspojjr7ezrmfns7cgi73dmgyd.onion/","pattern":"[url:value = 'http://y2twi4ccpkncrvcmnpaxaifcbpfd5alspojjr7ezrmfns7cgi73dmgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89bc3d41-35f3-51a7-d7c8-00002d1115c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://til4f5awnrznpjvlu27kjjbjzviphtvyq6u5krfldlm4u6strqnwjiyd.onion/","pattern":"[url:value = 'http://til4f5awnrznpjvlu27kjjbjzviphtvyq6u5krfldlm4u6strqnwjiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--368e0c2f-22b7-1bb6-9a34-000061d2a56e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ge536nltloszz3shnaghdk4vaxsvtpgcl5iasxnuhbavenmnhjubpxad.onion/","pattern":"[url:value = 'http://ge536nltloszz3shnaghdk4vaxsvtpgcl5iasxnuhbavenmnhjubpxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54deb5ba-8287-dcd2-e915-0000c4669b12","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://icpia46mmjp4t5oesni3fhorvyb734xv2cglw77xt3ktkckmjk2ivmqd.onion/","pattern":"[url:value = 'http://icpia46mmjp4t5oesni3fhorvyb734xv2cglw77xt3ktkckmjk2ivmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c452347f-11e5-bb03-cc68-00009594a928","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ni5pahrlrklkhiiqbx7ps7pibhgqhyhdd3wbnvyi7iwxbtkyzvcsnyyd.onion/","pattern":"[url:value = 'http://ni5pahrlrklkhiiqbx7ps7pibhgqhyhdd3wbnvyi7iwxbtkyzvcsnyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c10928cb-db5b-4d06-259f-00004d0d2ac0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gsw7dnxebi43efyuoookcp4vp7xfppecrrak7wbynzmmycz34xo3o2qd.onion/","pattern":"[url:value = 'http://gsw7dnxebi43efyuoookcp4vp7xfppecrrak7wbynzmmycz34xo3o2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9642016f-caaa-2d39-988f-00003634d8d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bxobwadjcfjmy2af6qu45tvk37ya6r6sltwyrpvrtkqcwti33tjtyzad.onion/","pattern":"[url:value = 'http://bxobwadjcfjmy2af6qu45tvk37ya6r6sltwyrpvrtkqcwti33tjtyzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d58ff824-0ff0-d9c8-3d00-00006a505e43","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tumx6e7wjzstctfiypww3ej2qbt4nnkhlvdklfxopj77n3k2wu2usaqd.onion/","pattern":"[url:value = 'http://tumx6e7wjzstctfiypww3ej2qbt4nnkhlvdklfxopj77n3k2wu2usaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8b4c3bf-f2bc-ca8b-c664-000016af0f63","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tlnhajcnrni7mgfmf5qxfgtsyiw7nht33xsy4jb72ckpdowvdtxvosad.onion/","pattern":"[url:value = 'http://tlnhajcnrni7mgfmf5qxfgtsyiw7nht33xsy4jb72ckpdowvdtxvosad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ba35004-4463-3606-bf18-0000061b422f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nssopy47u2aj3hcsvdw567hkkmpmsdvn66q4zokayzcbe6hyxau6osqd.onion/","pattern":"[url:value = 'http://nssopy47u2aj3hcsvdw567hkkmpmsdvn66q4zokayzcbe6hyxau6osqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--469866ff-a537-57bb-7a68-0000879da652","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lmumc5wkplrc6qcpzur3d7uft5yddaobnczuh3s4ekxrh4rst7o4hnyd.onion/","pattern":"[url:value = 'http://lmumc5wkplrc6qcpzur3d7uft5yddaobnczuh3s4ekxrh4rst7o4hnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4171113-113f-10a2-4b59-00003a1cfef4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tocymggk4npjmvfy3ngirumb3735aj5cxx44jvrtp3mrwwmec45zbhid.onion/","pattern":"[url:value = 'http://tocymggk4npjmvfy3ngirumb3735aj5cxx44jvrtp3mrwwmec45zbhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba6338eb-e643-f04e-be70-000092e5f64c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vt7agprzwcmnkjqj7n53shv7icvgirwtgvjezl6wjnziz5fyfsrbttad.onion/","pattern":"[url:value = 'http://vt7agprzwcmnkjqj7n53shv7icvgirwtgvjezl6wjnziz5fyfsrbttad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b984db8e-ab99-595b-2098-000097c42870","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vgg5x6pkgnogy4pmhhspwjnydjldpegsba3cbfwyqylbmn6365iyzvyd.onion/","pattern":"[url:value = 'http://vgg5x6pkgnogy4pmhhspwjnydjldpegsba3cbfwyqylbmn6365iyzvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af082450-f4de-df1c-9348-000067f90225","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sp6aak6qtjiismi5dx7gzvr5qxbijsifmogmnlvh6kuzk46s3gbx6lad.onion/","pattern":"[url:value = 'http://sp6aak6qtjiismi5dx7gzvr5qxbijsifmogmnlvh6kuzk46s3gbx6lad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcd6ae7c-2a26-1669-7368-0000f6a932c0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://plkzemgtqs5jnyalikcnrumfc6xtibedu74hmzskblvjrldgyqykl7yd.onion/","pattern":"[url:value = 'http://plkzemgtqs5jnyalikcnrumfc6xtibedu74hmzskblvjrldgyqykl7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f258b45d-6f2d-4a8d-9c63-0000750b4ac5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3iadnmjhyoshvwwzshtgepjueehznoniv27ft4otq25aqsjj5qmyikqd.onion/","pattern":"[url:value = 'http://3iadnmjhyoshvwwzshtgepjueehznoniv27ft4otq25aqsjj5qmyikqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fa56582-0539-4d2b-b51b-0000a8f142aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cpk56ewbfwvv6zcf62e7olu4h4bvfl7rbdv2unbjs4ri43qd7vzpgxid.onion/","pattern":"[url:value = 'http://cpk56ewbfwvv6zcf62e7olu4h4bvfl7rbdv2unbjs4ri43qd7vzpgxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25711fe6-9943-ba98-52fd-0000b341a6ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zhglw2uts4ksqgauzqtlfge6mu2f25eq3ustyhn7376767mr5vizxxad.onion/","pattern":"[url:value = 'http://zhglw2uts4ksqgauzqtlfge6mu2f25eq3ustyhn7376767mr5vizxxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--300c89b5-2fae-522d-f9c9-0000d414164c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://prm66ou22uzlntigywrfwfgv5f3y3zkpase6ni4v6vx27xjsrzckqvyd.onion/","pattern":"[url:value = 'http://prm66ou22uzlntigywrfwfgv5f3y3zkpase6ni4v6vx27xjsrzckqvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dd44216-3e66-9ec0-5dae-0000af2ca13b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m4myi6jcuaohdudhppf2eks7f2c6a5ccvff6yaq4qtlpdymjuy42mbyd.onion/","pattern":"[url:value = 'http://m4myi6jcuaohdudhppf2eks7f2c6a5ccvff6yaq4qtlpdymjuy42mbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91876b7f-2107-c2d3-15f6-00005e0ecebd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6qclwkzcdv5dpkqn5la2xbxjlehvt4p3v5vp247bccxv4mvr5kwf2syd.onion/","pattern":"[url:value = 'http://6qclwkzcdv5dpkqn5la2xbxjlehvt4p3v5vp247bccxv4mvr5kwf2syd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6e75538-db58-46b2-ae7f-000027ac2ffa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://msjsbmjv4lbolmylerisinxwwxdpv5krfsarhsfcu5dxdrdrmccn7oqd.onion/","pattern":"[url:value = 'http://msjsbmjv4lbolmylerisinxwwxdpv5krfsarhsfcu5dxdrdrmccn7oqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--381e96f1-68fb-19f2-5138-00009d644c8e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://x33caz37b7fhtsd7veyod3bneipin2fpwjaveo6ibnqynyc6x3vojwyd.onion/","pattern":"[url:value = 'http://x33caz37b7fhtsd7veyod3bneipin2fpwjaveo6ibnqynyc6x3vojwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b91343e-8610-e448-3c59-0000e6a1dd0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tc74h34gjh5af7ziex7neyrcyhj5frf54q3y5yztydenzueb2745yayd.onion/","pattern":"[url:value = 'http://tc74h34gjh5af7ziex7neyrcyhj5frf54q3y5yztydenzueb2745yayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fe2df81-d187-d246-d511-00005c256ef2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://57sqjtgdvvwn2r6qkjdowqgfsloir26t36cylhklcws7tjn2igxbe7ad.onion/","pattern":"[url:value = 'http://57sqjtgdvvwn2r6qkjdowqgfsloir26t36cylhklcws7tjn2igxbe7ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15b5a021-c2bb-869b-6f1b-0000d8f59286","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6lrxiqscnydhh6ecezst5uwklaijb6zqd7gc3fevkizab6pwus6olrqd.onion/","pattern":"[url:value = 'http://6lrxiqscnydhh6ecezst5uwklaijb6zqd7gc3fevkizab6pwus6olrqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55d2a364-3cf5-bfa1-9457-0000565f7ad5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5qcalthkbchk3e25x2l5mjzdd2wck22c3mesl23mvq4k2tcjdyfvhaad.onion/","pattern":"[url:value = 'http://5qcalthkbchk3e25x2l5mjzdd2wck22c3mesl23mvq4k2tcjdyfvhaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94140318-b927-d901-0da8-0000d7b4304c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2wgkaf2f7fxgpybfvsfu6xf35tq6o3dpninsintwpb53sdmwt5ryssqd.onion/","pattern":"[url:value = 'http://2wgkaf2f7fxgpybfvsfu6xf35tq6o3dpninsintwpb53sdmwt5ryssqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eba6b4a1-aa29-5f5c-4e44-000093d01f73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dfcszejizdyp2n2win7trt2yfdigpkoicahm3l2gwotkyajepo5ocead.onion/","pattern":"[url:value = 'http://dfcszejizdyp2n2win7trt2yfdigpkoicahm3l2gwotkyajepo5ocead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--569806df-96fd-1a0a-6464-0000da2d8b05","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nncnktdfnyy7v7aixo437wdkgcbecpnpeawen6gc2gfw2cn2fgibrlad.onion/","pattern":"[url:value = 'http://nncnktdfnyy7v7aixo437wdkgcbecpnpeawen6gc2gfw2cn2fgibrlad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbe2bd64-3a1e-bdd0-6785-0000a4c77548","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://idebr3oxfxzjqri764w2f66wlav7ypplxh2oce4hf3nsjpna46krf5id.onion/","pattern":"[url:value = 'http://idebr3oxfxzjqri764w2f66wlav7ypplxh2oce4hf3nsjpna46krf5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4daf204-09b8-9eda-17fe-0000b3f35563","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://as4i6et5nf2ee3qxmr56ol7zqfk3kxkfso64yc4yspdqtebbux45a2ad.onion/","pattern":"[url:value = 'http://as4i6et5nf2ee3qxmr56ol7zqfk3kxkfso64yc4yspdqtebbux45a2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bcc3f68-1a65-745c-e5ea-000078be7b0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://s2xvhoclphip4lyi7dtnxq2zjgziat7bajloh5inibzkvfrhsp56vqid.onion/","pattern":"[url:value = 'http://s2xvhoclphip4lyi7dtnxq2zjgziat7bajloh5inibzkvfrhsp56vqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf537a08-83b0-3682-e69f-0000ddd7859b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://72mtqnci5wl5xylybwe4z3vix4fituieaycqhrsw6ljieiyfymv6izid.onion/","pattern":"[url:value = 'http://72mtqnci5wl5xylybwe4z3vix4fituieaycqhrsw6ljieiyfymv6izid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db36109e-759d-eac6-8e01-000086835747","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wqc7xbdvwqcmddwhy2z343cnawox32uuw6bidr5fuzlcsospyltwbkad.onion/","pattern":"[url:value = 'http://wqc7xbdvwqcmddwhy2z343cnawox32uuw6bidr5fuzlcsospyltwbkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ddf4c9d-e2c8-149a-5813-00004b1da1cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mhxzljefeb273eo57hjpigdkae62h6zkzkp64bo4ysehi4ah32xjywqd.onion/","pattern":"[url:value = 'http://mhxzljefeb273eo57hjpigdkae62h6zkzkp64bo4ysehi4ah32xjywqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76d6c87e-a0a5-65c7-0c1c-0000c68a2a25","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7zrk2m6nkr3akshaasdvpc5vsphd5lpcdkxodp3dhbagy6j42m25pkid.onion/","pattern":"[url:value = 'http://7zrk2m6nkr3akshaasdvpc5vsphd5lpcdkxodp3dhbagy6j42m25pkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c80f35d2-f0ba-d590-1b00-000048f57b1f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ac5vcjjq4dk7mvqgf4tkxfipqj44f5r4e5sxh65qbjx4lbhilwr6ddad.onion/","pattern":"[url:value = 'http://ac5vcjjq4dk7mvqgf4tkxfipqj44f5r4e5sxh65qbjx4lbhilwr6ddad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d95212ac-6124-98d5-c70e-0000d985a178","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mqb5hxeq64otqrfro6kun3g7iikgwstmy7ec3pukhqsfaa2eupud7fqd.onion/","pattern":"[url:value = 'http://mqb5hxeq64otqrfro6kun3g7iikgwstmy7ec3pukhqsfaa2eupud7fqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5752fab-06e1-ae2b-ec6e-000013284a44","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://d3s62fytuwzerl6qnw23c7qqxmsm4z27eh4fiaptmwmtz5fuqluh5oad.onion/","pattern":"[url:value = 'http://d3s62fytuwzerl6qnw23c7qqxmsm4z27eh4fiaptmwmtz5fuqluh5oad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8b7a718-2eb2-3d5b-7948-00005200bbcf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://c7pjcvwro4tncaosfwwyvkw23u2gejjczeldgwzd2snirem2uz5eqtqd.onion/","pattern":"[url:value = 'http://c7pjcvwro4tncaosfwwyvkw23u2gejjczeldgwzd2snirem2uz5eqtqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28a7ef99-31d2-f82d-789c-000097e01f91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://75iphov67nj3ehfsyoiarzeo7nymo2sf7cgoycxk3ldubbau3635afid.onion/","pattern":"[url:value = 'http://75iphov67nj3ehfsyoiarzeo7nymo2sf7cgoycxk3ldubbau3635afid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1078bd3-9aad-07ef-6853-00003daa1a05","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://prccrijnexj7ys53tmtfn3kjzclwmmr77lqy73bc6hmt5s6gb47bgwid.onion/","pattern":"[url:value = 'http://prccrijnexj7ys53tmtfn3kjzclwmmr77lqy73bc6hmt5s6gb47bgwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d49a79fc-800e-cf02-0d5d-0000a68f772b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://z4xxrmrv6e42soz4m7f7c5lut5yw7uhn3z3h2axfsrzlbdlsmt6mukyd.onion/","pattern":"[url:value = 'http://z4xxrmrv6e42soz4m7f7c5lut5yw7uhn3z3h2axfsrzlbdlsmt6mukyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9fa45d6-82d1-1670-b95b-0000ad14acb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g6vaxi2xme54zbmt3gewcbdbtw5dbu5cc7vziaiks6ivz4flagahk5id.onion/","pattern":"[url:value = 'http://g6vaxi2xme54zbmt3gewcbdbtw5dbu5cc7vziaiks6ivz4flagahk5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ce36f34-3a37-6741-e118-00000c72cc04","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7w6pbuises7kljuwb7h5r4m4vdqm2zqfmpt76mhtkkwi6wvm5n57x2id.onion/","pattern":"[url:value = 'http://7w6pbuises7kljuwb7h5r4m4vdqm2zqfmpt76mhtkkwi6wvm5n57x2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09e9f0d6-ede5-c0c8-c7e7-0000b018b744","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jd2v46omzfxbzpkmlvpz32ee3ty47y76u67c3tg7ku2wxkegkhqnnpid.onion/","pattern":"[url:value = 'http://jd2v46omzfxbzpkmlvpz32ee3ty47y76u67c3tg7ku2wxkegkhqnnpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b93c02ed-2823-b866-8192-0000481518e1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mtrudrbcmzn6deejfncqm34yyl2yc34qsdshr54dnvrtdad2uvhlqsid.onion/","pattern":"[url:value = 'http://mtrudrbcmzn6deejfncqm34yyl2yc34qsdshr54dnvrtdad2uvhlqsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44c95d45-2036-a0cf-8c9c-00006f8a53cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ott7kh7u7qu22gqqzopbc56744bqqvl3ibvoe7domx5a2aua4lldkcid.onion/","pattern":"[url:value = 'http://ott7kh7u7qu22gqqzopbc56744bqqvl3ibvoe7domx5a2aua4lldkcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--add37e48-d0d1-58e7-895d-000024994e6d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://e54qu2mlopbhpas6expkkg77wsmgnrtruuwuvxkjnetcec546ylyabqd.onion/","pattern":"[url:value = 'http://e54qu2mlopbhpas6expkkg77wsmgnrtruuwuvxkjnetcec546ylyabqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--411b8322-a656-aaab-a8d7-00005574d505","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rl6ukoqptt42d6qs7r6y3w5ozacti4irtz5e3qz7pxo4udn4oplb7hyd.onion/","pattern":"[url:value = 'http://rl6ukoqptt42d6qs7r6y3w5ozacti4irtz5e3qz7pxo4udn4oplb7hyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b49c24f4-da04-2f8b-aa21-00004eeaa0df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p6dqysgft5e3wmcbpjqaapannvftvw5jrqjtzutmbvyvlyairvw5vead.onion/","pattern":"[url:value = 'http://p6dqysgft5e3wmcbpjqaapannvftvw5jrqjtzutmbvyvlyairvw5vead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be444a6f-acc4-88c9-2d53-0000ccdaeb0b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yngwxmkzyyfi22q6ezyuek2dcz74ahh4a3osnw2xyhjamn4utddyvxqd.onion/","pattern":"[url:value = 'http://yngwxmkzyyfi22q6ezyuek2dcz74ahh4a3osnw2xyhjamn4utddyvxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cf46bc3-2b40-c607-929d-00005b46e992","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ecldh2zc6rjzq77xswgey7aktx2elbantrzagykdg7fwbw4slogr3dqd.onion/","pattern":"[url:value = 'http://ecldh2zc6rjzq77xswgey7aktx2elbantrzagykdg7fwbw4slogr3dqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93556b65-71c4-28dc-8e2a-000027625be1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sytnjxhj7tfixj7ocvewgmbj2ixtga7dete7rnby55i5xxp6or5g7iqd.onion/","pattern":"[url:value = 'http://sytnjxhj7tfixj7ocvewgmbj2ixtga7dete7rnby55i5xxp6or5g7iqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--503565db-e20e-e7db-2d93-00003b93c4ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://takbxhd3rg6lz7f5lz4oau44qfklabdeeo3qxldxx3okd6qodmppnxqd.onion/","pattern":"[url:value = 'http://takbxhd3rg6lz7f5lz4oau44qfklabdeeo3qxldxx3okd6qodmppnxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c0b0552-f815-13a0-3063-000071eb92e1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sakx5tbf44g34uqxeqsw47ooqn4wbeys3walwxdpicfai62l4g3wflid.onion/","pattern":"[url:value = 'http://sakx5tbf44g34uqxeqsw47ooqn4wbeys3walwxdpicfai62l4g3wflid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06d80d61-0033-03e7-56ed-000080c5c014","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6yvv6sagns5omr5o6tkh6ws3ipap2ihl7dwveeguzydehlk3zzxoabqd.onion/","pattern":"[url:value = 'http://6yvv6sagns5omr5o6tkh6ws3ipap2ihl7dwveeguzydehlk3zzxoabqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f72e7c52-3001-18e3-5eff-0000c41284b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7pjel5rdskmsg7xhiucy7hwpltfpia3cs4plohcy665ptux2ewyrrjad.onion/","pattern":"[url:value = 'http://7pjel5rdskmsg7xhiucy7hwpltfpia3cs4plohcy665ptux2ewyrrjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--596aca5d-59e1-e70d-a006-00000c604f96","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://q2llvdk6tbo2vgxk4v356ootxdrffmsjnptvhb74xagwi34xshryffad.onion/","pattern":"[url:value = 'http://q2llvdk6tbo2vgxk4v356ootxdrffmsjnptvhb74xagwi34xshryffad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--396083d3-8419-d334-2cca-000026a5642e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4anntjcjpl6u3rgfsai7bbf2j5khrqdpjrbui46sfgcr3ajm53tdprid.onion/","pattern":"[url:value = 'http://4anntjcjpl6u3rgfsai7bbf2j5khrqdpjrbui46sfgcr3ajm53tdprid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d789fe-94bd-2e15-f38b-0000b9da7f30","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4keexy2gskyc5l5hchxqiq6orxhpwws2mlepl4wplifzxspv4slh2kqd.onion/","pattern":"[url:value = 'http://4keexy2gskyc5l5hchxqiq6orxhpwws2mlepl4wplifzxspv4slh2kqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24f9d57e-d3cb-7c8f-1d8d-000092377b32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://temf3n2t7daufajjtdcx4f65d2jc3ddmkwfjtnpkoyd42omjyguyw6ad.onion/","pattern":"[url:value = 'http://temf3n2t7daufajjtdcx4f65d2jc3ddmkwfjtnpkoyd42omjyguyw6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfc1cf95-8af4-70fd-0b24-0000afaf06cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://odv3bn24b7yndkybghc3nt3mmbv7nsk64hwyccaadpjb3ufagdweueqd.onion/","pattern":"[url:value = 'http://odv3bn24b7yndkybghc3nt3mmbv7nsk64hwyccaadpjb3ufagdweueqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d84a4e8d-de09-2fef-d2ae-0000e56807a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2rqfssorsw3myndd7f3lwglrdwvcwllzootbxiauxpohruxj6gj5hlyd.onion/","pattern":"[url:value = 'http://2rqfssorsw3myndd7f3lwglrdwvcwllzootbxiauxpohruxj6gj5hlyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c8b18ad-bfa3-896d-8e44-0000dda74960","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7pm2ot33sjfzrtftwxiituqymc4o3f6tksxt54fgo45roor4zdx4l5yd.onion/","pattern":"[url:value = 'http://7pm2ot33sjfzrtftwxiituqymc4o3f6tksxt54fgo45roor4zdx4l5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2694f913-7fa9-9adf-d5f5-0000d80a5508","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://effyotonty6zngtmd764pkazcgj372nr2ctme2ssgswnp3nas62fcryd.onion/","pattern":"[url:value = 'http://effyotonty6zngtmd764pkazcgj372nr2ctme2ssgswnp3nas62fcryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c814a34-120e-b414-e01b-0000473d1cd7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bndunnr674ypywtzzs3eksoatalludrjwmaniot6rer5f5aosg47fwad.onion/","pattern":"[url:value = 'http://bndunnr674ypywtzzs3eksoatalludrjwmaniot6rer5f5aosg47fwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37f4a001-2833-e8c5-493e-0000e163a542","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3ilif6dkjju6q35edalfyxrwsb2c5gl4swrdwcssch3yprwzhrpp2aqd.onion/","pattern":"[url:value = 'http://3ilif6dkjju6q35edalfyxrwsb2c5gl4swrdwcssch3yprwzhrpp2aqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c475151-495b-e1b7-4192-0000d210b993","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g6pvur4v5o3u3q6kg6r47dpxih2wbt33ztq632lciupny6oz5dxd6iyd.onion/","pattern":"[url:value = 'http://g6pvur4v5o3u3q6kg6r47dpxih2wbt33ztq632lciupny6oz5dxd6iyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d044c707-2bcd-7221-a527-0000043397fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://k4edbivp7dfzcy6hxis7aa5wwecd3zzabkubuwieeoqhl7fyigawt6ad.onion/","pattern":"[url:value = 'http://k4edbivp7dfzcy6hxis7aa5wwecd3zzabkubuwieeoqhl7fyigawt6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c66fdfc-3ba0-a047-5181-00004d6b941b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://h5srvq4iihhvossyrjf5ucgfolkzm7ms7he74maejabfkrbsp56yomyd.onion/","pattern":"[url:value = 'http://h5srvq4iihhvossyrjf5ucgfolkzm7ms7he74maejabfkrbsp56yomyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30b44758-6caf-987c-79b0-0000e5ed94c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://h6zsp4iz2ghvegyxibtfpgx4of3cvmjdhdyux57sdo7qlrxb77qyyfqd.onion/","pattern":"[url:value = 'http://h6zsp4iz2ghvegyxibtfpgx4of3cvmjdhdyux57sdo7qlrxb77qyyfqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b08b16f-088c-1d8e-e616-000044f8def3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yjy7rkjx4ywkkcy7nhriva3kb426qtdfcquhbemwva7nqh2u3ucxopyd.onion/","pattern":"[url:value = 'http://yjy7rkjx4ywkkcy7nhriva3kb426qtdfcquhbemwva7nqh2u3ucxopyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2136bb15-521b-3140-81ed-00002610c6fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://b66mcxl36wqm7vg2nsnj35y6ei4if3wcmzobobd6h3rkqtikkvoxloyd.onion/","pattern":"[url:value = 'http://b66mcxl36wqm7vg2nsnj35y6ei4if3wcmzobobd6h3rkqtikkvoxloyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e145b16-8bc6-7475-6650-0000af48cae0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://74euknp2zuen3o6hkjfotj7tjykajs6dzaeahe5zevksrpdjcu4t75qd.onion/","pattern":"[url:value = 'http://74euknp2zuen3o6hkjfotj7tjykajs6dzaeahe5zevksrpdjcu4t75qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4207b377-e68c-0eb8-6d88-0000f44453e1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://n4u3kpi747eiwrs5s3e3sttw5kb57v7xz5mqzqizj5ruvo3gptqzfnid.onion/","pattern":"[url:value = 'http://n4u3kpi747eiwrs5s3e3sttw5kb57v7xz5mqzqizj5ruvo3gptqzfnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72fad0e6-ad43-b00a-d4c6-0000854937d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2gf2vgrmj2bjrb7gcj575574guw2iefcdsno3q5jdfkin7gusp7xlhyd.onion/","pattern":"[url:value = 'http://2gf2vgrmj2bjrb7gcj575574guw2iefcdsno3q5jdfkin7gusp7xlhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec4dc07a-df01-7a54-11a9-00006e8742a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yhtfykndelwxn5btezh736vlgqr536xr7ewau44prdaeqhpgskgy3qyd.onion/","pattern":"[url:value = 'http://yhtfykndelwxn5btezh736vlgqr536xr7ewau44prdaeqhpgskgy3qyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1364c462-77a9-7528-ceeb-00005a6cedf8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kaxqmpjht2rnib3bs7oconrpznxgnxc5ac3vwhyhey5eucpifj3rqzid.onion/","pattern":"[url:value = 'http://kaxqmpjht2rnib3bs7oconrpznxgnxc5ac3vwhyhey5eucpifj3rqzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f4d37d1-90f6-9fea-1e7a-0000e057872f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fmljwxfz6vrv4tky2wv5f2dwjozbmndknhgnptng2kmwbnrpaojlciqd.onion/","pattern":"[url:value = 'http://fmljwxfz6vrv4tky2wv5f2dwjozbmndknhgnptng2kmwbnrpaojlciqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e392143-ea2b-252a-ada3-00005530eb52","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p33liq4mrsa43l5l4prrbasubkeapfsi24dh6j2rylthltwilebqcoqd.onion/","pattern":"[url:value = 'http://p33liq4mrsa43l5l4prrbasubkeapfsi24dh6j2rylthltwilebqcoqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e34cd86-45a8-799e-70a2-00004e2e7f14","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://latesgmxl7tudr6j7mtjbcccrgdztyai6chhqln7xgxjg7k63tpyj4yd.onion/","pattern":"[url:value = 'http://latesgmxl7tudr6j7mtjbcccrgdztyai6chhqln7xgxjg7k63tpyj4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d985202-ead3-1df3-63bb-000081abb54d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wpf4w72fnllt2syylq56mx2zkri4ggb4hivqiikqjlg5p456vpaoceqd.onion/","pattern":"[url:value = 'http://wpf4w72fnllt2syylq56mx2zkri4ggb4hivqiikqjlg5p456vpaoceqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ec445e4-c857-88af-6350-00004b9a8075","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://il2xjfptv4mnq3atlpnznqclbnlutet3vkotl4wc4wqku6qpw2drflqd.onion/","pattern":"[url:value = 'http://il2xjfptv4mnq3atlpnznqclbnlutet3vkotl4wc4wqku6qpw2drflqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bde838a2-1df7-07ce-82f6-000097c41aac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://w4bkuexf4ufxtt525cppzkkzmbqfppcqnctdd32hnt5f4oivrmbufbyd.onion/","pattern":"[url:value = 'http://w4bkuexf4ufxtt525cppzkkzmbqfppcqnctdd32hnt5f4oivrmbufbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--550ca52c-b57a-ad3c-9314-00001fe7fef8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zq53vbywqjhuvlg3ljnm7k5q6di6oijuh32v6gizkgzp6vhnfvtwb3id.onion/","pattern":"[url:value = 'http://zq53vbywqjhuvlg3ljnm7k5q6di6oijuh32v6gizkgzp6vhnfvtwb3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59a4189f-2059-a760-ca2f-000051994592","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3n6kxmh4oslmshtetkqmdheflyabpj4xajtxneso6lr6ai5ecgr5mbad.onion/","pattern":"[url:value = 'http://3n6kxmh4oslmshtetkqmdheflyabpj4xajtxneso6lr6ai5ecgr5mbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bdd2ba6-58fc-9563-6216-0000a7913767","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://djylmsdn2elx4hosbp2jymz3k6vaacglo36olfua2jrxcckpn357omad.onion/","pattern":"[url:value = 'http://djylmsdn2elx4hosbp2jymz3k6vaacglo36olfua2jrxcckpn357omad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69689968-3571-b8fd-b3b1-000051580766","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fnm7d5gglkclynkiid6kly4dav3xdnvh2xrjrry3iy3rm4cwveuvbhqd.onion/","pattern":"[url:value = 'http://fnm7d5gglkclynkiid6kly4dav3xdnvh2xrjrry3iy3rm4cwveuvbhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4436db9-8604-bfda-2cfd-0000017f8535","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ji35vmq2hw7d6qqtemdmtsn3ubi6jpu7ojzwqwc6mrykpi6co6pywnqd.onion/","pattern":"[url:value = 'http://ji35vmq2hw7d6qqtemdmtsn3ubi6jpu7ojzwqwc6mrykpi6co6pywnqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c411a9fb-e1b0-c826-c5e1-00005892fe09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xvu3dc6du7getj5wiltjztppfcnv46n3dbhybhmhz6k6ojlonvg4oayd.onion/","pattern":"[url:value = 'http://xvu3dc6du7getj5wiltjztppfcnv46n3dbhybhmhz6k6ojlonvg4oayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--466cd047-c0ea-8675-82b1-0000449f36c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://74vuaahghbasowbvr37uwr3m7ndqap44q3z2u7itaxr5bxwxjrakzcyd.onion/","pattern":"[url:value = 'http://74vuaahghbasowbvr37uwr3m7ndqap44q3z2u7itaxr5bxwxjrakzcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7173f010-6b68-0f4c-605c-000035e02794","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5xlbxe72negvvqpk5lvjdrpt5ogc7yi27pfvsms5gtu7yexr5cj55vad.onion/","pattern":"[url:value = 'http://5xlbxe72negvvqpk5lvjdrpt5ogc7yi27pfvsms5gtu7yexr5cj55vad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb989c45-48e7-79ff-ab5e-0000a107d40e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qels6bdyriqqp4llbhu323lrsfcgdwkufvbuvo3aum4jqirrurb3hvid.onion/","pattern":"[url:value = 'http://qels6bdyriqqp4llbhu323lrsfcgdwkufvbuvo3aum4jqirrurb3hvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70c408fa-40f9-6ed9-66b8-000018f53f79","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/","pattern":"[url:value = 'http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd07d38f-1ea8-c108-582c-00002a6e1ab1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wvci26mxz5owih7v2vrpj4lgcigqb3bvcvwbvogiozy6wdfcqk6y23id.onion/","pattern":"[url:value = 'http://wvci26mxz5owih7v2vrpj4lgcigqb3bvcvwbvogiozy6wdfcqk6y23id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9676dc61-d523-1d59-1797-00002988ba35","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2gwhjopr2zfbecvfjzymlyq3d2w5bqv2c5cc76wqxx6g4gmscbrbaiyd.onion/","pattern":"[url:value = 'http://2gwhjopr2zfbecvfjzymlyq3d2w5bqv2c5cc76wqxx6g4gmscbrbaiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9a2b8dd-7ea6-a310-700d-000065e30510","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://olu6mrh5wfeyqndktiqqiqpd3dgiqqfai5ptxulmxt4f2rrqcvu2pcid.onion/","pattern":"[url:value = 'http://olu6mrh5wfeyqndktiqqiqpd3dgiqqfai5ptxulmxt4f2rrqcvu2pcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fa6a890-e1fa-1ceb-ad84-0000500ecd7d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lhlzixubmiuy2a6opc6vczkckmqa4uditylsmxeewemlhni4t7psqaid.onion/","pattern":"[url:value = 'http://lhlzixubmiuy2a6opc6vczkckmqa4uditylsmxeewemlhni4t7psqaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8dd79d34-7082-ac05-7d5b-00000b4cbb4f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p7ipujay5n6b5ndshpaflkrf3wlfjnjnjjo37wyqbohtzjrcr6htjeid.onion/","pattern":"[url:value = 'http://p7ipujay5n6b5ndshpaflkrf3wlfjnjnjjo37wyqbohtzjrcr6htjeid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e912776d-8057-3bf8-4725-000027be834d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nn6527gutxrnby7uzw3owke3blqxm6r5hsasnziw6fstjbmlujj54uqd.onion/","pattern":"[url:value = 'http://nn6527gutxrnby7uzw3owke3blqxm6r5hsasnziw6fstjbmlujj54uqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--161bfe64-924c-dfb0-f919-0000bbf2239b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vmjnih57b5tiskqoi4zsrhmc5x7672mkhjs4skxcqcfxljilel3ko4yd.onion/","pattern":"[url:value = 'http://vmjnih57b5tiskqoi4zsrhmc5x7672mkhjs4skxcqcfxljilel3ko4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--174f1b8c-8b6f-9b93-668d-0000530c30c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yyaidwloeb3phrc66p4pz2tjevqlhco7r3bzgfruuspftjgli53ru2yd.onion/","pattern":"[url:value = 'http://yyaidwloeb3phrc66p4pz2tjevqlhco7r3bzgfruuspftjgli53ru2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8ead422-a8db-9798-f59e-00006a34dc95","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://isl65ttcgmss2sxwvaengdzfdnhn3kdim6b35ay4hyhqsdgpb5fkegad.onion/","pattern":"[url:value = 'http://isl65ttcgmss2sxwvaengdzfdnhn3kdim6b35ay4hyhqsdgpb5fkegad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88d9c0ea-c36e-4a0c-f9b8-000064f6ad6e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7lgtrvjiro624cfh4xiojh2i3mc4z2fwd6i47zbwfyvzib34cknzlead.onion/","pattern":"[url:value = 'http://7lgtrvjiro624cfh4xiojh2i3mc4z2fwd6i47zbwfyvzib34cknzlead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c3bf7cf-c6e4-b7c3-c02c-000084730ab1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://auuwlsfjq7uyfigmpajkpi2xqkgpajyqwi3vqldqx3mcpabrgiz4rsid.onion/","pattern":"[url:value = 'http://auuwlsfjq7uyfigmpajkpi2xqkgpajyqwi3vqldqx3mcpabrgiz4rsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01c1b9f4-ff89-6d58-8e04-00009fdf7974","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://65g6o2whexv6lcrniqabzw2ulgipz22xt35gd4lcbhxkgbpoo5aeq5yd.onion/","pattern":"[url:value = 'http://65g6o2whexv6lcrniqabzw2ulgipz22xt35gd4lcbhxkgbpoo5aeq5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87f0e513-195d-4418-599d-000074a2adb5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://iul7g5uaadfkv2nsfqcdygrk5m4sattncacsdduffdrfqxjxiak66rid.onion/","pattern":"[url:value = 'http://iul7g5uaadfkv2nsfqcdygrk5m4sattncacsdduffdrfqxjxiak66rid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de2ec45e-e988-944f-c76f-0000e114594f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://h2ktnfmrnh2amavswz4dztwfgrvjiwuygdyvukgfk4zqjja32olotkqd.onion/","pattern":"[url:value = 'http://h2ktnfmrnh2amavswz4dztwfgrvjiwuygdyvukgfk4zqjja32olotkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2f2cd0f-4c86-0222-e7ca-0000d2cd3872","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://voebjhpsp66gv44pn6f2ra7l6qumx25wraukc43ubmcqq5nxp4454rqd.onion/","pattern":"[url:value = 'http://voebjhpsp66gv44pn6f2ra7l6qumx25wraukc43ubmcqq5nxp4454rqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c33574e0-3e3a-86ca-565e-00004074ed1c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://alnsja67tiwthhbfvu4vrne7nxqrgwmobaj52trf7zauu2liu6hlb2id.onion/","pattern":"[url:value = 'http://alnsja67tiwthhbfvu4vrne7nxqrgwmobaj52trf7zauu2liu6hlb2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7211847e-ac8b-5fa2-f572-00009f467d3b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ynbc5x3lst6y6wecsnkts7itsklnxopja7utcseuqss5tc54n6uwcqad.onion/","pattern":"[url:value = 'http://ynbc5x3lst6y6wecsnkts7itsklnxopja7utcseuqss5tc54n6uwcqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--061e0fbe-32d5-10b2-8b35-00004621b71e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7wgmsubtpi2qrvgghsmznfiroo6fvtxom3lk26hlhcgnwwdikz37jeqd.onion/","pattern":"[url:value = 'http://7wgmsubtpi2qrvgghsmznfiroo6fvtxom3lk26hlhcgnwwdikz37jeqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3210c748-c308-c692-b03b-000013f3c809","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://iu4fxdim6smks3gguxaxp5y66u5677d4ipquqloz6wjxxq3q7feykrid.onion/","pattern":"[url:value = 'http://iu4fxdim6smks3gguxaxp5y66u5677d4ipquqloz6wjxxq3q7feykrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd5b649a-b44c-2543-bbee-0000f9da5eaa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ljdsv645wpylj7p2txrl43y5slelmsmml3n7wgvxszmx36r3edc6lpad.onion/","pattern":"[url:value = 'http://ljdsv645wpylj7p2txrl43y5slelmsmml3n7wgvxszmx36r3edc6lpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d08954e7-9779-60bc-9610-00001268208f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://o6p5ylhcuhtt554rpnpvwwgu7zvgh3ddsdfnpb24qbvx7i7vl475hkad.onion/","pattern":"[url:value = 'http://o6p5ylhcuhtt554rpnpvwwgu7zvgh3ddsdfnpb24qbvx7i7vl475hkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd043958-6736-2395-51a0-00009f3073b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://o6ezbwozpmepciaeq6cjdo2yy5rwiqkdpqeitf6qnydw3mlxbxb7xoad.onion/","pattern":"[url:value = 'http://o6ezbwozpmepciaeq6cjdo2yy5rwiqkdpqeitf6qnydw3mlxbxb7xoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6fbf454-7745-201b-ce02-0000c57ccc19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://k4v227umcldfbqpkhbqnnjqueuysmwpy6bzbltbfv4ik7yfsim4qgxqd.onion/","pattern":"[url:value = 'http://k4v227umcldfbqpkhbqnnjqueuysmwpy6bzbltbfv4ik7yfsim4qgxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64389f86-65cd-bc9b-619d-0000cf150cb3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ksp74k7h47ozli74rjoy6krii4kjcfoeczzd7qei4iqu46gtdlk7i5id.onion/","pattern":"[url:value = 'http://ksp74k7h47ozli74rjoy6krii4kjcfoeczzd7qei4iqu46gtdlk7i5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d295043c-6c5f-32c3-ce9a-00003d0efb47","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://khifa4f2xvvfxru3s6olzxo5n2fwxuqdmyykapedrzh5qxrmqtmyvqyd.onion/","pattern":"[url:value = 'http://khifa4f2xvvfxru3s6olzxo5n2fwxuqdmyykapedrzh5qxrmqtmyvqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--979aad36-504c-52e9-df56-0000dfe364e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xsfgu3okwm4ysvosddd2iwyhnyzvbwu4glcelzaqncdzqkmzmtn27tid.onion/","pattern":"[url:value = 'http://xsfgu3okwm4ysvosddd2iwyhnyzvbwu4glcelzaqncdzqkmzmtn27tid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a77d5ea-cf03-2156-de31-0000622dc587","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pb4znn5oxc4uy3ly7wj3sbay4wnxokh4zmud2u4hd6oqktu3bpsnmpqd.onion/","pattern":"[url:value = 'http://pb4znn5oxc4uy3ly7wj3sbay4wnxokh4zmud2u4hd6oqktu3bpsnmpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--481ff600-22aa-480c-87e4-00003b980e28","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g6m5ddg3cvwbw7yyxadpkgbcswpnux4aenbjez5p6mnyz3j7imbi5mqd.onion/","pattern":"[url:value = 'http://g6m5ddg3cvwbw7yyxadpkgbcswpnux4aenbjez5p6mnyz3j7imbi5mqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fe23fcd-d2dc-d65a-46e6-00007bdbe94a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gsuwpsbhsjjr7bn4kmktybblcnn6swue76hkpgfplev7vun3c7aj4zid.onion/","pattern":"[url:value = 'http://gsuwpsbhsjjr7bn4kmktybblcnn6swue76hkpgfplev7vun3c7aj4zid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e00c38bd-d6da-9c62-55a3-000027d9d8dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ndi3oahu4wr3wfiwjj4s2iqzsxlfbgo2qlsedfymmzbednbqwvggazqd.onion/","pattern":"[url:value = 'http://ndi3oahu4wr3wfiwjj4s2iqzsxlfbgo2qlsedfymmzbednbqwvggazqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e69f1c4-632d-6004-83bb-00005b19725c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qfwhphi2a75crdgmswnkq5stf7ypw7nl5fwtt5ydhhtqb5ygtxe34pqd.onion/","pattern":"[url:value = 'http://qfwhphi2a75crdgmswnkq5stf7ypw7nl5fwtt5ydhhtqb5ygtxe34pqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--813cb8d4-e2e2-e361-76e5-00007d8580f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kfklpeb5iu4bugpxquwpnlurmza63e6va7y7xkesgnaw2tp5gfdzrmid.onion/","pattern":"[url:value = 'http://kfklpeb5iu4bugpxquwpnlurmza63e6va7y7xkesgnaw2tp5gfdzrmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--884c005d-5204-6266-313b-0000ef78f57e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://45b2jij2pfmvize2nn2oewyh7j2bp666sdgd4b5nmjv6qfdbn44g6pid.onion/","pattern":"[url:value = 'http://45b2jij2pfmvize2nn2oewyh7j2bp666sdgd4b5nmjv6qfdbn44g6pid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1af0f228-2504-d904-2d55-0000591f23cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dmh7yyy745o3tkyj3esi4c5f32senovn4eoismee5z2gjcxrhslu3sqd.onion/","pattern":"[url:value = 'http://dmh7yyy745o3tkyj3esi4c5f32senovn4eoismee5z2gjcxrhslu3sqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3833104d-5818-d8d4-9805-000079262842","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://x5tn343h7ne3ypupgz32xov3kgo7iqu6jiyurkkgxfrquzs7zsibnqyd.onion/","pattern":"[url:value = 'http://x5tn343h7ne3ypupgz32xov3kgo7iqu6jiyurkkgxfrquzs7zsibnqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e50dae5a-a8af-02bb-533b-0000db6803f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://s7sopajp72ocucwqge7kv57av64yvvct7rdsvmbwzxtdyqd6fg7l4zyd.onion/","pattern":"[url:value = 'http://s7sopajp72ocucwqge7kv57av64yvvct7rdsvmbwzxtdyqd6fg7l4zyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b4b6d79-95ac-3e01-3e11-00009e0b9bd8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rv42srn3rjasszrvlfq7irtxoz4shfgojw4uffarmtppa2h6phzm5yyd.onion/","pattern":"[url:value = 'http://rv42srn3rjasszrvlfq7irtxoz4shfgojw4uffarmtppa2h6phzm5yyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49716a44-f0bd-fabc-e722-00003bf5a27c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2lhtjll2n3wltgp5niqar3akdcywj5zme6japwawzcmi5tj3ejwxnhad.onion/","pattern":"[url:value = 'http://2lhtjll2n3wltgp5niqar3akdcywj5zme6japwawzcmi5tj3ejwxnhad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6058843f-4100-53a2-bbc3-0000e11e63ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4qm3mni5kwea5y4pzpogqfeb3kmznn2zyzfvr7ocd5o2sodcjgaovyqd.onion/","pattern":"[url:value = 'http://4qm3mni5kwea5y4pzpogqfeb3kmznn2zyzfvr7ocd5o2sodcjgaovyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79f83ead-72af-315e-314a-0000d775eab7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://33o5mryquwkxqy7scywzgh3rehesvyppmkx2wcljdmptyxmdltehbnid.onion/","pattern":"[url:value = 'http://33o5mryquwkxqy7scywzgh3rehesvyppmkx2wcljdmptyxmdltehbnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c21a92c-f951-0d13-02f8-0000f68ded58","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gqyc527qrrflvgl67jilcfkg2tle6hekwhykdqshznp63zu3cvsgwryd.onion/","pattern":"[url:value = 'http://gqyc527qrrflvgl67jilcfkg2tle6hekwhykdqshznp63zu3cvsgwryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75c5c161-ff6c-8f86-894b-0000848c34fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cehxhnw6763mc6y22kbarpqhrnwqwdpyhtur3abwxozr2w3f4ypibyqd.onion/","pattern":"[url:value = 'http://cehxhnw6763mc6y22kbarpqhrnwqwdpyhtur3abwxozr2w3f4ypibyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e26fbe0-2ebb-c44c-912e-000078d1281b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://igsovciayhnw6q7beadcol465epxjlmx3njo2vs6ru2ikqpfbmni25qd.onion/","pattern":"[url:value = 'http://igsovciayhnw6q7beadcol465epxjlmx3njo2vs6ru2ikqpfbmni25qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3fbb283-47ea-a7d3-7e31-0000eb99070a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://je3cboyhsd6aps755x6cmhpmkh2xcznazya7l2bvzmpsn6ifyphp34yd.onion/","pattern":"[url:value = 'http://je3cboyhsd6aps755x6cmhpmkh2xcznazya7l2bvzmpsn6ifyphp34yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69e64646-73ad-e7ad-5bde-00006f2b1b7b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kwhe2oj6wwxdh7pgftul5g4ib6fzg7shpol6negvnrdtml5eblyrwdid.onion/","pattern":"[url:value = 'http://kwhe2oj6wwxdh7pgftul5g4ib6fzg7shpol6negvnrdtml5eblyrwdid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91de9272-b828-e7af-6ab1-0000811fee4a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yrqwicz4y5agdgtd3e3l27jxpaaqhtqtpsqgetxryqzmaf3z5xj2wpyd.onion/","pattern":"[url:value = 'http://yrqwicz4y5agdgtd3e3l27jxpaaqhtqtpsqgetxryqzmaf3z5xj2wpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28d38aa1-1557-231d-399a-0000f27a817e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://e6x3mrw37u7xrxaonusji7k2cguz3btlgjd4ncbvdtamiaqo4temo4qd.onion/","pattern":"[url:value = 'http://e6x3mrw37u7xrxaonusji7k2cguz3btlgjd4ncbvdtamiaqo4temo4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96f29d7f-e2da-344e-e66d-00003c870d32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://a6c27imx6fpdacje7jhhlibjald2u5twofvepno2nu3nlfee24wa23ad.onion/","pattern":"[url:value = 'http://a6c27imx6fpdacje7jhhlibjald2u5twofvepno2nu3nlfee24wa23ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d35b438-c392-8b77-a37f-000008145e14","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ytlui6t3l3bz2uhtuogr6uomvlmlvoxqizgp3ovreejehwuzgxsnsxqd.onion/","pattern":"[url:value = 'http://ytlui6t3l3bz2uhtuogr6uomvlmlvoxqizgp3ovreejehwuzgxsnsxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a95580e-9e79-2073-0d10-00000cefd819","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vsd5b6txkvee5rjojbnbyp3iwa6ckxuc5jrhz6zcpqofsias43y57tyd.onion/","pattern":"[url:value = 'http://vsd5b6txkvee5rjojbnbyp3iwa6ckxuc5jrhz6zcpqofsias43y57tyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eba54686-8029-7666-8057-000011519d93","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vzjr3n5m25v6mhngl4yc2qiijnh5uufdnbuxu3e7bosj2ojkoho6etyd.onion/","pattern":"[url:value = 'http://vzjr3n5m25v6mhngl4yc2qiijnh5uufdnbuxu3e7bosj2ojkoho6etyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c9be1c6-a2d4-6563-2aa4-000041ec2711","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uwwxgb4jkt77ldvvshlk7phubbgp4jva36tzaeh3u4c326xa53hdofid.onion/","pattern":"[url:value = 'http://uwwxgb4jkt77ldvvshlk7phubbgp4jva36tzaeh3u4c326xa53hdofid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ce4dd20-f8d8-e24b-3120-00005fca9e21","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qienexa5fkp2tt2fasdglgzojbzve4nbb5siyjjodte7k446rkpoqiad.onion/","pattern":"[url:value = 'http://qienexa5fkp2tt2fasdglgzojbzve4nbb5siyjjodte7k446rkpoqiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcfc2835-e4d7-0f86-4cb3-00003f8072f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ag3zagrp26xhvnxl3522fqxzsbuwvk2xdxrs5zpm7y6g3xufysn52gyd.onion/","pattern":"[url:value = 'http://ag3zagrp26xhvnxl3522fqxzsbuwvk2xdxrs5zpm7y6g3xufysn52gyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ade44b90-4922-be3f-fb3a-0000bd8f4d5c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://djs7zrnlmrrgrpzkgsn62j3k3p6vlvvhy2cmw7g55cvx5gtgz3twgfqd.onion/","pattern":"[url:value = 'http://djs7zrnlmrrgrpzkgsn62j3k3p6vlvvhy2cmw7g55cvx5gtgz3twgfqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e99f13cb-4d42-2170-9b92-000068d3f3a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5fiwdpsvflirkq2uonftcwv5ux54qeyhkbggfubbjdos6jynqoayveid.onion/","pattern":"[url:value = 'http://5fiwdpsvflirkq2uonftcwv5ux54qeyhkbggfubbjdos6jynqoayveid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--204ccb25-9188-c32f-ab87-00009d94c2bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qkdpd4bdg5vhftcwwyv7y6obzbw4xsxmm7rmourgzveae45pdumejlqd.onion/","pattern":"[url:value = 'http://qkdpd4bdg5vhftcwwyv7y6obzbw4xsxmm7rmourgzveae45pdumejlqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--616dea14-f568-d7b9-8a00-000078cb48e0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ljc5kt4pd22vmxyejlbjzpz5ax7dgwpidyfyrdqk6xo6tuh6kco7gdyd.onion/","pattern":"[url:value = 'http://ljc5kt4pd22vmxyejlbjzpz5ax7dgwpidyfyrdqk6xo6tuh6kco7gdyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25af6c5c-d1fb-007e-36fb-00001ef1088d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://md4greyvkgkw7pqreh5v7xfa5pelirtsew6cbjk46pdu7hm7bjxraqid.onion/","pattern":"[url:value = 'http://md4greyvkgkw7pqreh5v7xfa5pelirtsew6cbjk46pdu7hm7bjxraqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23d76e12-1223-18b1-1e17-0000081d33cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p5n3fvzqnjrijfzzygeiwrc3o6gsiu6dtvfmwqwjjfc3effal3775xqd.onion/","pattern":"[url:value = 'http://p5n3fvzqnjrijfzzygeiwrc3o6gsiu6dtvfmwqwjjfc3effal3775xqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a61fdef4-85de-3b65-6401-0000d4087b60","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6hprxamxybyaodcw4g6hxw6ngwlxld2mronh5yniswpplo6xccpj52qd.onion/","pattern":"[url:value = 'http://6hprxamxybyaodcw4g6hxw6ngwlxld2mronh5yniswpplo6xccpj52qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4379660c-26e0-0684-12b1-0000e712b930","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://b6uslc3dlt2xqvbujioitx7ct4lvrq6gaucih4qi54h6hhcoj7dmoaid.onion/","pattern":"[url:value = 'http://b6uslc3dlt2xqvbujioitx7ct4lvrq6gaucih4qi54h6hhcoj7dmoaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3f57c43-1674-c915-aa3a-0000c8f7468d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://274e36hcao25a3ltzw2hgqlerutdb2pg26kjxhfr6oayj7a3drye6zad.onion/","pattern":"[url:value = 'http://274e36hcao25a3ltzw2hgqlerutdb2pg26kjxhfr6oayj7a3drye6zad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6dcb0ef-ce7d-18c8-fd29-00003d68e2a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3konwt4eair5d3gbuzb327gmluy5d2g6etcb5ky5vdm25essevofbsqd.onion/","pattern":"[url:value = 'http://3konwt4eair5d3gbuzb327gmluy5d2g6etcb5ky5vdm25essevofbsqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e122725-a0bf-440c-ea52-0000e38c0206","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7f23dkjirpgsdssdwruxwejaenpbsle3jdxbq44h6gsupd3n52tcedqd.onion/","pattern":"[url:value = 'http://7f23dkjirpgsdssdwruxwejaenpbsle3jdxbq44h6gsupd3n52tcedqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b93ed8f-2fdc-3fed-7ce5-00009cc956d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://daxicevkc6vzljhkcueogxhztjzeb634rbdgmaio5kg77iwqh5epsgid.onion/","pattern":"[url:value = 'http://daxicevkc6vzljhkcueogxhztjzeb634rbdgmaio5kg77iwqh5epsgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dc21fd6-f057-0f3f-85b6-0000c542a163","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://a4sopzricrvvjnlnnujtiqxskgdukhj4sfepcxbedsmyz3rsrrsyq2ad.onion/","pattern":"[url:value = 'http://a4sopzricrvvjnlnnujtiqxskgdukhj4sfepcxbedsmyz3rsrrsyq2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--285e7dd4-b6be-dfa1-7a48-000068b4a322","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nddehm3ghksxjsaqczqmq2vp64erv3t52hzplkr73s2n7vefehrllaad.onion/","pattern":"[url:value = 'http://nddehm3ghksxjsaqczqmq2vp64erv3t52hzplkr73s2n7vefehrllaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b169167b-8655-fb8b-c558-00008424ae85","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://f562khrajerizksiy7iltvb6yjgcqqulksc5kvfwlrmkgehylzmwheid.onion/","pattern":"[url:value = 'http://f562khrajerizksiy7iltvb6yjgcqqulksc5kvfwlrmkgehylzmwheid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d54fec1-f2ff-032b-ab39-00008222e03a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qldyj3m3pwyyvdmbsgfpjxmrwtgboq7xb22nrdvfkzpkbbk5etoz6uad.onion/","pattern":"[url:value = 'http://qldyj3m3pwyyvdmbsgfpjxmrwtgboq7xb22nrdvfkzpkbbk5etoz6uad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--405f30f5-c94f-0336-dfee-000063eb8e43","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wq5xfvygxl7wu24qdnqqe6aihjni4o7v3otk5fy3c65xqmnrsxk5wqqd.onion/","pattern":"[url:value = 'http://wq5xfvygxl7wu24qdnqqe6aihjni4o7v3otk5fy3c65xqmnrsxk5wqqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee0aec9b-df4f-045e-f1f7-0000172e47af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jtn6kogqzhpa4okce76tfxpropztzhgfwqw36e7spxiua26mgrtoqnid.onion/","pattern":"[url:value = 'http://jtn6kogqzhpa4okce76tfxpropztzhgfwqw36e7spxiua26mgrtoqnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e30d41ec-5023-8d1b-96e8-0000c35d6e70","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rre3xcbjyna5eriayhw6kesaqxcb2c5dulwl7setvedfqknuo56llmad.onion/","pattern":"[url:value = 'http://rre3xcbjyna5eriayhw6kesaqxcb2c5dulwl7setvedfqknuo56llmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32616394-0962-5516-93d7-00007a093c1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3m532a2wnyi4gg4r3ftseaycnredsl5lefwoju6smfghmrunx6o5zcid.onion/","pattern":"[url:value = 'http://3m532a2wnyi4gg4r3ftseaycnredsl5lefwoju6smfghmrunx6o5zcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f221123b-fe4b-c659-0437-0000e8d52fa0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://355yfctz6uq4427ptnnw36wusfmh5banzqt2igmsaam3asvqgpctobid.onion/","pattern":"[url:value = 'http://355yfctz6uq4427ptnnw36wusfmh5banzqt2igmsaam3asvqgpctobid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d9c8063-89a6-9cb6-33b1-00007cdd77ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://n7jqfkmhu7gwua42wsm4kdl7x5rzhombxjvohx6x53be6atz4ks6hwqd.onion/","pattern":"[url:value = 'http://n7jqfkmhu7gwua42wsm4kdl7x5rzhombxjvohx6x53be6atz4ks6hwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b72ad2a6-2674-a030-d762-000041360a80","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://neibmgiu5wksweqvs6icrj4k5fvq3ltgudpvvwu35xaprbwy5j4kuoid.onion/","pattern":"[url:value = 'http://neibmgiu5wksweqvs6icrj4k5fvq3ltgudpvvwu35xaprbwy5j4kuoid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e9fd6ff-d2be-0bd6-e178-0000fd3c9d51","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fukvcbzfxjmqrevqf7xmujdk3wxidtqjxdxypmcbsl4tufpe62mqbdqd.onion/","pattern":"[url:value = 'http://fukvcbzfxjmqrevqf7xmujdk3wxidtqjxdxypmcbsl4tufpe62mqbdqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1363a425-16ec-b610-f7e7-0000d42088b9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uvkiz4dgu3iw5mtc54lchevcosvm7abyc5rqfngjzso7bvmlhfm6dyid.onion/","pattern":"[url:value = 'http://uvkiz4dgu3iw5mtc54lchevcosvm7abyc5rqfngjzso7bvmlhfm6dyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1db96f60-f1d7-854d-214d-0000ec79f2d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://euesxh6f7qlypwvu6vws4qaxjgnno2oudn5umfhffmw3ffyhzekj7fqd.onion/","pattern":"[url:value = 'http://euesxh6f7qlypwvu6vws4qaxjgnno2oudn5umfhffmw3ffyhzekj7fqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54b07156-ffa8-05e4-b585-00006102ecc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bx3fwizfurizjms7i5fjf4rqmk2bx5panoyfuk56tzle7d2np3q3vjid.onion/","pattern":"[url:value = 'http://bx3fwizfurizjms7i5fjf4rqmk2bx5panoyfuk56tzle7d2np3q3vjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90a76ba8-c059-628c-46e8-0000eda6cdc1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nqmrdqv45dncvjy3mnnccamfor5ecnde3xfeyejm4cqcnmhg2hisidad.onion/","pattern":"[url:value = 'http://nqmrdqv45dncvjy3mnnccamfor5ecnde3xfeyejm4cqcnmhg2hisidad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2946e1ee-92f9-0415-90ba-00008fd09e25","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://esl2mvv6u7n4csf6qvmgvvldku7xo2tspkqztzdsf6wo3uw23ohc4iqd.onion/","pattern":"[url:value = 'http://esl2mvv6u7n4csf6qvmgvvldku7xo2tspkqztzdsf6wo3uw23ohc4iqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95cafdd1-9095-e292-cd1c-0000a29eae62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://n2p7ejvlekagkffszor2ep7pywks37wxbjt7ngyt6vmonmcz6ohuokad.onion/","pattern":"[url:value = 'http://n2p7ejvlekagkffszor2ep7pywks37wxbjt7ngyt6vmonmcz6ohuokad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79472726-4711-db29-0731-0000facb19d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3aajsu74akuddlzj5zcv4dhckbqgu3xfgyfxkupluqfuvpkovmsn6qid.onion/","pattern":"[url:value = 'http://3aajsu74akuddlzj5zcv4dhckbqgu3xfgyfxkupluqfuvpkovmsn6qid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4825a07-121a-dc1f-d0c2-0000b2db042d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ulpkp62dcatxv7ufgpo5jng4gtjovjzzvettn67ryfnutmz6cyp6viyd.onion/","pattern":"[url:value = 'http://ulpkp62dcatxv7ufgpo5jng4gtjovjzzvettn67ryfnutmz6cyp6viyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--407401bf-2c20-fdd9-fa2d-0000740778a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3rbo6bdcl7znlwmskn7spu2l6xrr4macaaulev72jyfhjto3rg7fvpyd.onion/","pattern":"[url:value = 'http://3rbo6bdcl7znlwmskn7spu2l6xrr4macaaulev72jyfhjto3rg7fvpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceec3e62-252f-c68d-0ff9-0000575cef00","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://styqen6rpkmbef5zpdxdlpzxofwc2bv5ziwdeycy6yg2ghsxyyetcpyd.onion/","pattern":"[url:value = 'http://styqen6rpkmbef5zpdxdlpzxofwc2bv5ziwdeycy6yg2ghsxyyetcpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dad319e-d3cf-2c57-908a-00006dc1088e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lnkxat2xutaov6uvpq5j7hgyzh5irkrji5dhqrs2hr762723r2rqznid.onion/","pattern":"[url:value = 'http://lnkxat2xutaov6uvpq5j7hgyzh5irkrji5dhqrs2hr762723r2rqznid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dadfa9cd-915a-4a50-b7e5-000004a88882","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tjba45gilocqsbges65bcvlfddkm3nhxdupnrxyihjafmiviq2mgz6yd.onion/","pattern":"[url:value = 'http://tjba45gilocqsbges65bcvlfddkm3nhxdupnrxyihjafmiviq2mgz6yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8089ab0-87ca-9f63-f449-0000b45d51a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3ketfyxjshfp6x7lp673r3hs5qxhkwwygg3gslklcpudcaaatcymwdid.onion/","pattern":"[url:value = 'http://3ketfyxjshfp6x7lp673r3hs5qxhkwwygg3gslklcpudcaaatcymwdid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56e41f03-6726-5026-6845-00009c0dd35e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://v527dzuyh24lgttskx4mon2tgk72xrj4r73jintiw3zt2a7ziucbblqd.onion/","pattern":"[url:value = 'http://v527dzuyh24lgttskx4mon2tgk72xrj4r73jintiw3zt2a7ziucbblqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e8dd044-e3e9-1545-c606-000091d45a1e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kcflhn4u2xqhd3vc74ymdpqjcef5zqbc5e6xkqe2p75x4ybrl6bfgnyd.onion/","pattern":"[url:value = 'http://kcflhn4u2xqhd3vc74ymdpqjcef5zqbc5e6xkqe2p75x4ybrl6bfgnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82588ea1-5818-df25-319a-0000ec7c1e78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uju3v57zk3bqwbtnxaextzk7krrjpt7c7f55yg3kfakljlsmox4s32yd.onion/","pattern":"[url:value = 'http://uju3v57zk3bqwbtnxaextzk7krrjpt7c7f55yg3kfakljlsmox4s32yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59fba076-9315-6b74-ca6c-00002062c668","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xuqa3gjo4bpflbckaskize2mgmdusf6hzsdj3xs5r7axiqswnqkjuvqd.onion/","pattern":"[url:value = 'http://xuqa3gjo4bpflbckaskize2mgmdusf6hzsdj3xs5r7axiqswnqkjuvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--782efe2c-935a-cfd9-afc5-000093c83bae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xvuawymlya547ymvif2s66leck3uyj4bgapoogc77r2uj6oopccsdjid.onion/","pattern":"[url:value = 'http://xvuawymlya547ymvif2s66leck3uyj4bgapoogc77r2uj6oopccsdjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19d4684f-81c9-86df-823e-0000a32a7828","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rhfyyvvb7g7dt4g7veiisdl57lwaqr5csp2hkcjwff7wyumdbo6b7nid.onion/","pattern":"[url:value = 'http://rhfyyvvb7g7dt4g7veiisdl57lwaqr5csp2hkcjwff7wyumdbo6b7nid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d6153d9-88e4-67ae-f6f8-0000dd0d1425","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jzh4hs5sh5a3cx7mdizdgwswy55q32p3ogwvfiubo3yq2vpsatajkuyd.onion/","pattern":"[url:value = 'http://jzh4hs5sh5a3cx7mdizdgwswy55q32p3ogwvfiubo3yq2vpsatajkuyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5740f6d3-dbec-015d-86b2-00004f83c93b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4tn7j5spr6dpgp65hbpplrs76tpsg2qj475s4obi5c7qdocszngaggqd.onion/","pattern":"[url:value = 'http://4tn7j5spr6dpgp65hbpplrs76tpsg2qj475s4obi5c7qdocszngaggqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ee8ff60-ef7d-e6e7-ace3-000081541938","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fil3jdba32zrwv54in7ws42mqgncyhbrmf5g4ucmf4bpnvlx2ugc7gqd.onion/","pattern":"[url:value = 'http://fil3jdba32zrwv54in7ws42mqgncyhbrmf5g4ucmf4bpnvlx2ugc7gqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9dfd851-65e6-816f-44e0-0000c6858182","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7ofecovurqwlni3ocmeam5x6l6gu4oodcy7owdxq6dxkxelxrmianyqd.onion/","pattern":"[url:value = 'http://7ofecovurqwlni3ocmeam5x6l6gu4oodcy7owdxq6dxkxelxrmianyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fe83be3-96b0-8c8b-b99f-0000cdb1ae6a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5iey4r4utujz2klf6mcekhxwuxo2rqvb2lcz5t2p62bpujfhgxd5faqd.onion/","pattern":"[url:value = 'http://5iey4r4utujz2klf6mcekhxwuxo2rqvb2lcz5t2p62bpujfhgxd5faqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--571c9fea-b914-7e52-5952-0000b2dbda15","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xu7fyjo35dfqqrk6fiis2w5ukqfe46cskr4jsyfo36guk7pcm3e35lad.onion/","pattern":"[url:value = 'http://xu7fyjo35dfqqrk6fiis2w5ukqfe46cskr4jsyfo36guk7pcm3e35lad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9719a4d-ceb8-4c29-fad1-0000209878ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6bmiskklpk6lnabqczaleo76cozzy34pgngqypzls7zbf52mu7i5izyd.onion/","pattern":"[url:value = 'http://6bmiskklpk6lnabqczaleo76cozzy34pgngqypzls7zbf52mu7i5izyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5ccfd2f-db15-c47e-aaa0-0000f4a755bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fyc7rx4quchbysxr4hho264a3b2uoply76g7yu23gile2ek7y5ubvnid.onion/","pattern":"[url:value = 'http://fyc7rx4quchbysxr4hho264a3b2uoply76g7yu23gile2ek7y5ubvnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5eebb10a-bc39-f5fe-d81a-000033e7642f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m4wv5rbwnbq7iqdz6w3feoyafqqet3tf4baojz3sbpo3qudel7772zqd.onion/","pattern":"[url:value = 'http://m4wv5rbwnbq7iqdz6w3feoyafqqet3tf4baojz3sbpo3qudel7772zqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d2a2a7b-cefa-59db-6d66-00001802c7ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://u63zm2mdsvqyuunihval72tq42isc5yjix6646lbz4mtvutsdpl53dad.onion/","pattern":"[url:value = 'http://u63zm2mdsvqyuunihval72tq42isc5yjix6646lbz4mtvutsdpl53dad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77bfe74c-3f6a-2917-bfdd-0000c717fa4b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fc6w4glqdex3ge7hazga4abff5gsi5httgay3tul442324fxscfmgjid.onion/","pattern":"[url:value = 'http://fc6w4glqdex3ge7hazga4abff5gsi5httgay3tul442324fxscfmgjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b5ad540-8ac7-4d8c-2199-0000f31d4145","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://v4225sbsop3gtymojtjlpghoy7m4vhkrrkkiqko4zldglpsxrrwozlid.onion/","pattern":"[url:value = 'http://v4225sbsop3gtymojtjlpghoy7m4vhkrrkkiqko4zldglpsxrrwozlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2becefb-507e-0d48-ba45-00003447bd16","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ysevl2dktor37mjylfllib4o4ino2vk25lymmaoqphzza6tqikyi5cqd.onion/","pattern":"[url:value = 'http://ysevl2dktor37mjylfllib4o4ino2vk25lymmaoqphzza6tqikyi5cqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3aa21b8-2559-29d3-9efd-000085a7b5e0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2mazdz5lt6myokumykncynq7tdaawbtop7rsttztz4556tnnn72bmgad.onion/","pattern":"[url:value = 'http://2mazdz5lt6myokumykncynq7tdaawbtop7rsttztz4556tnnn72bmgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0eab881f-0f15-3658-745c-00005152c9ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://glx7uvlr4k7nrfla7wk64pfbxkncy3v5aapwfe6umwfwsej4jvlveiyd.onion/","pattern":"[url:value = 'http://glx7uvlr4k7nrfla7wk64pfbxkncy3v5aapwfe6umwfwsej4jvlveiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f50a9457-b78d-c711-19fb-0000687ddb6e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lezq6wuezehjq35tllwqn4qqtnzh5d66rhmifnhplz5dwlpv5bbn32yd.onion/","pattern":"[url:value = 'http://lezq6wuezehjq35tllwqn4qqtnzh5d66rhmifnhplz5dwlpv5bbn32yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87f38c08-2468-9e55-7d62-000049e76070","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ibwjbk2udjxalafk4s52lp22juj6d7ogqrptbcbewooy4w7pdml3liid.onion/","pattern":"[url:value = 'http://ibwjbk2udjxalafk4s52lp22juj6d7ogqrptbcbewooy4w7pdml3liid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ee83ea2-b01e-4ac9-8f30-0000c19ebdd9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fdsd2eoivckkf5uv4mxazboabhdyplbq7hrr6cxwjp6iza5fspdzr3ad.onion/","pattern":"[url:value = 'http://fdsd2eoivckkf5uv4mxazboabhdyplbq7hrr6cxwjp6iza5fspdzr3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9824c188-e37d-083f-3745-0000f5b20dd0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4jjffvx23dtgfr23wv3c4phfanxmxb74dqudkbgujhvkh5nfnhdo2hyd.onion/","pattern":"[url:value = 'http://4jjffvx23dtgfr23wv3c4phfanxmxb74dqudkbgujhvkh5nfnhdo2hyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--744509d0-7801-e00f-6d2f-0000ae8b7ebc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tim5mpyt72hjytoc2fvn45mqoly34tnclc3myt34bx2tvw26h4v466ad.onion/","pattern":"[url:value = 'http://tim5mpyt72hjytoc2fvn45mqoly34tnclc3myt34bx2tvw26h4v466ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0665a7f6-2ede-4b5c-eb5d-000099a1f533","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3gslvpe5ov7xwnxjehhzwzjmswgp3te4aohdgtouyukpvq3xggnvnpad.onion/","pattern":"[url:value = 'http://3gslvpe5ov7xwnxjehhzwzjmswgp3te4aohdgtouyukpvq3xggnvnpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fabd73ad-286e-56fd-d935-000094146e63","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qpwp3ktx7dclpuwrx2uz2ygpd2xnplcjqr2wl4teg23az46i7gaqqjad.onion/","pattern":"[url:value = 'http://qpwp3ktx7dclpuwrx2uz2ygpd2xnplcjqr2wl4teg23az46i7gaqqjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9035c3a-143b-1538-5375-0000528d66a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ea4k7x3lrjgvhqbu4ss7a2qvbihb7eltgybawist36ahgzgy6ze3baad.onion/","pattern":"[url:value = 'http://ea4k7x3lrjgvhqbu4ss7a2qvbihb7eltgybawist36ahgzgy6ze3baad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fddc260-444c-8ad6-7d1d-0000bd0f9554","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qdunrpvavgscc63bbjbfzsytfwyfheh5fzykrbmu6mzimb6qcas2dxid.onion/","pattern":"[url:value = 'http://qdunrpvavgscc63bbjbfzsytfwyfheh5fzykrbmu6mzimb6qcas2dxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09d9b101-7112-5991-2699-0000f765da19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nuxr6sujnp26dj7wyhicwe7i5jzrqef7dxaneejzz5xc2by2cotaknid.onion/","pattern":"[url:value = 'http://nuxr6sujnp26dj7wyhicwe7i5jzrqef7dxaneejzz5xc2by2cotaknid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c41ef82-71d6-06ef-bc4d-0000cefa1469","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rquamtkv55voc3r736awbuklbhujizppdt7ubu4hldtxvx7pdcmfyrid.onion/","pattern":"[url:value = 'http://rquamtkv55voc3r736awbuklbhujizppdt7ubu4hldtxvx7pdcmfyrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20f26bb8-5124-c1cf-05f8-0000ea81cb7a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://a3dzxbosl6cepdbcjmfnn3y3sro5mzt5sgsc5hy63r4u56svgrrazaad.onion/","pattern":"[url:value = 'http://a3dzxbosl6cepdbcjmfnn3y3sro5mzt5sgsc5hy63r4u56svgrrazaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ec35272-d18f-b3e4-45dc-000029e35522","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ecuickfsktqgnqbq2q3v77pcyhpom5kha3hgjc5dqxjj7sbew2o3zcqd.onion/","pattern":"[url:value = 'http://ecuickfsktqgnqbq2q3v77pcyhpom5kha3hgjc5dqxjj7sbew2o3zcqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8e11528-cbdd-bf77-a9d1-0000229066b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gloya5gofd76hfye6xzhvj4ynasvqvzl6i2q4ntl7krql4qmsd6mpqad.onion/","pattern":"[url:value = 'http://gloya5gofd76hfye6xzhvj4ynasvqvzl6i2q4ntl7krql4qmsd6mpqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88966bed-3efd-73cd-d450-0000ca2982c8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2eb47nlbj3ypo5msdxtnhm3qwre3v7ifgostlqkrulj6zx4ifavidyyd.onion/","pattern":"[url:value = 'http://2eb47nlbj3ypo5msdxtnhm3qwre3v7ifgostlqkrulj6zx4ifavidyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b48dedce-3e45-4665-6f16-0000179e8c6c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rz2rqxjx4casrtegra76wgo56x5vngjdg2euy3t2l6totgcfmkekyzyd.onion/","pattern":"[url:value = 'http://rz2rqxjx4casrtegra76wgo56x5vngjdg2euy3t2l6totgcfmkekyzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6249df2b-a4c5-1eb3-5ed5-0000c9cecc29","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ypi6t7qud5u5meu23it47h7gpue3bnpgtlk2gdvgixqabfdpwxrzzkqd.onion/","pattern":"[url:value = 'http://ypi6t7qud5u5meu23it47h7gpue3bnpgtlk2gdvgixqabfdpwxrzzkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3422a790-fade-d795-e0f5-00003d4396a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://znwywdshu5dkz5q64n6fymlvcg2xlvmikb4rkyzqvpudhkwu3x77syyd.onion/","pattern":"[url:value = 'http://znwywdshu5dkz5q64n6fymlvcg2xlvmikb4rkyzqvpudhkwu3x77syyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fcbe9cd-282c-38b9-6df5-0000ee0b132f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6coghfuocm6enveoxjnj2m4qsqqn3bydhzu4bxy6zzcxy3lgb7fbmfyd.onion/","pattern":"[url:value = 'http://6coghfuocm6enveoxjnj2m4qsqqn3bydhzu4bxy6zzcxy3lgb7fbmfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dd1bd1e-cb62-1a7f-2e4b-00004271f92e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://i7wzmcfrz2gbpubjt6ztucpbpem2fysg72vcuwqigdwu4zscbst573qd.onion/","pattern":"[url:value = 'http://i7wzmcfrz2gbpubjt6ztucpbpem2fysg72vcuwqigdwu4zscbst573qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd784bdb-3ab3-cda0-8818-000038f9f062","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5t6wiarxyc77jjjhk735xlkfqhoqojabivlrxr6vu5uh5vjud7ndiryd.onion/","pattern":"[url:value = 'http://5t6wiarxyc77jjjhk735xlkfqhoqojabivlrxr6vu5uh5vjud7ndiryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49d9fde3-0199-27b9-f307-000001cfde9e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hevead62mijwe2ci273pbk3n5xicjwlknj77axkziuyp3rejpn3bq3ad.onion/","pattern":"[url:value = 'http://hevead62mijwe2ci273pbk3n5xicjwlknj77axkziuyp3rejpn3bq3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--949f8457-8f2a-d2f8-baf7-0000a2daae95","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5cssic2psnl2jslpjwuk44m2nwu3zroreqenjrxya65m6my2yxytq4qd.onion/","pattern":"[url:value = 'http://5cssic2psnl2jslpjwuk44m2nwu3zroreqenjrxya65m6my2yxytq4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34ac9ece-91c0-5ff9-3925-00005fe5b687","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6edb2xkyjc23zobbhyufvyg4m36b5t7uyxzc74dd7i6kv4xdqosmb2yd.onion/","pattern":"[url:value = 'http://6edb2xkyjc23zobbhyufvyg4m36b5t7uyxzc74dd7i6kv4xdqosmb2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--293d2f82-bb76-92d9-3a72-00005cb3fe15","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qi5wmauvdvx6nrentqzvberiwecbbs2pct35gob5hwnyxwqig3uoenad.onion/","pattern":"[url:value = 'http://qi5wmauvdvx6nrentqzvberiwecbbs2pct35gob5hwnyxwqig3uoenad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea9b9082-9ec9-62ed-35f3-0000005b4a7c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gm7xqrtsln6elnwbbb6szzc5zn36qploy5u7yzi5jpmpxzgbr7dvwryd.onion/","pattern":"[url:value = 'http://gm7xqrtsln6elnwbbb6szzc5zn36qploy5u7yzi5jpmpxzgbr7dvwryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ff59a5d-9e57-4340-cf45-0000d66b9c61","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://elizzldyssdok2zrvy5e3ebgep5666dpicpw74zubvnph2mmzsyyieid.onion/","pattern":"[url:value = 'http://elizzldyssdok2zrvy5e3ebgep5666dpicpw74zubvnph2mmzsyyieid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b05ae1a-0607-d36a-6749-0000a52906ab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://z4kympcennryizw7cq6fhq4kocvxmapuwabuelcynlkdfq6dlt4zsvqd.onion/","pattern":"[url:value = 'http://z4kympcennryizw7cq6fhq4kocvxmapuwabuelcynlkdfq6dlt4zsvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc47aacd-6349-d295-413d-0000d151c021","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4vx2ig7egsqgbwue7rdatmw6msaq5qjrhlr6drlecj27txondddfb3id.onion/","pattern":"[url:value = 'http://4vx2ig7egsqgbwue7rdatmw6msaq5qjrhlr6drlecj27txondddfb3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--509aa54c-457d-1236-d2a5-00004e5c03ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2gcrsof7cldihnxk2qsctxd5hqdi74lvskncl6ook7hrej6jrw2ohzid.onion/","pattern":"[url:value = 'http://2gcrsof7cldihnxk2qsctxd5hqdi74lvskncl6ook7hrej6jrw2ohzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6c81cb9-3a32-a891-e72f-00004d319758","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lzfmcpjgum46m3asismwhanpxffxuqxxqfopcxhda6y7ghpb6vcruoyd.onion/","pattern":"[url:value = 'http://lzfmcpjgum46m3asismwhanpxffxuqxxqfopcxhda6y7ghpb6vcruoyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6b441ef-be3f-1a86-38e5-000073a6db34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qnarlsn6i5jga3oiz5ipmc3td4hgw5mlodlrh2kpgwbomuixz4ivknad.onion/","pattern":"[url:value = 'http://qnarlsn6i5jga3oiz5ipmc3td4hgw5mlodlrh2kpgwbomuixz4ivknad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fe653f7-f82f-58dd-b8ad-00009c02696e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kjzdmmbkb7yb7m4cgwhzvow2lz6bj4kh4rcmfqjfglm77e4mewg3ctad.onion/","pattern":"[url:value = 'http://kjzdmmbkb7yb7m4cgwhzvow2lz6bj4kh4rcmfqjfglm77e4mewg3ctad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1c5a0a6-c571-0621-38ed-00006c8aee7b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nr4dn2z2z26aab3ah2zob3g4fadqneg2slqcaigmjlule7pvhzccrvad.onion/","pattern":"[url:value = 'http://nr4dn2z2z26aab3ah2zob3g4fadqneg2slqcaigmjlule7pvhzccrvad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cf4b187-5fac-d9d3-7c9f-00005702e1db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vg2l7qu7ronuyd24e53adx3xhdt2htl2y7cziumrzehr457wdqqnlfyd.onion/","pattern":"[url:value = 'http://vg2l7qu7ronuyd24e53adx3xhdt2htl2y7cziumrzehr457wdqqnlfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92376390-4c21-5347-2811-0000ff0860a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7yb3xzz554ows7qij55t4ierbzzierwsluhqmoltxwpkxpaqvvn5rxid.onion/","pattern":"[url:value = 'http://7yb3xzz554ows7qij55t4ierbzzierwsluhqmoltxwpkxpaqvvn5rxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf625ba5-6892-4e87-252d-0000d1365e71","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5ctxovxn6tjp3tthqho2h4jlabopfz2k6jtziwq6gvzwsx3mmul2ojyd.onion/","pattern":"[url:value = 'http://5ctxovxn6tjp3tthqho2h4jlabopfz2k6jtziwq6gvzwsx3mmul2ojyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cc1b66d-e249-ace4-db57-0000ea85e6d9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://iqytpvofgtxw7xonlxcugr3f5gxgrqluid2dvzbofd5jy6iz72t6xaqd.onion/","pattern":"[url:value = 'http://iqytpvofgtxw7xonlxcugr3f5gxgrqluid2dvzbofd5jy6iz72t6xaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--252845fb-fe26-9003-9ccb-0000f55cca00","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ub3qgqqkmbn5qjwzdpsyxhr6indalu3elffzn3b64b6jthvhia3v3qyd.onion/","pattern":"[url:value = 'http://ub3qgqqkmbn5qjwzdpsyxhr6indalu3elffzn3b64b6jthvhia3v3qyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7cceb78-24d8-cb6b-50bd-000081ccd83d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://62sarr6yixt37xomq23cvn4sliul6izimynn4yjv5orpxq2d5dzhxnyd.onion/","pattern":"[url:value = 'http://62sarr6yixt37xomq23cvn4sliul6izimynn4yjv5orpxq2d5dzhxnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8c5b3f0-ef81-b4ba-1ab7-00006554fd82","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tszr7xr2ankqiwzddojdguf73esmvhpj7gsetwmz5vkhjghgsbrceqyd.onion/","pattern":"[url:value = 'http://tszr7xr2ankqiwzddojdguf73esmvhpj7gsetwmz5vkhjghgsbrceqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b84ffca-2456-ec85-4abe-000011bfec08","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zrzhomix5spu7brkh7tmj3r5gvmpd2elwfukoscftke4b4nyskqvwead.onion/","pattern":"[url:value = 'http://zrzhomix5spu7brkh7tmj3r5gvmpd2elwfukoscftke4b4nyskqvwead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abcbf511-6abd-ba5b-73bc-00008cef8282","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4yn4fzzf2pwg7ruz5adlely42m3kgvrfrp4cukrp4ufh7cabxg2w25qd.onion/","pattern":"[url:value = 'http://4yn4fzzf2pwg7ruz5adlely42m3kgvrfrp4cukrp4ufh7cabxg2w25qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f97f542d-ca91-2f52-1604-0000da8e6419","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jl2jf7yfgvgl27zggx4xlcupbjm6p35jeg75hbg4ti4rppd7lo7rubid.onion/","pattern":"[url:value = 'http://jl2jf7yfgvgl27zggx4xlcupbjm6p35jeg75hbg4ti4rppd7lo7rubid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--354ca2f3-c16e-3ad7-7846-0000a0af5bc2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ltpcjbrdps2ybfz64irhjexiys45fr6keu7lbssbdizalmggskk6zoyd.onion/","pattern":"[url:value = 'http://ltpcjbrdps2ybfz64irhjexiys45fr6keu7lbssbdizalmggskk6zoyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec6084ef-3d44-aef5-0608-00004495eec8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://77bq6vwhss5dmzlandgztuahkgliaa4h7e6qam2l47tj7xe7e5yjszid.onion/","pattern":"[url:value = 'http://77bq6vwhss5dmzlandgztuahkgliaa4h7e6qam2l47tj7xe7e5yjszid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfcf8ada-a0c0-8d5a-d927-0000bedf5a17","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6ijhmlpp6oohaohwx7friaqf3bu26hk4yltxngqsxmyygr2ftfkpb6yd.onion/","pattern":"[url:value = 'http://6ijhmlpp6oohaohwx7friaqf3bu26hk4yltxngqsxmyygr2ftfkpb6yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0b8798a-cb1e-3460-0cec-000023932239","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xljmgrdshsrckq6eps4lgn5rim67rsnx4t64vu75mqg6dovunfyjfhyd.onion/","pattern":"[url:value = 'http://xljmgrdshsrckq6eps4lgn5rim67rsnx4t64vu75mqg6dovunfyjfhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a4c31d3-d859-0c3e-8b87-0000c28ec4e4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tihaxq2coblqyinbv3bzp2gtpz6bpbog2njh3g2ofalhbilj4sjr5wqd.onion/","pattern":"[url:value = 'http://tihaxq2coblqyinbv3bzp2gtpz6bpbog2njh3g2ofalhbilj4sjr5wqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb98182a-5132-33e5-1c61-0000bd63050c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://avgplhppsx6eqlufslcn4y47qwmg3vqj46j2zwi2ondbu5e6bcfbevyd.onion/","pattern":"[url:value = 'http://avgplhppsx6eqlufslcn4y47qwmg3vqj46j2zwi2ondbu5e6bcfbevyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--487159e6-ec88-c2be-aa87-000015624e43","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rfnbhlxlbrxnrmvugk35qoek5m2pirfigqrdo3dzilyb7n7a4ei67pyd.onion/","pattern":"[url:value = 'http://rfnbhlxlbrxnrmvugk35qoek5m2pirfigqrdo3dzilyb7n7a4ei67pyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b48fab84-e157-a8f3-a175-000022be0dd5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tkbnui7mhtfv2hdgoc3bib5l4d3wr2y2w4n7orss44rwhv3yquxntlad.onion/","pattern":"[url:value = 'http://tkbnui7mhtfv2hdgoc3bib5l4d3wr2y2w4n7orss44rwhv3yquxntlad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40da698e-f125-304e-371f-0000cde49840","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://seddf4b4tbtstyov5ejeo4dnmoxc372hlmwepxnfgcwwtmq53jbn6mad.onion/","pattern":"[url:value = 'http://seddf4b4tbtstyov5ejeo4dnmoxc372hlmwepxnfgcwwtmq53jbn6mad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a9ba8fe-621d-068b-e92e-00004a2f6763","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tsvgz6u3ahyxwfcajich7anzbfo3krcyajlvyhj7jbupfxahxd4rhtqd.onion/","pattern":"[url:value = 'http://tsvgz6u3ahyxwfcajich7anzbfo3krcyajlvyhj7jbupfxahxd4rhtqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b69cb1e-55be-a4b1-8c7e-0000feae1c36","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5jtm6uihwfje7xjwne4kls73yxafwbjyj2yuogx5cyuka5g7zhhaxsad.onion/","pattern":"[url:value = 'http://5jtm6uihwfje7xjwne4kls73yxafwbjyj2yuogx5cyuka5g7zhhaxsad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79abd2ae-d62e-9b25-42bd-0000d59ae840","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dcytkdwaamnzvb5pufw7fbpprgjwrwfofxk7ynpyxruylg4rd5zcv6id.onion/","pattern":"[url:value = 'http://dcytkdwaamnzvb5pufw7fbpprgjwrwfofxk7ynpyxruylg4rd5zcv6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5df06dc8-e9fc-4d54-7477-0000062465fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jh2t7yciz7vscg3mtajppwqgja7lojhcdwybxmtibvd7f5v6rxwo56ad.onion/","pattern":"[url:value = 'http://jh2t7yciz7vscg3mtajppwqgja7lojhcdwybxmtibvd7f5v6rxwo56ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--546a3de5-f1be-e038-89a7-00009cd09749","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://z5obrospajqqpyzysbwsv3sbk7jajgut4ik4khe5kewap6kew5iswrqd.onion/","pattern":"[url:value = 'http://z5obrospajqqpyzysbwsv3sbk7jajgut4ik4khe5kewap6kew5iswrqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94b43ce1-eae9-84ba-ef4e-0000e3a9f1c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6dwf2is6omywughjzcnsdfqm7xf4syqqjp52phgik6mfrmx6kb4omsid.onion/","pattern":"[url:value = 'http://6dwf2is6omywughjzcnsdfqm7xf4syqqjp52phgik6mfrmx6kb4omsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--094ed0c0-e27c-c4ff-a2aa-000075857a6f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://shou4riazlf4ovytyrb2436wfv7hfz5ts6uyxq3ya34ygnfkxcro3dqd.onion/","pattern":"[url:value = 'http://shou4riazlf4ovytyrb2436wfv7hfz5ts6uyxq3ya34ygnfkxcro3dqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a1e1d36-6fa9-f049-db87-0000d1f38df9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t5zunmhchgyqsoad64vwej53dvlqx7mwdpodd65of4ei2wt5jin2hzqd.onion/","pattern":"[url:value = 'http://t5zunmhchgyqsoad64vwej53dvlqx7mwdpodd65of4ei2wt5jin2hzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c47fbaa-7f39-ea30-8c7a-00003f6971c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hwkznkgd73qceka7ubmwtmblmqiqvrgfu75jasvlftqbteajt2r7kyqd.onion/","pattern":"[url:value = 'http://hwkznkgd73qceka7ubmwtmblmqiqvrgfu75jasvlftqbteajt2r7kyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b246f0bf-1334-e33b-5d97-0000b177f929","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qt3rxb7nvdfq25w5mihmfn43d3gcxjhvujs7as3gqp4a4z4y4vvcqlqd.onion/","pattern":"[url:value = 'http://qt3rxb7nvdfq25w5mihmfn43d3gcxjhvujs7as3gqp4a4z4y4vvcqlqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87bd5fac-055f-8ff3-bfc3-0000ace76f87","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kk2w3ln5za5hpd2ovomwnp7ewq24wnz63nhtmzebdd3jgbwo4kvrltid.onion/","pattern":"[url:value = 'http://kk2w3ln5za5hpd2ovomwnp7ewq24wnz63nhtmzebdd3jgbwo4kvrltid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--101e5814-9c4b-e440-afe6-00006734a42d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fgcrj5dsfwjgg65kxbte47f54srnrdwqxq6srj3pk6ff3sfrqnsgkjyd.onion/","pattern":"[url:value = 'http://fgcrj5dsfwjgg65kxbte47f54srnrdwqxq6srj3pk6ff3sfrqnsgkjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--360962bb-d40e-1a95-58fb-0000136ae5e8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://76ji2jo5tz4732mrnwrk2ybr3a32vewlkdke7ghgeag7r2scf3fyipyd.onion/","pattern":"[url:value = 'http://76ji2jo5tz4732mrnwrk2ybr3a32vewlkdke7ghgeag7r2scf3fyipyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffce3519-af76-c0c2-59c2-0000396cf0af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eiiny3em4i6bd6pzqaft2bgfrvpqghoxrfay3z7varuex5mksyidseid.onion/","pattern":"[url:value = 'http://eiiny3em4i6bd6pzqaft2bgfrvpqghoxrfay3z7varuex5mksyidseid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9559692-91b6-1eca-0f49-000036fba13e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tpcktilf7ukwxswg3ara377mitjyulcjraij3kj6asgy5l7j4hotzdqd.onion/","pattern":"[url:value = 'http://tpcktilf7ukwxswg3ara377mitjyulcjraij3kj6asgy5l7j4hotzdqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b68b4d7b-d35c-26ac-8edd-0000936fa949","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nktmnpipqtqsmxhxjnywv4jobzg6zygiacg4rphgbss2xjrsqfmmtzqd.onion/","pattern":"[url:value = 'http://nktmnpipqtqsmxhxjnywv4jobzg6zygiacg4rphgbss2xjrsqfmmtzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--278b402a-42cb-0509-3a74-00004bbf9312","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qxrj2cvhfxtd36jaoxycorbutymzyhzjybdndwp3d7q5pl3eorwvlbid.onion/","pattern":"[url:value = 'http://qxrj2cvhfxtd36jaoxycorbutymzyhzjybdndwp3d7q5pl3eorwvlbid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da1ac836-29c3-4633-159a-00002ad1786a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mier6ea5zfr5hhejlb5iovjspdlhi5xkjonbsebn6nomusyzl3ftfcid.onion/","pattern":"[url:value = 'http://mier6ea5zfr5hhejlb5iovjspdlhi5xkjonbsebn6nomusyzl3ftfcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7771b75-3f47-cbc7-04a3-0000c11bc0d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://headgaeo2bxjeeveov6cv7q4dmpvqksrah7aqvtgip44orjoltwwjwqd.onion/","pattern":"[url:value = 'http://headgaeo2bxjeeveov6cv7q4dmpvqksrah7aqvtgip44orjoltwwjwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85597feb-3461-e92b-957b-0000ebd1f603","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bq2mf6kgcn3xemlmxen4hefwlvh355m65cqtwgu3udjknqphevu24oqd.onion/","pattern":"[url:value = 'http://bq2mf6kgcn3xemlmxen4hefwlvh355m65cqtwgu3udjknqphevu24oqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a11a7561-e8fa-aea7-8db8-0000124990d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p4tcczmceeya6d5njdpc3qjsuhx6yqsezz6h7fectaycd2m3dosxbryd.onion/","pattern":"[url:value = 'http://p4tcczmceeya6d5njdpc3qjsuhx6yqsezz6h7fectaycd2m3dosxbryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--210df659-52ba-e609-1eb8-0000ab4c6a36","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5f5l5cimicclpmz4angjsrusrbdj7lcpev6qmvdzojyqicxoztgkfxyd.onion/","pattern":"[url:value = 'http://5f5l5cimicclpmz4angjsrusrbdj7lcpev6qmvdzojyqicxoztgkfxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c26fa02-2787-4e49-98e9-0000cbac1d76","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t6xruel3qohtio3qrg5s6lqtvemxpolsvnqzsu7gq72ls7v6jebvviyd.onion/","pattern":"[url:value = 'http://t6xruel3qohtio3qrg5s6lqtvemxpolsvnqzsu7gq72ls7v6jebvviyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6fbfa29-6b8c-1114-13fc-000007d61ab4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uluk2dun6kxo6dpotejoiycjy6o4nn23nxpdh6vyxaic6lnqkcadn2qd.onion/","pattern":"[url:value = 'http://uluk2dun6kxo6dpotejoiycjy6o4nn23nxpdh6vyxaic6lnqkcadn2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a9c1eb2-f8ea-a5fb-7057-00001f548ffa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qyni2nray34n2bt62vhzazrkcdkkrwr6fwnf4lldl52glhpjpoisg3yd.onion/","pattern":"[url:value = 'http://qyni2nray34n2bt62vhzazrkcdkkrwr6fwnf4lldl52glhpjpoisg3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bff689d-1f8e-a2ef-3e05-0000819b60b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qaitk2nhithrozjjl677tnvdygwpbf4voswlcchbytqtdvjh5epwhdid.onion/","pattern":"[url:value = 'http://qaitk2nhithrozjjl677tnvdygwpbf4voswlcchbytqtdvjh5epwhdid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35f82bfa-ae07-5a5d-a90b-0000893334da","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://56tozfwhwndqwjumts345pqmzmzutjxw2oporrvik6tb7arhu75dhpad.onion/","pattern":"[url:value = 'http://56tozfwhwndqwjumts345pqmzmzutjxw2oporrvik6tb7arhu75dhpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d508efdb-7fc3-47e9-71a2-0000a297f8bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4k7h5bbjzvpjlosgksempinpubyddhlhc74oyugzrx6mlnaw32fimfqd.onion/","pattern":"[url:value = 'http://4k7h5bbjzvpjlosgksempinpubyddhlhc74oyugzrx6mlnaw32fimfqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8aa45f93-2913-0006-24be-0000e7bb65e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://37asfl4aturhkebvrs5uy3uqrpt5jqdshze3bollucxjxmivyx65ggid.onion/","pattern":"[url:value = 'http://37asfl4aturhkebvrs5uy3uqrpt5jqdshze3bollucxjxmivyx65ggid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23cd928a-b0f3-d3d3-0320-0000be768d4e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6zs4fmzdjmhhvjah334uivfr5qq4evqxkokymvlfpcf3gyyeajh3rkqd.onion/","pattern":"[url:value = 'http://6zs4fmzdjmhhvjah334uivfr5qq4evqxkokymvlfpcf3gyyeajh3rkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--158179a3-dcaf-31bb-b033-00004b0ad78b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m3qteim6fk7dk2xplmolbywuern66rbw46unedprbhsyactdfmyfluad.onion/","pattern":"[url:value = 'http://m3qteim6fk7dk2xplmolbywuern66rbw46unedprbhsyactdfmyfluad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--702c4412-5314-4943-e958-00004d19d422","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ezvpc477cfydolq4eqq77ko5ih3ma2zpwyvxp4xvloy2hl4kcft2layd.onion/","pattern":"[url:value = 'http://ezvpc477cfydolq4eqq77ko5ih3ma2zpwyvxp4xvloy2hl4kcft2layd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84989f39-69b0-e2e2-4b6f-0000d7c11696","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l234hi2mvb57fwyowkpswwmxlmweiwjotrmpmimdzfwdzqpbafu4poyd.onion/","pattern":"[url:value = 'http://l234hi2mvb57fwyowkpswwmxlmweiwjotrmpmimdzfwdzqpbafu4poyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4f7db38-1b97-c37e-d6f4-00009f1b8a39","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3m23raqnfwua2znyes3vzx646lrdi4zgubewu4vgbhdibvkyu4hvt2id.onion/","pattern":"[url:value = 'http://3m23raqnfwua2znyes3vzx646lrdi4zgubewu4vgbhdibvkyu4hvt2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e8fd86e-acb8-8bfd-cd1a-000082d9726c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l3jniqvrhlbqeevzp3rll6o2vji7x4lf6phhxnssfs6ogggpme47fkid.onion/","pattern":"[url:value = 'http://l3jniqvrhlbqeevzp3rll6o2vji7x4lf6phhxnssfs6ogggpme47fkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77cb397e-15b5-9e0a-b398-0000a82b9601","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://a4veossh4pgs6qokx62umuc7rl7lpfktspsykdt2xab4rswnaxpi54ad.onion/","pattern":"[url:value = 'http://a4veossh4pgs6qokx62umuc7rl7lpfktspsykdt2xab4rswnaxpi54ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8067e558-83f6-8e4b-c4fc-00006606c974","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wj4kle7j3ogh32ochqfyrz2vljplxuikp4kht7ee25qq6bwgxu7wy6id.onion/","pattern":"[url:value = 'http://wj4kle7j3ogh32ochqfyrz2vljplxuikp4kht7ee25qq6bwgxu7wy6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc7318e3-5301-f0ec-0c6c-000014c59344","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tkaduf35csoi5takpfnzj5uyhyspr4y5gnapdalxeyonbhmcoow5vuid.onion/","pattern":"[url:value = 'http://tkaduf35csoi5takpfnzj5uyhyspr4y5gnapdalxeyonbhmcoow5vuid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15736f9d-22e6-0523-0f23-00002ad439f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbzmwubyyym675qhhcj3vklz3jr4chblihll3trnxyjnbhnxinrq6jyd.onion/","pattern":"[url:value = 'http://lbzmwubyyym675qhhcj3vklz3jr4chblihll3trnxyjnbhnxinrq6jyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0030775b-12d3-753a-40c2-0000d2385b62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wz4e52ekmlhwnqbahdhcoyjaf575mx36lz3b2w4uy6kicctioetk6sad.onion/","pattern":"[url:value = 'http://wz4e52ekmlhwnqbahdhcoyjaf575mx36lz3b2w4uy6kicctioetk6sad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5989d71e-028d-06a1-eb6e-0000b8d3a3d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6le3nyil6rrwrwj7vogz7s66yorll3ta4c5p2i5yqmnt6wy3szpiy2ad.onion/","pattern":"[url:value = 'http://6le3nyil6rrwrwj7vogz7s66yorll3ta4c5p2i5yqmnt6wy3szpiy2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0ad3b40-0738-6dcb-37f4-00001039f8c3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vckmgfabkjgvwsb6o37ebbmzwyttoh4exzrren44zgqzmna3c4y6tyid.onion/","pattern":"[url:value = 'http://vckmgfabkjgvwsb6o37ebbmzwyttoh4exzrren44zgqzmna3c4y6tyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7831f18-9612-7b87-8fb1-00005fa86bd5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m7vf5uu2vnew4pc4mayohi4plb3x22d4kgtkirvtfk7jmjzbvkeoduad.onion/","pattern":"[url:value = 'http://m7vf5uu2vnew4pc4mayohi4plb3x22d4kgtkirvtfk7jmjzbvkeoduad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50474a47-190f-846c-6653-0000638dad07","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://imjckfrh7qdhcd4kfarvruxo6osrncgg5kpbgqtyqdffhpy6h6gofmid.onion/","pattern":"[url:value = 'http://imjckfrh7qdhcd4kfarvruxo6osrncgg5kpbgqtyqdffhpy6h6gofmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d32bcdd-173a-b3e7-a637-0000f18053f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ino3wksnycirlvmc7gm6zoojylb6xtysp6wym65r4kspzkqknp7musyd.onion/","pattern":"[url:value = 'http://ino3wksnycirlvmc7gm6zoojylb6xtysp6wym65r4kspzkqknp7musyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96942036-83db-7ea2-d1c1-0000b676afe5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jgb462bvbytz3sjkcyblgx3msqce6bmmwwibjomjrezlbnic4xp7a4id.onion/","pattern":"[url:value = 'http://jgb462bvbytz3sjkcyblgx3msqce6bmmwwibjomjrezlbnic4xp7a4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8faff124-8521-0b90-5476-000080fcc598","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://al6g2ikdzto2s4vsvi7aiw3hx4tk5xxexuztnlwdov4ppvjhf4guccid.onion/","pattern":"[url:value = 'http://al6g2ikdzto2s4vsvi7aiw3hx4tk5xxexuztnlwdov4ppvjhf4guccid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33ec3fdc-a1f9-0021-a748-000081870da6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://h6ijzzigkilkyibr35czmzh3sv4m7npgd5amrwd3327aqyylkjnj36yd.onion/","pattern":"[url:value = 'http://h6ijzzigkilkyibr35czmzh3sv4m7npgd5amrwd3327aqyylkjnj36yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3444e74a-b619-2fa9-15c1-0000e9f5ad2e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eza7mkwxk2zcrnq2l5j7qwst27ci4rusxhwtpkjj6hyakjw72ftuwhyd.onion/","pattern":"[url:value = 'http://eza7mkwxk2zcrnq2l5j7qwst27ci4rusxhwtpkjj6hyakjw72ftuwhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68fe6913-a792-d842-71c2-0000042c571a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://b6ewn7vkjw4jtjkey3nxiufhcaujlfmhsxl3z46fd3kqlhwptnlijvqd.onion/","pattern":"[url:value = 'http://b6ewn7vkjw4jtjkey3nxiufhcaujlfmhsxl3z46fd3kqlhwptnlijvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95615403-276e-4d64-4fb8-0000125232fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tfx6mkwzjettzyukvqej42ivvo6u3dktq33ujkjoy3s4fj6bgmdnobyd.onion/","pattern":"[url:value = 'http://tfx6mkwzjettzyukvqej42ivvo6u3dktq33ujkjoy3s4fj6bgmdnobyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a4f8220-dc7f-9652-bb5e-000023eda5cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3y6tlkxcf62it7lrzjcfqochw34uejfobg2eexqqaggp4avsnm7xsrid.onion/","pattern":"[url:value = 'http://3y6tlkxcf62it7lrzjcfqochw34uejfobg2eexqqaggp4avsnm7xsrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef048b13-1fcb-fd55-d775-0000350cddf1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sz4lgxha326tjtndlc3xm57y37ro4r6a7osfa43qull4mnkpy7mqvgyd.onion/","pattern":"[url:value = 'http://sz4lgxha326tjtndlc3xm57y37ro4r6a7osfa43qull4mnkpy7mqvgyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad01b58b-af02-e582-9442-0000f7a3db09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ydql276xl3za7quouarzn3yqy3yzbwmrbwfmphk3zaz7fx4dxxact3ad.onion/","pattern":"[url:value = 'http://ydql276xl3za7quouarzn3yqy3yzbwmrbwfmphk3zaz7fx4dxxact3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af20f8f0-1e75-bd9d-9cd9-0000a6b97dac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lecmw24yk5vwjcbcienucbtxk74hvdygsewgcfpubebtcvx6g7wqt7id.onion/","pattern":"[url:value = 'http://lecmw24yk5vwjcbcienucbtxk74hvdygsewgcfpubebtcvx6g7wqt7id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4765e424-524c-cb3d-82bb-0000ccf808ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ed26bfkcdsqs5wuezd4vraj4u743h2agcqumkcsbtjcvi5jzpvklizqd.onion/","pattern":"[url:value = 'http://ed26bfkcdsqs5wuezd4vraj4u743h2agcqumkcsbtjcvi5jzpvklizqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9a28153-d3aa-f879-f427-000080ccbe20","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3kvefuhgyazobjbu3gfgttrcxd47cvrkccwf7u4scfe4wipiavwk7vqd.onion/","pattern":"[url:value = 'http://3kvefuhgyazobjbu3gfgttrcxd47cvrkccwf7u4scfe4wipiavwk7vqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15040a42-c5f2-6f96-120d-00007aea3086","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cnzwaoscbdnlssfcjznjw5n27npnckk2nebif2phhntik6bufyzlztyd.onion/","pattern":"[url:value = 'http://cnzwaoscbdnlssfcjznjw5n27npnckk2nebif2phhntik6bufyzlztyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1572944f-4d36-ec4f-f51c-00002496d048","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4jdrdrfeguonp4pleectncqjwnpsr3us6js7azwenq34jnug4mohqqad.onion/","pattern":"[url:value = 'http://4jdrdrfeguonp4pleectncqjwnpsr3us6js7azwenq34jnug4mohqqad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd4519a4-5a2e-735c-1a4e-0000b7b1acd8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qmlf7hcrhgsimdbrnnpfgdbmgjz6ovzs4k6p6mldu6muvao7fdhncwad.onion/","pattern":"[url:value = 'http://qmlf7hcrhgsimdbrnnpfgdbmgjz6ovzs4k6p6mldu6muvao7fdhncwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92c11d7f-4624-6937-4f87-0000b8d4f46b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://j6yrp5sq4jkk6cq6kwolyae3mzlxozk6to5lwyo2epahmqjtatv524id.onion/","pattern":"[url:value = 'http://j6yrp5sq4jkk6cq6kwolyae3mzlxozk6to5lwyo2epahmqjtatv524id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e7ea196-9fb6-bf1e-8adb-00000d495071","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nrs7p2auuk2swhszzcu3slsyeg2fsdcg6xcffsmlea37y47dhboqkayd.onion/","pattern":"[url:value = 'http://nrs7p2auuk2swhszzcu3slsyeg2fsdcg6xcffsmlea37y47dhboqkayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fd55309-9f36-6f11-6c11-00009c885692","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sxuojjsaj4kaac32pjna3iublfav5r7hvhjwf6l4ykq2cmgormhcm2yd.onion/","pattern":"[url:value = 'http://sxuojjsaj4kaac32pjna3iublfav5r7hvhjwf6l4ykq2cmgormhcm2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bc3f829-3eb7-d186-bea4-00001de2c0f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nam4kifgrpoerkebji2gkrckpxbsr4kzrw3wnqakbuqfjuffqq3pfiid.onion/","pattern":"[url:value = 'http://nam4kifgrpoerkebji2gkrckpxbsr4kzrw3wnqakbuqfjuffqq3pfiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9cd30c7-a9eb-8afa-9ecf-00005a054d5c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kmlh5jldnzmvhsu3maouzvewlmed4632lvhmbq2y2bpohk5swwemloqd.onion/","pattern":"[url:value = 'http://kmlh5jldnzmvhsu3maouzvewlmed4632lvhmbq2y2bpohk5swwemloqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a2cedcb-b4aa-60b4-8bd5-0000b084ddd7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eko5zejmrlr4edby5djlhtbv4soqmsjk7k4ayw5dbjoc4ndbwmqxgtqd.onion/","pattern":"[url:value = 'http://eko5zejmrlr4edby5djlhtbv4soqmsjk7k4ayw5dbjoc4ndbwmqxgtqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce93abb1-48b6-1c43-5c06-0000141f769b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://grpvtbkr6o2iantersxsgynluwh4mj4uitoaatfmn7phw2gdhvesocid.onion/","pattern":"[url:value = 'http://grpvtbkr6o2iantersxsgynluwh4mj4uitoaatfmn7phw2gdhvesocid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b25caac-3194-95b9-19fe-00005e050a02","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7x24mcwqbg7e32p3xdbnfmk2mlyvjlagf6kk3urk5dwkdzttmlsxp6id.onion/","pattern":"[url:value = 'http://7x24mcwqbg7e32p3xdbnfmk2mlyvjlagf6kk3urk5dwkdzttmlsxp6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c7a5f5c-c1f0-3694-ba62-00001c234baf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rzuge4avddhpkyieu5ral5pbva2kijd3conbatx3ta65wxb3losrebid.onion/","pattern":"[url:value = 'http://rzuge4avddhpkyieu5ral5pbva2kijd3conbatx3ta65wxb3losrebid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94f4c393-0464-2f6d-5772-00005124f11b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5et5vkdae4blfm42lzjt6zliwoyu26odmagqmun6hsyaajgt6b3dhdqd.onion/","pattern":"[url:value = 'http://5et5vkdae4blfm42lzjt6zliwoyu26odmagqmun6hsyaajgt6b3dhdqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f965aa43-441b-2411-45a1-0000ef9ab77a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l6d7inmai6euituwdb3mozlpgngj7vxqmp74o5xa5oy73vadxfz47hqd.onion/","pattern":"[url:value = 'http://l6d7inmai6euituwdb3mozlpgngj7vxqmp74o5xa5oy73vadxfz47hqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10105103-db86-4f3d-8d01-000048278796","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://o472de37blevtdm2egaafpbopfzeipogh7js53zswyui6wolhvakoxad.onion/","pattern":"[url:value = 'http://o472de37blevtdm2egaafpbopfzeipogh7js53zswyui6wolhvakoxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--763dbea4-0652-b069-ffd6-000008297f43","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vt3i4o2xhjwxcbuylfthtipcpsjn5xhg6yhktla3juookc554ezom4id.onion/","pattern":"[url:value = 'http://vt3i4o2xhjwxcbuylfthtipcpsjn5xhg6yhktla3juookc554ezom4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d119d02-a733-1879-dbc9-000059ad4568","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://h5odq7vosr5qre2yhs6imglssgtbdji77xgpmhm4pgrdxz63xvpct3ad.onion/","pattern":"[url:value = 'http://h5odq7vosr5qre2yhs6imglssgtbdji77xgpmhm4pgrdxz63xvpct3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00f5b64c-1e76-af22-941c-0000f2be3ea7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://btqoflj332ws55asdu6ta2s2s5t3uuelh62lo5j5bf2rkgfiyao5xoid.onion/","pattern":"[url:value = 'http://btqoflj332ws55asdu6ta2s2s5t3uuelh62lo5j5bf2rkgfiyao5xoid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79810b5c-03fb-3cff-50b3-0000e89bf87e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mii5amuxlef2uhq4otkzyalxm3jfiqyfcsim6dxhtzdb2alp3tjootyd.onion/","pattern":"[url:value = 'http://mii5amuxlef2uhq4otkzyalxm3jfiqyfcsim6dxhtzdb2alp3tjootyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7de2e824-e527-b295-6cc7-00001391515f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ajgrgprnxjl42kypxv3fohbghv25bzw24tbae5rsqdp2dxtoegcu5gad.onion/","pattern":"[url:value = 'http://ajgrgprnxjl42kypxv3fohbghv25bzw24tbae5rsqdp2dxtoegcu5gad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ffd3b60-f7a4-56f6-0df3-0000431fef78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://d5cds6ecz6zg2pu32baoecxh5fbrr25sy5fhfuye5zvcqw4qei3dd6id.onion/","pattern":"[url:value = 'http://d5cds6ecz6zg2pu32baoecxh5fbrr25sy5fhfuye5zvcqw4qei3dd6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--786a6a15-8d2d-535a-b4d6-0000dcee2f26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://d5iozdaaoe4par7hb6sgixeetdygedouir6kzmdev3l4xiuointiibad.onion/","pattern":"[url:value = 'http://d5iozdaaoe4par7hb6sgixeetdygedouir6kzmdev3l4xiuointiibad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e8a1231-d196-6754-423e-0000a446d07a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://djg6kqmkuwxdv4qbkgh3poqip2tdlvstt6sxvctv5ucerzvav5bbwiyd.onion/","pattern":"[url:value = 'http://djg6kqmkuwxdv4qbkgh3poqip2tdlvstt6sxvctv5ucerzvav5bbwiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1f4d66d-789e-334c-0c14-0000d9cb4980","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7nfpgc6wsil4cvahd4q63k7fvimn2cyi7r3ctqagq3p5wb5a757sqzad.onion/","pattern":"[url:value = 'http://7nfpgc6wsil4cvahd4q63k7fvimn2cyi7r3ctqagq3p5wb5a757sqzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e330523e-af8b-aa5e-bea5-000074d782ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://axpzhhwyrqz44vf3372ugwblhy3ptxo3kq2artq4cq3jwwhkk2ulyoqd.onion/","pattern":"[url:value = 'http://axpzhhwyrqz44vf3372ugwblhy3ptxo3kq2artq4cq3jwwhkk2ulyoqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ba0c7fa-3193-db64-097d-00001e4851e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zjr25hldfboiro5ddg4ugvxyinqsjjpyrmx2uw5stkasvqrrr54rswyd.onion/","pattern":"[url:value = 'http://zjr25hldfboiro5ddg4ugvxyinqsjjpyrmx2uw5stkasvqrrr54rswyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37447ba7-0537-8c0c-4cad-0000953b2bc8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2vychwbk5wl45sp73s5xenq453xqkqwyvr7noj4co2ezpgyckbsyamad.onion/","pattern":"[url:value = 'http://2vychwbk5wl45sp73s5xenq453xqkqwyvr7noj4co2ezpgyckbsyamad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19361865-a5ff-f11a-9a14-0000f7cb41bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6rgevdptzbai4tyy2hxyhfhw3wgndug3bwd5qr2bxxvtahr6vidma3qd.onion/","pattern":"[url:value = 'http://6rgevdptzbai4tyy2hxyhfhw3wgndug3bwd5qr2bxxvtahr6vidma3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22b43993-ad89-d8a0-9a7d-0000c9abb90a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://42j6c7o247vbir6umg32gclfci7paw4ym2uexqwmfkb4kkpr2ixizjid.onion/","pattern":"[url:value = 'http://42j6c7o247vbir6umg32gclfci7paw4ym2uexqwmfkb4kkpr2ixizjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9277722-354e-8f0c-90cb-00000acb8da3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hzmsrvawmk2muu5gr7ln4fc24wmi5r5vh5omavp6yuicjd2yz5erakyd.onion/","pattern":"[url:value = 'http://hzmsrvawmk2muu5gr7ln4fc24wmi5r5vh5omavp6yuicjd2yz5erakyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e729e0e-96f4-d57d-6416-0000af21df3e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xy2v3mkdj3nq5zl7w66jav7xaqyoguejuqxiv3a4hrz3qathm4fugtad.onion/","pattern":"[url:value = 'http://xy2v3mkdj3nq5zl7w66jav7xaqyoguejuqxiv3a4hrz3qathm4fugtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--248467cc-9d51-b7c3-cf8c-0000acaa90f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cuvnqffujazpugb26wi744ahbsgvn5ljrifarsolfgvnppqfvgyo7did.onion/","pattern":"[url:value = 'http://cuvnqffujazpugb26wi744ahbsgvn5ljrifarsolfgvnppqfvgyo7did.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f72843d4-b573-806c-39ff-000090176c89","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uwcmogod63ehoml2wuywgapki62egrb73r4utfbacc23aumutwe4mzqd.onion/","pattern":"[url:value = 'http://uwcmogod63ehoml2wuywgapki62egrb73r4utfbacc23aumutwe4mzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16ca6917-95f4-514d-4710-000022910b0d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rysd7epmwvgtzv3p7i5j6kwtcdljdlssweomu4tf4evgtkypnohzwyyd.onion/","pattern":"[url:value = 'http://rysd7epmwvgtzv3p7i5j6kwtcdljdlssweomu4tf4evgtkypnohzwyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--108b9142-d2f8-0ecb-1f83-00009558fde3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qf6ckzjpxxh7dwjx2pkmag4fm54boh5pvf4kxnaix7dprppgkzdu2uid.onion/","pattern":"[url:value = 'http://qf6ckzjpxxh7dwjx2pkmag4fm54boh5pvf4kxnaix7dprppgkzdu2uid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e0534b7-67dd-d032-a7a0-0000ff27aadd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ugnvgetiiabnvgd6eju4gamn4cwhoqtcwodwilp4gzrcncbogrluw7yd.onion/","pattern":"[url:value = 'http://ugnvgetiiabnvgd6eju4gamn4cwhoqtcwodwilp4gzrcncbogrluw7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b4d1cf0-6a3d-5a12-8dca-0000afa85685","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://arnm7yxmn734igurgztfr4rw5fldykt6c33hyewdpqi535flzwa33wqd.onion/","pattern":"[url:value = 'http://arnm7yxmn734igurgztfr4rw5fldykt6c33hyewdpqi535flzwa33wqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b8403a3-e4f9-fb1e-aee9-0000eeb0b2f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4z4jbblgxjxs2ktmtq3xn3odljd36rce63d5jkxhurn6kjrqajh27jid.onion/","pattern":"[url:value = 'http://4z4jbblgxjxs2ktmtq3xn3odljd36rce63d5jkxhurn6kjrqajh27jid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55161ab1-7879-9237-3f3a-000074139e56","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4qokzgb6ateutdvxtbdzvqvd73h3qynqyom7x4p6mjlqixsdnxtofrid.onion/","pattern":"[url:value = 'http://4qokzgb6ateutdvxtbdzvqvd73h3qynqyom7x4p6mjlqixsdnxtofrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4958f2d8-e513-5f71-d739-000034d67b96","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7jg7qtgmnxaaczegd4ug5hatukr32lxmh2pi5vdoq6x57i2hrfvz2cqd.onion/","pattern":"[url:value = 'http://7jg7qtgmnxaaczegd4ug5hatukr32lxmh2pi5vdoq6x57i2hrfvz2cqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99fdd416-4b04-22ce-604e-0000ca85144f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://i7axj4en3v7ze7oo2icxu5pt24bwppahocwlod7b2u674z3uzgzii6id.onion/","pattern":"[url:value = 'http://i7axj4en3v7ze7oo2icxu5pt24bwppahocwlod7b2u674z3uzgzii6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91b78289-0989-ec86-9427-00004622b9d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://naix5ifhvr2u5o22c2pdgwmnlpjqauz2e7p7x47fqrnsv7x6gprtpnyd.onion/","pattern":"[url:value = 'http://naix5ifhvr2u5o22c2pdgwmnlpjqauz2e7p7x47fqrnsv7x6gprtpnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a474629-7313-450f-b242-00008d71043b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qjwx5vujr7rgn33lhnnnmfev5bxwng633t3xcc4ewp6wgx3eemmd3pad.onion/","pattern":"[url:value = 'http://qjwx5vujr7rgn33lhnnnmfev5bxwng633t3xcc4ewp6wgx3eemmd3pad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f07778ff-cd33-21a7-96ba-0000636966d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://riichsqrpju6rjpdbqjfxoixugb3z66iyo7266gi5vh5eit7ox67skad.onion/","pattern":"[url:value = 'http://riichsqrpju6rjpdbqjfxoixugb3z66iyo7266gi5vh5eit7ox67skad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--314b9a74-15c9-1476-6b2f-0000cd2e7f9b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cj2etbsdktfbkrxxp4grhw2pkh4w6vgd4r6mdco6czrgg6ckratiqfad.onion/","pattern":"[url:value = 'http://cj2etbsdktfbkrxxp4grhw2pkh4w6vgd4r6mdco6czrgg6ckratiqfad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--682b3787-768b-fe94-a655-00002cb711b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mt7eid5xpxwopsm3xmycalyynhgqa2m6sxmmx5wrvnp7m6dxpaq4rxqd.onion/","pattern":"[url:value = 'http://mt7eid5xpxwopsm3xmycalyynhgqa2m6sxmmx5wrvnp7m6dxpaq4rxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--616e9bed-3f2c-41f4-43dc-00006df319b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tjxinhugi5s7kamimzi5uqmtm4xdb6qsvee36ffdewhgdh6x4shskpqd.onion/","pattern":"[url:value = 'http://tjxinhugi5s7kamimzi5uqmtm4xdb6qsvee36ffdewhgdh6x4shskpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f0cebdb-08c8-a4db-c495-0000c196f93c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wne7mhfchrnry7yz7wg5bjwyq2v5yi6sqcwom3y2skubcg5mkc4j2tid.onion/","pattern":"[url:value = 'http://wne7mhfchrnry7yz7wg5bjwyq2v5yi6sqcwom3y2skubcg5mkc4j2tid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01d9e9a4-90ed-14fd-5636-00005ab492c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vngb6zrm2agguu3ivwa6upemxj5sgwnvnxxbgjk4qfc3kx4bh67artid.onion/","pattern":"[url:value = 'http://vngb6zrm2agguu3ivwa6upemxj5sgwnvnxxbgjk4qfc3kx4bh67artid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6480317-8ad5-742a-60b1-0000be356afc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t4alntw663vnpywzf4b6pc3l6zj4aihfnfvkuvb6p7224k4v76lyqxad.onion/","pattern":"[url:value = 'http://t4alntw663vnpywzf4b6pc3l6zj4aihfnfvkuvb6p7224k4v76lyqxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf9f46f5-ce28-c7c1-af4d-000081ea927c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://o5eeqv7wyuewfh25akwcir57f3imx7lqrz7cnh3jcbtmrqrphj6mdpad.onion/","pattern":"[url:value = 'http://o5eeqv7wyuewfh25akwcir57f3imx7lqrz7cnh3jcbtmrqrphj6mdpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b84ddb0f-2fb0-a2c2-5062-0000958b23d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mnlgoynk5fbe27rrjxoab6nd4jzcdytxexusiykadd4quidsvdxip2ad.onion/","pattern":"[url:value = 'http://mnlgoynk5fbe27rrjxoab6nd4jzcdytxexusiykadd4quidsvdxip2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--608b6d7c-5bfc-5065-3fe9-000003a49bb8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://th4hkk4hlnau74gfpf2wgwhorck7c6mm4ssnlwbae6vztkein3nmvpyd.onion/","pattern":"[url:value = 'http://th4hkk4hlnau74gfpf2wgwhorck7c6mm4ssnlwbae6vztkein3nmvpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--163a26c1-0250-0c98-2791-000061c9e359","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ajovhprvtnwvclooo57f5jnjx3llsugebptzge7dxjwoblx5oionjsqd.onion/","pattern":"[url:value = 'http://ajovhprvtnwvclooo57f5jnjx3llsugebptzge7dxjwoblx5oionjsqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e826d68-f0c2-7c58-bfc9-00006157285e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vjuhvnelu7igymrzgf37q235nyjztbyy3o7kx2zvqtbvzibv4b3kluid.onion/","pattern":"[url:value = 'http://vjuhvnelu7igymrzgf37q235nyjztbyy3o7kx2zvqtbvzibv4b3kluid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bae29e0-5af3-42cd-fe16-000028bc8431","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pfl5yb3eo3l7sz3y3igxo23oq7xzesw6sjepqstgu6llbkfv6pbawhid.onion/","pattern":"[url:value = 'http://pfl5yb3eo3l7sz3y3igxo23oq7xzesw6sjepqstgu6llbkfv6pbawhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4217558-ce3a-4d07-f95a-000088f8a7ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tmkwo5pmqnnl4xkic4yiv7xdhjpu22nmdjms653777g6olvfxoukfnyd.onion/","pattern":"[url:value = 'http://tmkwo5pmqnnl4xkic4yiv7xdhjpu22nmdjms653777g6olvfxoukfnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7583e196-c60a-34b9-2087-00003e3c91ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://k7v76bci6dcbt4oh7upyoka7tlcqaldvvkz5vau4cbuq7zbo7h5nu3ad.onion/","pattern":"[url:value = 'http://k7v76bci6dcbt4oh7upyoka7tlcqaldvvkz5vau4cbuq7zbo7h5nu3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--251defc4-ec94-aea1-9b81-0000d830f8ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://w64o73ynfg4uvwhglbzrin77e7eu745stq7d4ezi5coa4tjcpuhtyuid.onion/","pattern":"[url:value = 'http://w64o73ynfg4uvwhglbzrin77e7eu745stq7d4ezi5coa4tjcpuhtyuid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea0edf20-635d-d490-bc68-00002d23f773","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jl3skmc6opjork2vh675567ntpeugceoru45spye4js2ewc4htsamzad.onion/","pattern":"[url:value = 'http://jl3skmc6opjork2vh675567ntpeugceoru45spye4js2ewc4htsamzad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ece6e1c3-7c00-a6a1-00df-00006993e8bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://x5kb3a557n37bes3pyha32blmzvtmuzwct7c45x3foha4izelctwjlad.onion/","pattern":"[url:value = 'http://x5kb3a557n37bes3pyha32blmzvtmuzwct7c45x3foha4izelctwjlad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48b27a64-cac8-3b58-aafe-00004b1765c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cg4zvkwkg7rlbi6nopi4ibg5dsyjaehjajpmnemcug2n24omtx4n5xid.onion/","pattern":"[url:value = 'http://cg4zvkwkg7rlbi6nopi4ibg5dsyjaehjajpmnemcug2n24omtx4n5xid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8721951b-532d-3e0c-4c52-0000a45a67b9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://llfsk35utbxkvhnw2jevumvrtld26kmf3odhblbfffafg2oyqb23ksyd.onion/","pattern":"[url:value = 'http://llfsk35utbxkvhnw2jevumvrtld26kmf3odhblbfffafg2oyqb23ksyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--900306ea-1057-9a7f-e51f-00009f50e674","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qlgj4ydwho5u65lp7by2rk2jdmbd5mxz6nzvzf5jerjpnst7nqn5evqd.onion/","pattern":"[url:value = 'http://qlgj4ydwho5u65lp7by2rk2jdmbd5mxz6nzvzf5jerjpnst7nqn5evqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f558e467-dd19-1a95-12c5-0000e64c77d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cqpmulaoil7jemmalkza6ycphytbqex6a52ow2nhznpsvnqyf3ojk5ad.onion/","pattern":"[url:value = 'http://cqpmulaoil7jemmalkza6ycphytbqex6a52ow2nhznpsvnqyf3ojk5ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c769fb5-eadd-75b4-1578-0000785c3b85","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bclspfcy4cxh5tpx5jcbzn6ze2kpt4ny4hgmtjnu6zkzutq55ke2v3yd.onion/","pattern":"[url:value = 'http://bclspfcy4cxh5tpx5jcbzn6ze2kpt4ny4hgmtjnu6zkzutq55ke2v3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cda942c-2d12-336b-c045-0000b60a8ef2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tb2hrk643mjhumepowdvwkburydcp6jfrvrtcojujxux4j2lyfzp2dqd.onion/","pattern":"[url:value = 'http://tb2hrk643mjhumepowdvwkburydcp6jfrvrtcojujxux4j2lyfzp2dqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--675a9364-217d-a67a-ace1-00006a7a4706","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hwt6modj6twmmqxwgywlrhkqil7zrg3gnw2wnrod2jl67l2wtixuvtad.onion/","pattern":"[url:value = 'http://hwt6modj6twmmqxwgywlrhkqil7zrg3gnw2wnrod2jl67l2wtixuvtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5b453cf-e10d-b8f2-9a8d-0000331fed74","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bqwxnomrw7v65eqoktrxq44xqa4unvc23yt2wi44w3iyc72lhf2nlgqd.onion/","pattern":"[url:value = 'http://bqwxnomrw7v65eqoktrxq44xqa4unvc23yt2wi44w3iyc72lhf2nlgqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9de778a2-9e86-3e8a-c953-0000f7024818","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://acfg3dxipf5hiwyhra7k55dnrkx3iilpoo3qlplckad472dt6qcwejad.onion/","pattern":"[url:value = 'http://acfg3dxipf5hiwyhra7k55dnrkx3iilpoo3qlplckad472dt6qcwejad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--806c0a52-5714-be69-013f-000025a57a09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fi6v2rbgitmilp5sepzwwnd4oc4jb3xr5abxka3qntnx4i2p2irwzjyd.onion/","pattern":"[url:value = 'http://fi6v2rbgitmilp5sepzwwnd4oc4jb3xr5abxka3qntnx4i2p2irwzjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d31f9a5f-f551-70e6-7d2d-000095304395","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lpq4oa57thkx32h7lkq7lvqalwcz6oawg2bxn7smebgrrc6zzkjeq3qd.onion/","pattern":"[url:value = 'http://lpq4oa57thkx32h7lkq7lvqalwcz6oawg2bxn7smebgrrc6zzkjeq3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afc78f48-f1a7-dbf1-7e95-000033e44aee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nca5ifoa4oupnytvg3ujasik4wioqiftxocobms36jgsaasrsue7lsid.onion/","pattern":"[url:value = 'http://nca5ifoa4oupnytvg3ujasik4wioqiftxocobms36jgsaasrsue7lsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b79bdb03-2560-70da-e587-0000f321ad58","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kznttsyzr6wsw7ypeswfp6hbjsaszzlbydd4mkh6tcpgvlcsgw6fjlqd.onion/","pattern":"[url:value = 'http://kznttsyzr6wsw7ypeswfp6hbjsaszzlbydd4mkh6tcpgvlcsgw6fjlqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdb66fd6-20a9-9892-5702-0000bd156d40","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mqpzwgqjrb7y3huttlbvj77zrq3ar5y2fhpifz764ule7tm7ydpxd2id.onion/","pattern":"[url:value = 'http://mqpzwgqjrb7y3huttlbvj77zrq3ar5y2fhpifz764ule7tm7ydpxd2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8970cecb-85c4-0e2c-b861-00006cf0b77a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tuo4y5oya7p466izdkievw2oqhaweazirwxug3abpc2iy6gxsdmwbhqd.onion/","pattern":"[url:value = 'http://tuo4y5oya7p466izdkievw2oqhaweazirwxug3abpc2iy6gxsdmwbhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0fe587c-4c68-0119-efaf-000081fadc2d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://d4apmrstglx3pncltzgkq527na2jhigqch6m23e5lc5aivepjzdsx6qd.onion/","pattern":"[url:value = 'http://d4apmrstglx3pncltzgkq527na2jhigqch6m23e5lc5aivepjzdsx6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16f1eee5-580b-561c-a1f4-000051184b1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tbst3bmrpkfpbatotxqiufdcckwhd5ajlcw47fqioukaq2pecovcocad.onion/","pattern":"[url:value = 'http://tbst3bmrpkfpbatotxqiufdcckwhd5ajlcw47fqioukaq2pecovcocad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1677dc31-f201-81bc-66fb-00003233a493","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ttg6l5zvawq3ryly55urbuqwl47ckf4wnilsucznqwdcheu3j4urn2qd.onion/","pattern":"[url:value = 'http://ttg6l5zvawq3ryly55urbuqwl47ckf4wnilsucznqwdcheu3j4urn2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67e2a88f-5b00-781b-f7bc-000036c5acc1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lmuzsldj2n6oislth3l4ql4cgl5ypbmv4yu65y22xx7pdolbqjbmrjad.onion/","pattern":"[url:value = 'http://lmuzsldj2n6oislth3l4ql4cgl5ypbmv4yu65y22xx7pdolbqjbmrjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ab964ff-9e71-f155-e5e5-0000f9c2d492","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5tfccsdhx3zzw6jykj7spuzs7fipdpzexy7yb2xvzcf76237hjwhhnad.onion/","pattern":"[url:value = 'http://5tfccsdhx3zzw6jykj7spuzs7fipdpzexy7yb2xvzcf76237hjwhhnad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--798443fc-60a6-f4c6-041c-00007929949c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xj2fskz7jbasocl3hrqtdcinscipl3lxrus3a76dbhqal74fw7xw52yd.onion/","pattern":"[url:value = 'http://xj2fskz7jbasocl3hrqtdcinscipl3lxrus3a76dbhqal74fw7xw52yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f6744c9-7db1-4c3b-d865-00002dcb96d4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4iyxaq5p47uzgzgevxibm5gycglm3rzg2v2m3pbsn2cvw4wl7ynxidid.onion/","pattern":"[url:value = 'http://4iyxaq5p47uzgzgevxibm5gycglm3rzg2v2m3pbsn2cvw4wl7ynxidid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--803a9800-0252-99b7-48ba-00008be29c8e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vmwwdia2pcvpozyhcqshcdrdn7opkvspc5hhltsduhi27nmwdqq2jfid.onion/","pattern":"[url:value = 'http://vmwwdia2pcvpozyhcqshcdrdn7opkvspc5hhltsduhi27nmwdqq2jfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4f444f7-30e3-eaf9-af4d-00006a389c0b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pzqic6ecpsaebm7p7np4m2lrybuqwagvw3jymvisa2nookymgansg3ad.onion/","pattern":"[url:value = 'http://pzqic6ecpsaebm7p7np4m2lrybuqwagvw3jymvisa2nookymgansg3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2808e35-6ac6-30b4-c28a-00009e6e5492","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gy72soqbkizuqkehr4wbsfytnyc3avsxj6o4rwpcocmoonc7vgzfouid.onion/","pattern":"[url:value = 'http://gy72soqbkizuqkehr4wbsfytnyc3avsxj6o4rwpcocmoonc7vgzfouid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d23c8f7e-1018-3016-b740-0000396df825","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://prvimy6lsid4tcpkp4eomxruvpysch6ep5qpjn33ubl7vvmanowknzqd.onion/","pattern":"[url:value = 'http://prvimy6lsid4tcpkp4eomxruvpysch6ep5qpjn33ubl7vvmanowknzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba9417f0-9d27-0a42-1cdb-0000b353e50f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gvintuqcgxg75zo4rkr522avsfhsrktqmibhedbxvptl2krdxtmr5dyd.onion/","pattern":"[url:value = 'http://gvintuqcgxg75zo4rkr522avsfhsrktqmibhedbxvptl2krdxtmr5dyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9b44474-2457-e28d-a44c-0000ff97784f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ug6f7pbi7btlgawhoqhuetdytqk35cwhsktnvocsurivdavcpg3mslad.onion/","pattern":"[url:value = 'http://ug6f7pbi7btlgawhoqhuetdytqk35cwhsktnvocsurivdavcpg3mslad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f4e2149-fd88-48d2-cd82-000096c68a1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cdm7kqxuwo64vz7ktjx5rh7wjsfaeekehtnsjbukaqjafcjngsxiq6id.onion/","pattern":"[url:value = 'http://cdm7kqxuwo64vz7ktjx5rh7wjsfaeekehtnsjbukaqjafcjngsxiq6id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1f2b00e-2e87-0118-c498-0000499e55dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4zjfju7dc4f6ickqpdufulbodbnp4fvkccbimx5cppm3ns7y435ojoad.onion/","pattern":"[url:value = 'http://4zjfju7dc4f6ickqpdufulbodbnp4fvkccbimx5cppm3ns7y435ojoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ec0993e-e764-bdbb-35b9-0000e1647e99","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mfztc2spxine5domda4cu36rrx7i7gg5k3orqm6fqctkntno2crwczad.onion/","pattern":"[url:value = 'http://mfztc2spxine5domda4cu36rrx7i7gg5k3orqm6fqctkntno2crwczad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--953c942b-07e2-e206-6f2c-0000fa2cdfa3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://56vrt3ld2rqoyk2t4qzqabku32pqnasn3bkngtmrlpxthnu7jjvbz5id.onion/","pattern":"[url:value = 'http://56vrt3ld2rqoyk2t4qzqabku32pqnasn3bkngtmrlpxthnu7jjvbz5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff7010bb-5194-6fa5-460a-000027ba37cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4h6gnqxb4cmfvwgghxqb7mru7jlea6mqh3sznn6t4j5joc6aq77qhdad.onion/","pattern":"[url:value = 'http://4h6gnqxb4cmfvwgghxqb7mru7jlea6mqh3sznn6t4j5joc6aq77qhdad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69215efc-6d8b-4a3c-39c4-000020f9aff7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ojdjwxsfbs24kdmprqgcejcb73h4eywlg7ekoswfz2r5isynzuokbgad.onion/","pattern":"[url:value = 'http://ojdjwxsfbs24kdmprqgcejcb73h4eywlg7ekoswfz2r5isynzuokbgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5127e69-78fe-7eb7-4d90-0000f17590e4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4gjeayuyvqmf725vfmnspfhpdbhyvwc22zigjmtzmcckmglfvjp6ftad.onion/","pattern":"[url:value = 'http://4gjeayuyvqmf725vfmnspfhpdbhyvwc22zigjmtzmcckmglfvjp6ftad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e74c9cd2-97e1-f36c-108f-0000d8e56cba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fj7vyh4lj3d2azypkcllq6cm6c263wyya66gm5du66izxlkhkbz6bfad.onion/","pattern":"[url:value = 'http://fj7vyh4lj3d2azypkcllq6cm6c263wyya66gm5du66izxlkhkbz6bfad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4723e8aa-3c95-f5c6-8760-0000145995c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nsjog47c5r77fjdttcy7r2kjqbnj7fe4t73ug4y5uezbdieomzv6kaad.onion/","pattern":"[url:value = 'http://nsjog47c5r77fjdttcy7r2kjqbnj7fe4t73ug4y5uezbdieomzv6kaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e38f35ab-3475-133b-08dd-0000fe6dabcb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4ug6ieegf6mcnz4f2vgvk3w44yhxgruw7kxzsxyeapo35x64qr4ctwad.onion/","pattern":"[url:value = 'http://4ug6ieegf6mcnz4f2vgvk3w44yhxgruw7kxzsxyeapo35x64qr4ctwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39c30091-35da-2ac8-a1bf-00000aca045a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://h2qqjob3uu4z65z5ps5i42bjrspiuw2vf7sq7j3qmagc3onab7udcfid.onion/","pattern":"[url:value = 'http://h2qqjob3uu4z65z5ps5i42bjrspiuw2vf7sq7j3qmagc3onab7udcfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddb1526c-eadb-a140-6b5f-00008150cbfb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yvi55k2xqi45hivhqrk3n7no7uje5o3nocgcmfbrm6k3ooifns7ejxid.onion/","pattern":"[url:value = 'http://yvi55k2xqi45hivhqrk3n7no7uje5o3nocgcmfbrm6k3ooifns7ejxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77e097bc-3be4-0695-8d35-0000a638bc08","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yfds4rb64v6qkflagm552ts4hafm36wdgknnx4kxkw2yj7ogbkvabnyd.onion/","pattern":"[url:value = 'http://yfds4rb64v6qkflagm552ts4hafm36wdgknnx4kxkw2yj7ogbkvabnyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--febcece5-abc7-a28f-6ec4-00006b43145c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nmzanifuvww352acrewixfs3ccu47m7odyzqbx4irzi54k3msxcafcqd.onion/","pattern":"[url:value = 'http://nmzanifuvww352acrewixfs3ccu47m7odyzqbx4irzi54k3msxcafcqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e851be93-ba88-7ccc-39a8-00006d09a1bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://32iln5hsuhh6h23vxdozlrdpe34z55q64sjhc7vszjg6gymsafybntqd.onion/","pattern":"[url:value = 'http://32iln5hsuhh6h23vxdozlrdpe34z55q64sjhc7vszjg6gymsafybntqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38b6621d-25ea-9af9-c2ec-000095416a29","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://e5xsyvpznhvpbe6x23infajbhnosbgqrm7vkj7ipmviuvdbp73bimfid.onion/","pattern":"[url:value = 'http://e5xsyvpznhvpbe6x23infajbhnosbgqrm7vkj7ipmviuvdbp73bimfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f99f36cd-85ee-2205-4705-000084ad5fe4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cx3jub2f7g5jxhk5qu4fewxsxspztao2jfy4drllitcteb6mdakbs4yd.onion/","pattern":"[url:value = 'http://cx3jub2f7g5jxhk5qu4fewxsxspztao2jfy4drllitcteb6mdakbs4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d4cfefb-7e69-6ca4-e8ea-0000b8b2188a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yuixyfc3dfxrsw32xeskx7bj5bwsriyuso5jmte4d4itx5vzfs7dwbqd.onion/","pattern":"[url:value = 'http://yuixyfc3dfxrsw32xeskx7bj5bwsriyuso5jmte4d4itx5vzfs7dwbqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cf3e635-4d1e-fc50-8b6d-0000fa469555","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fsd6w5h3y3rnguawguyf7bjf7kuesx5frsz3im2tt3oc7kfqmo5xkmyd.onion/","pattern":"[url:value = 'http://fsd6w5h3y3rnguawguyf7bjf7kuesx5frsz3im2tt3oc7kfqmo5xkmyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00af29ca-e937-25e4-f1f6-00006a6177aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wuw3f4e6iitt7z2lyuxxhydvao5bvowpbqrlmbezthakfhkbm4efdhyd.onion/","pattern":"[url:value = 'http://wuw3f4e6iitt7z2lyuxxhydvao5bvowpbqrlmbezthakfhkbm4efdhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8acc5d5-d1b8-4ef9-4e1b-000016d97e55","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3dr2kapincqukpiqavyh6zqjlrxf35x246hqi3kwnd7uu57e3isvapyd.onion/","pattern":"[url:value = 'http://3dr2kapincqukpiqavyh6zqjlrxf35x246hqi3kwnd7uu57e3isvapyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b56a8d5-50a0-0977-8e52-00009be270ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2ru7dh7myxylx3bpwtv2jfugmp3yk24hi27h2rni7ppj2xeyea62lzid.onion/","pattern":"[url:value = 'http://2ru7dh7myxylx3bpwtv2jfugmp3yk24hi27h2rni7ppj2xeyea62lzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f244d16-296b-2a50-e87d-000095094ffa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nmmzaxo5x64zmhkqcowocfzvigss7pjrs27a6u4bxsd7qcsw2tuoyuqd.onion","pattern":"[url:value = 'http://nmmzaxo5x64zmhkqcowocfzvigss7pjrs27a6u4bxsd7qcsw2tuoyuqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f588dade-eb77-2ff0-6682-0000ebd57be6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://imtw62nlygdgzyuri6dmce7s7vmpfdrmth56czxvdissu4w5jqoq4aid.onion/","pattern":"[url:value = 'http://imtw62nlygdgzyuri6dmce7s7vmpfdrmth56czxvdissu4w5jqoq4aid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--530bcee4-9f5b-ba94-649d-000098361ec9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ppdxekp3e2lap5mpurmmrztjamwydjz352l3giquyqihxrilxs6is7qd.onion","pattern":"[url:value = 'http://ppdxekp3e2lap5mpurmmrztjamwydjz352l3giquyqihxrilxs6is7qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb20517d-27a5-f232-a10c-00003091f29b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zklxzhbbfhmfa24qn4ewfsxnkllhiq3kjmhcxyeyvyecatpjesokl7id.onion/","pattern":"[url:value = 'http://zklxzhbbfhmfa24qn4ewfsxnkllhiq3kjmhcxyeyvyecatpjesokl7id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f60e20f-fb5f-3c72-d035-0000ded0f2ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mqmli23jqwsu5k4r256wphxk732cmd6tspsdjlz6uzzhju76gbk5zfad.onion/","pattern":"[url:value = 'http://mqmli23jqwsu5k4r256wphxk732cmd6tspsdjlz6uzzhju76gbk5zfad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e0d5739-b442-efd9-2d0a-000054872cb1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://r4xawvvhiw6jjll3loholrkhd2seue2ty2g6ezxt3umafj25kff2amqd.onion/","pattern":"[url:value = 'http://r4xawvvhiw6jjll3loholrkhd2seue2ty2g6ezxt3umafj25kff2amqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01ed5126-13ea-1892-0de7-0000b5ad8d2d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ewdq4igcuosp3pgloyxpjmlivh7vrhcx4axnerj4adsfqewrmgerwgad.onion/","pattern":"[url:value = 'http://ewdq4igcuosp3pgloyxpjmlivh7vrhcx4axnerj4adsfqewrmgerwgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d727aca8-a217-20ae-4802-000084a50f2f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wt4ampyvjt3ozvxfpjtm2igsg4zwahnw2scyeyk5v2bvl42mujokvkid.onion/","pattern":"[url:value = 'http://wt4ampyvjt3ozvxfpjtm2igsg4zwahnw2scyeyk5v2bvl42mujokvkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e12d87e2-c6fd-2504-29ed-00006f0d1378","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vblcmlxagwc5wmwxw2mjovmj6d6km55zpogazfmrnibmsib4epr3ceid.onion/","pattern":"[url:value = 'http://vblcmlxagwc5wmwxw2mjovmj6d6km55zpogazfmrnibmsib4epr3ceid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e359afe-5852-69bb-9bc5-00009631bdd9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rkl6pv5gbhvg3chpgvj4bvanzbmway7phxhguvyxbltcatqrudtbcsyd.onion/","pattern":"[url:value = 'http://rkl6pv5gbhvg3chpgvj4bvanzbmway7phxhguvyxbltcatqrudtbcsyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91a2ac4b-e934-f613-2b20-0000b2d3163f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fkpc57333w44jk3qtcnotrfail5xjbsnqzf7gzbkoksx5bhad6um57ad.onion/","pattern":"[url:value = 'http://fkpc57333w44jk3qtcnotrfail5xjbsnqzf7gzbkoksx5bhad6um57ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6e89ea4-25eb-dbcc-5986-00006b147d2a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://33mo4vvozcnqrnn6hk2pavgrw4k5yicbtlh4pabonw3pmmydavgn5wad.onion/","pattern":"[url:value = 'http://33mo4vvozcnqrnn6hk2pavgrw4k5yicbtlh4pabonw3pmmydavgn5wad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b1134ee-c375-9301-5579-000086906b9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fn3zyhg5cc4dh4gpqkr6tdigffglhf7zygck2vtem5vp7ip6pxs2vsyd.onion/","pattern":"[url:value = 'http://fn3zyhg5cc4dh4gpqkr6tdigffglhf7zygck2vtem5vp7ip6pxs2vsyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe367c96-49a7-ca07-ffa9-000041d82271","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zbzvt5he7qsvm2zf2zfwbyomww3l5nbwyulz4ple4bjgtvm2wcg2coid.onion/","pattern":"[url:value = 'http://zbzvt5he7qsvm2zf2zfwbyomww3l5nbwyulz4ple4bjgtvm2wcg2coid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--206990b2-f147-75e7-7f7a-000077833c16","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yx66ex47lij4ou2zwbswelttzmlexwzu4coo26sqxyryrglnjuif2sad.onion/","pattern":"[url:value = 'http://yx66ex47lij4ou2zwbswelttzmlexwzu4coo26sqxyryrglnjuif2sad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--379f9c44-ddf6-bf7e-7b4d-00003ea12b46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://w2nqadfma4bsgdkjmfpmxsh6nvwqgpa5q3toijdiducuqkauj447j3qd.onion/","pattern":"[url:value = 'http://w2nqadfma4bsgdkjmfpmxsh6nvwqgpa5q3toijdiducuqkauj447j3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7bd4cad-633c-6dfd-ceb8-0000ccca4442","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3nuqlmbcmogstufvn7mkrheqvgiqdbaukpaalceetglvksae2ulgjxyd.onion/","pattern":"[url:value = 'http://3nuqlmbcmogstufvn7mkrheqvgiqdbaukpaalceetglvksae2ulgjxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff97c546-0098-3ddf-8025-0000588791cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://olofrf73o3ciyn73vc7cmjsskpkhjcpiilvdauijcf3lts4boysyctad.onion/","pattern":"[url:value = 'http://olofrf73o3ciyn73vc7cmjsskpkhjcpiilvdauijcf3lts4boysyctad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5407526c-ce07-2f87-804d-0000a352ddcb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5rkotzsj6y53u2d4cut2nn2fghnvx2efa5spf724mlqjyr2srgfwqmid.onion/","pattern":"[url:value = 'http://5rkotzsj6y53u2d4cut2nn2fghnvx2efa5spf724mlqjyr2srgfwqmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7c11d78-0220-8990-fdac-0000bd9be2ab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://n2etbp6ktgv42iraeco6foqo4fa5srbcegomwqe4jzch7f5jh3aneiqd.onion/","pattern":"[url:value = 'http://n2etbp6ktgv42iraeco6foqo4fa5srbcegomwqe4jzch7f5jh3aneiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fd4ef53-0d2e-76ca-a6b6-0000c2d42c96","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7g3fopguwzuaz3xofjhb2fxm4aoj5pryhznieynw66sy75pkxonw7iad.onion/","pattern":"[url:value = 'http://7g3fopguwzuaz3xofjhb2fxm4aoj5pryhznieynw66sy75pkxonw7iad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9e91790-e3b7-c561-4c79-0000d53023bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eef7dbgmttjm3qkfjlmqoivbup3fl6utgagu5smmzwve3mfoubalevqd.onion/","pattern":"[url:value = 'http://eef7dbgmttjm3qkfjlmqoivbup3fl6utgagu5smmzwve3mfoubalevqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf846d04-3794-520b-23c5-0000c9f9bf6e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://z6wq6a3skbldpfplorxebvoprwsxuca5vvv667zjighx7w4pmoss3rad.onion/","pattern":"[url:value = 'http://z6wq6a3skbldpfplorxebvoprwsxuca5vvv667zjighx7w4pmoss3rad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aa95de7-74a7-0dd3-aa30-0000f8c4bb84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kfshlvgm4dmhuop5y7wl5wqlp52r7aqrnuz6463eqqnr4sm7f3767ryd.onion/","pattern":"[url:value = 'http://kfshlvgm4dmhuop5y7wl5wqlp52r7aqrnuz6463eqqnr4sm7f3767ryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55b62966-bf33-c690-31e5-0000de687b3b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sxksja7dfrioge25bgp2zggvyu4dfbwh3znl4cmmvgu7pnkyaisfeayd.onion/","pattern":"[url:value = 'http://sxksja7dfrioge25bgp2zggvyu4dfbwh3znl4cmmvgu7pnkyaisfeayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd020297-ce35-bab0-6144-0000d012e8b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wo7j5f2fzufffq5dg235tzlpyoztc3obhzld2sifxqlrb7knlia3p2yd.onion/","pattern":"[url:value = 'http://wo7j5f2fzufffq5dg235tzlpyoztc3obhzld2sifxqlrb7knlia3p2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52355e56-030d-335e-6285-0000eecca307","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lmwmc6cqabtanrx2ncxvt3cyw3zqabcr6pbqyhmqjd3sauweccgjuhad.onion/","pattern":"[url:value = 'http://lmwmc6cqabtanrx2ncxvt3cyw3zqabcr6pbqyhmqjd3sauweccgjuhad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--583d00e8-e0c9-df89-e51e-00000bef88ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://iuhetl6bw42pi6e7l26jf66se75zpmiselqn3ygtmaj7opqfzj7rcmid.onion/","pattern":"[url:value = 'http://iuhetl6bw42pi6e7l26jf66se75zpmiselqn3ygtmaj7opqfzj7rcmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4d372cc-a12d-4acc-44fe-00006e10b264","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4qnqinvxamonvpkdgsazpt557ghsanrxn4gycziuztpb4rtpgryopsyd.onion/","pattern":"[url:value = 'http://4qnqinvxamonvpkdgsazpt557ghsanrxn4gycziuztpb4rtpgryopsyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7e559f0-bec1-4bef-7fc5-0000faabc633","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tjplg6ewcuzt5cbelb5cb2sawumpvtea74xnkuyly73zmu3athzog3qd.onion/","pattern":"[url:value = 'http://tjplg6ewcuzt5cbelb5cb2sawumpvtea74xnkuyly73zmu3athzog3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--946c7e36-6796-d942-471c-00002128a513","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://s5a3n7rpg2kjjeac3ffr2u4x3v3vtk2552sairawiqpkn4x6pzack4id.onion/","pattern":"[url:value = 'http://s5a3n7rpg2kjjeac3ffr2u4x3v3vtk2552sairawiqpkn4x6pzack4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--033aedc9-e80a-8f1e-bced-000047d4bc71","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qyjz6x5cxnu3utkwzlpjc4rbx25hynl3ug7jq32fiissbw77un45m2ad.onion/","pattern":"[url:value = 'http://qyjz6x5cxnu3utkwzlpjc4rbx25hynl3ug7jq32fiissbw77un45m2ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2fca557-7a3c-379d-628d-0000fafe8bf2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ibnuhunbz3ibjid2mnehzi63htotmx3l26yuwepg345yo6el2mb3qiqd.onion/","pattern":"[url:value = 'http://ibnuhunbz3ibjid2mnehzi63htotmx3l26yuwepg345yo6el2mb3qiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--893a5406-427c-2005-962f-0000e8207877","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2swloxgo46jn745yonzheyqgyl67nczdrxliwqmojzgcgw6l267px3qd.onion/","pattern":"[url:value = 'http://2swloxgo46jn745yonzheyqgyl67nczdrxliwqmojzgcgw6l267px3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b31b9360-bcdf-293f-4db7-00006ca89e08","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yauyy3poof4vzfy7kesoblkohfavbhxhxjl5hnaj3mnxb7njh5hbnyqd.onion/","pattern":"[url:value = 'http://yauyy3poof4vzfy7kesoblkohfavbhxhxjl5hnaj3mnxb7njh5hbnyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d6da60f-ef63-62b0-762f-000034740464","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://istcxxyqe3bewj366inscqdsavyd37v3qj5f7wzg7fpgcuofoioh4wqd.onion/","pattern":"[url:value = 'http://istcxxyqe3bewj366inscqdsavyd37v3qj5f7wzg7fpgcuofoioh4wqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c75a232a-425a-fd37-4cb7-0000f4bb49d4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://25hchw2baxphdb4mu5vdfu7j2f3pn3ze2qumzn3ccwe2rbwj4rtdkmid.onion/","pattern":"[url:value = 'http://25hchw2baxphdb4mu5vdfu7j2f3pn3ze2qumzn3ccwe2rbwj4rtdkmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ed7162c-dc5f-395c-d0b0-0000c10e08c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3vgcwib73eenykpxii5gnuwxl4ysya6psfx3yjqtl7xgy35lixi25wqd.onion/","pattern":"[url:value = 'http://3vgcwib73eenykpxii5gnuwxl4ysya6psfx3yjqtl7xgy35lixi25wqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10944336-e673-3209-4c45-0000f8a69707","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://oso6kkweobalp7sttvuv3kto3piov3ddzzwrxzgsbadohwevsy65xzyd.onion/","pattern":"[url:value = 'http://oso6kkweobalp7sttvuv3kto3piov3ddzzwrxzgsbadohwevsy65xzyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--412ddfdc-f6d5-3020-7e35-0000339a0c1e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p7evo5mrc4e4benug33wfc6zslkbj7yxht27b7w7prrbbwgjtwssdtad.onion/","pattern":"[url:value = 'http://p7evo5mrc4e4benug33wfc6zslkbj7yxht27b7w7prrbbwgjtwssdtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7d8983e-024a-910b-f270-0000eb13d717","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://heutrg7ynu2p3sywvvfwmd73bspe6ndxd3xxtm3jmbhmo2ejg2tiqeyd.onion/","pattern":"[url:value = 'http://heutrg7ynu2p3sywvvfwmd73bspe6ndxd3xxtm3jmbhmo2ejg2tiqeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e71402c-c703-d33b-6bb2-0000125af4ab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5fowetkacveat2b33i2vs4ss6bkxnwhvgmdlxvx65uv237s5bueezaqd.onion/","pattern":"[url:value = 'http://5fowetkacveat2b33i2vs4ss6bkxnwhvgmdlxvx65uv237s5bueezaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf24eaaf-8b15-c9cc-b8c3-0000bec0a0fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xpi6anvefx456kfogxwwpxdejqzxxv63ve4yy3atczhs23kw73e3wwyd.onion/","pattern":"[url:value = 'http://xpi6anvefx456kfogxwwpxdejqzxxv63ve4yy3atczhs23kw73e3wwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--706a729f-d853-f418-3997-0000b2572921","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fmeti5zey2mpjbvucw5hj45brp4rbu4gqajh73n4nh4uklepqos3gkqd.onion/","pattern":"[url:value = 'http://fmeti5zey2mpjbvucw5hj45brp4rbu4gqajh73n4nh4uklepqos3gkqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e08eec4d-3c68-8b15-9b8b-000074ff491a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kqbrqhs446zc72jau3f2a6qj5zomkcjs35gtytesv3v2os533mlobpyd.onion/","pattern":"[url:value = 'http://kqbrqhs446zc72jau3f2a6qj5zomkcjs35gtytesv3v2os533mlobpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39dc7097-2f6d-2b81-0a69-0000ac700ceb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://i3gut7gggz4cihj2byuhjqxmrzdetkmkwlfmvy6xju4zzos6awfbmvid.onion/","pattern":"[url:value = 'http://i3gut7gggz4cihj2byuhjqxmrzdetkmkwlfmvy6xju4zzos6awfbmvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4323b525-3573-25d1-6ed1-0000f125ea69","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5ulslyd5yq6iai7swjag3vqqsrx2or4t5luwngxjq6fw22qmraetmrqd.onion/","pattern":"[url:value = 'http://5ulslyd5yq6iai7swjag3vqqsrx2or4t5luwngxjq6fw22qmraetmrqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e210f60-934a-25e3-ba6c-000077508211","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4nuk3ztutihvgxhi4vg4sh4xfbrmhaqopi45lkmlsmzoqmd65iu2uwyd.onion/","pattern":"[url:value = 'http://4nuk3ztutihvgxhi4vg4sh4xfbrmhaqopi45lkmlsmzoqmd65iu2uwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2258996a-66f6-e548-ffd5-00007405e3ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kkxbat3noaq4e4jgyqysidmv2qaunh32bzchqfzus75f47zbbyhkaiyd.onion/","pattern":"[url:value = 'http://kkxbat3noaq4e4jgyqysidmv2qaunh32bzchqfzus75f47zbbyhkaiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48f8d80a-fdad-d6b4-f033-00000366f509","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cbxsgxq477jbzurnekcy7mgm3gv6jmfxtworzof3tvmxk4o3uwffmgid.onion/","pattern":"[url:value = 'http://cbxsgxq477jbzurnekcy7mgm3gv6jmfxtworzof3tvmxk4o3uwffmgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1b7f55d-7d9a-6550-86a0-0000acdccb6b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5oqm5zqiy53m7eblq4lcqbydx2zqdhtkcsdyr4ax2aal5ipn5eclqhid.onion/","pattern":"[url:value = 'http://5oqm5zqiy53m7eblq4lcqbydx2zqdhtkcsdyr4ax2aal5ipn5eclqhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac7cb302-dba0-ad74-7bab-000061a95100","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://f4daw6veh35y4t357cwagxcrt2h3ayu7lgxaj4ndhalfpgud5ybz5jyd.onion/","pattern":"[url:value = 'http://f4daw6veh35y4t357cwagxcrt2h3ayu7lgxaj4ndhalfpgud5ybz5jyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a01c8cd1-db26-27bd-f0fc-0000fb0a9101","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://noew5sgjoqdw7dpuwzv5r6ninwhuqwlrqsgexykunxyx74bxfyjssbad.onion/","pattern":"[url:value = 'http://noew5sgjoqdw7dpuwzv5r6ninwhuqwlrqsgexykunxyx74bxfyjssbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c7e9e97-1b53-27f5-c9c0-000054551028","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion/","pattern":"[url:value = 'http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e1d66b-9018-3bf3-d233-0000b09bd1ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2mdzef2yb7qsp373sbxo3wrdykvohviei7gfjjpga2aad3evhsa375id.onion/","pattern":"[url:value = 'http://2mdzef2yb7qsp373sbxo3wrdykvohviei7gfjjpga2aad3evhsa375id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3084885a-9486-c4f0-fe8c-00008cd2bb82","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xsjv7vfn3mezoilxzr5w6n7to7z6e6jhcl6xszvzbfznusaqpg2orkid.onion/","pattern":"[url:value = 'http://xsjv7vfn3mezoilxzr5w6n7to7z6e6jhcl6xszvzbfznusaqpg2orkid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--208a470f-4205-59a1-56ff-00004d7fb14f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dduwxwoslpixrhc4x7bpjxqlbdfre4p7cczbnbyrlc2ntirxtcrvr2yd.onion/","pattern":"[url:value = 'http://dduwxwoslpixrhc4x7bpjxqlbdfre4p7cczbnbyrlc2ntirxtcrvr2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d40aca7a-2a69-e924-ab01-00007cd07e26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t6vvwhi2cgalcrcg3rea55knzg6k3lfa4xvx5b2ep5zlurym7e222kqd.onion/","pattern":"[url:value = 'http://t6vvwhi2cgalcrcg3rea55knzg6k3lfa4xvx5b2ep5zlurym7e222kqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b409cfe-d3f9-7432-4cf3-0000e0049fd9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://q2s4esvphmolhb4b6f242efzufbqyz2k3jm2bvokctrdxhnfwidm6pqd.onion/","pattern":"[url:value = 'http://q2s4esvphmolhb4b6f242efzufbqyz2k3jm2bvokctrdxhnfwidm6pqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64623870-d195-95b8-b0b6-000014a49115","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://43e2jpueb6mpwz627q6hsqpxn4q5ainik2zghbeuyvrusgaopkjijiad.onion/","pattern":"[url:value = 'http://43e2jpueb6mpwz627q6hsqpxn4q5ainik2zghbeuyvrusgaopkjijiad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30cf2617-4f83-dd78-0f1d-0000251aac6e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ukhccf4frimtbrnsxaja5igzdh7qvpcvrvnshnm3hdhdrwztecn3k6yd.onion/","pattern":"[url:value = 'http://ukhccf4frimtbrnsxaja5igzdh7qvpcvrvnshnm3hdhdrwztecn3k6yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0800fd4-5dda-c7de-3404-000014d6471d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jlo6rtcobup3p7nf7awd2qvp5f2hvrj5y42xoexv3sg5qjs6emwcqaqd.onion/","pattern":"[url:value = 'http://jlo6rtcobup3p7nf7awd2qvp5f2hvrj5y42xoexv3sg5qjs6emwcqaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b977cb5-d50f-7622-3845-0000da0249d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g2zz6q3w4aminok7myriwblfgyifc5uybejxm76gi6g5diliseujsvyd.onion/","pattern":"[url:value = 'http://g2zz6q3w4aminok7myriwblfgyifc5uybejxm76gi6g5diliseujsvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5231ed3-b0de-c819-f088-00000d9f80cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rtpirl6rklc4js6xkleviq66al22e5yztvpjusyvlhdk4sierqy6k6qd.onion/","pattern":"[url:value = 'http://rtpirl6rklc4js6xkleviq66al22e5yztvpjusyvlhdk4sierqy6k6qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f7018b0-51a6-da5c-07c3-0000e33652c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dlliudi3736dl6ogno7bpbz456p5xcvvnjumih7mw74mga65tw5gzyqd.onion/","pattern":"[url:value = 'http://dlliudi3736dl6ogno7bpbz456p5xcvvnjumih7mw74mga65tw5gzyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9de297e4-e5a8-dcb8-a029-00002a99a2c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2d5nnlkrituzb54m57eg7loc7qz3rfo6f5ze2roq45rq5sxl7izlofyd.onion/","pattern":"[url:value = 'http://2d5nnlkrituzb54m57eg7loc7qz3rfo6f5ze2roq45rq5sxl7izlofyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1ae4c22-20f0-4f39-8a17-0000a21d5977","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://abr5wpdszssel27cusihy5ac7ir6rylvy2dn3vm2rz2t2ud3hh67acad.onion/","pattern":"[url:value = 'http://abr5wpdszssel27cusihy5ac7ir6rylvy2dn3vm2rz2t2ud3hh67acad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1024d9b-7a5e-1dd2-111a-0000aee9421a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2db2voqrkcomdgmpei5yg4tt4h6jtkw7lypezsimtgboaxsjrs3c3lqd.onion/","pattern":"[url:value = 'http://2db2voqrkcomdgmpei5yg4tt4h6jtkw7lypezsimtgboaxsjrs3c3lqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cdc729c-5b12-c4e0-39b7-00009213812d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qyqtmhiu6u4gmjrvbqyycrghvf54fhllu6v4q3jq2nbprn2fvdkbinqd.onion/","pattern":"[url:value = 'http://qyqtmhiu6u4gmjrvbqyycrghvf54fhllu6v4q3jq2nbprn2fvdkbinqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d41f80c2-d61c-cc30-4ab2-0000d0d692ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3yvfwkjonlmgkxpb53xklnwse6ynv6wyrx46oszgugjcdozrwrmgm5id.onion/","pattern":"[url:value = 'http://3yvfwkjonlmgkxpb53xklnwse6ynv6wyrx46oszgugjcdozrwrmgm5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cda9d357-0fdf-1e29-1029-0000989af0c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3qxsc4mkucdcmfd5qedl6ub25m45dyabzqly5aa5j4pvhzwa5luvvzqd.onion/","pattern":"[url:value = 'http://3qxsc4mkucdcmfd5qedl6ub25m45dyabzqly5aa5j4pvhzwa5luvvzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7faa418-a007-2faa-de91-00007140d52e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://e5q3hn2volbts6guyvfed2g2bum6ixjjm6okkr2boyq55iz6pgkvs7ad.onion/","pattern":"[url:value = 'http://e5q3hn2volbts6guyvfed2g2bum6ixjjm6okkr2boyq55iz6pgkvs7ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a314abb-8169-8022-0de2-00006635f3d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://55dhywkxzu2yklme5jz6ov3gojyyqcxts7lktrlg7ciinviw4jnexyad.onion/","pattern":"[url:value = 'http://55dhywkxzu2yklme5jz6ov3gojyyqcxts7lktrlg7ciinviw4jnexyad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1f8e100-6106-93ba-26f3-00000075fdcc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ufooeuu46cscgr4s55xhredxk2pfd25kai2h6v3fxd72q44u5naq67ad.onion/","pattern":"[url:value = 'http://ufooeuu46cscgr4s55xhredxk2pfd25kai2h6v3fxd72q44u5naq67ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--930d508d-531e-04ba-cca5-0000d991ec07","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kivi7gmuw6ynre2vjha3xg4larjzkmqklzych4mhnc5bfau2idlijuid.onion/","pattern":"[url:value = 'http://kivi7gmuw6ynre2vjha3xg4larjzkmqklzych4mhnc5bfau2idlijuid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf6c6792-86fa-87fe-2301-00006459f9ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6h646bnusnohhsw4liocsqlkb77z5ezfoznkq7bfafr74r4rmebxmzid.onion/","pattern":"[url:value = 'http://6h646bnusnohhsw4liocsqlkb77z5ezfoznkq7bfafr74r4rmebxmzid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--740bd088-d897-56a6-31a2-00000dba1375","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fxusbgau76xjtsge6um5im6wgqaunawbujzioi4i7m2sc7stvqmdgfyd.onion/","pattern":"[url:value = 'http://fxusbgau76xjtsge6um5im6wgqaunawbujzioi4i7m2sc7stvqmdgfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a0c8955-9f82-5a1e-fbb1-00007df6c6e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zgqfcxan6qbtw67hh3s4nwvsfudiuf4qbl47emmhuaxj3gtz6m6o3wqd.onion/","pattern":"[url:value = 'http://zgqfcxan6qbtw67hh3s4nwvsfudiuf4qbl47emmhuaxj3gtz6m6o3wqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffe30cce-4044-0606-877f-0000faf102d5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ldvzvwiurk3swzksqtqgvu6zvg3zv6vdggkyl532yqhssst5tzgvwyyd.onion/","pattern":"[url:value = 'http://ldvzvwiurk3swzksqtqgvu6zvg3zv6vdggkyl532yqhssst5tzgvwyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c05ff15f-0827-195c-4950-000065e5b07a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5kvj72izos5lvrwntlbzlyimaozufudkzciruqwinkeziludv26ph7yd.onion/","pattern":"[url:value = 'http://5kvj72izos5lvrwntlbzlyimaozufudkzciruqwinkeziludv26ph7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40c91e92-14e4-84ec-051c-00003c186cbb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dp6vxtqsvusxfbnk555enzgnivovpvoqe4f7v2422lzqdyj6iq7qu7yd.onion/","pattern":"[url:value = 'http://dp6vxtqsvusxfbnk555enzgnivovpvoqe4f7v2422lzqdyj6iq7qu7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed255f45-a032-5b4c-9159-0000f4009fb4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://haqrod6fojtr6aexib4un5pa6ue7tpq7cp7nbr573upiilyglwfnkrqd.onion/","pattern":"[url:value = 'http://haqrod6fojtr6aexib4un5pa6ue7tpq7cp7nbr573upiilyglwfnkrqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74d1ca38-df08-cf7f-6ad8-00001ecf2c74","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7ok7aj7ecfo2ydyfsscpxc64mqmdaq3xctnjva327wzp5w27fwiexvid.onion/","pattern":"[url:value = 'http://7ok7aj7ecfo2ydyfsscpxc64mqmdaq3xctnjva327wzp5w27fwiexvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a6bc056-4c50-2ef5-65e1-00008ddd7808","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://magoxorwigpp3kdhkq3xvnzorf5znc2rphdh7xehaqir3s4owodjvmad.onion/","pattern":"[url:value = 'http://magoxorwigpp3kdhkq3xvnzorf5znc2rphdh7xehaqir3s4owodjvmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec3fd93c-24fc-bba1-2da5-00003f9b0add","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sxwtt3g5tk77o3rcinl7siownprzrl2gfkbe74rtgxasrkhgwu32kqqd.onion/","pattern":"[url:value = 'http://sxwtt3g5tk77o3rcinl7siownprzrl2gfkbe74rtgxasrkhgwu32kqqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6d9469b-70b3-bce5-0fdb-00005c1c90aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kv7ti35lpsqoafjvw2s3kw66fbld6ajastrmqzx5bv2ncfjcu7oyq4qd.onion/","pattern":"[url:value = 'http://kv7ti35lpsqoafjvw2s3kw66fbld6ajastrmqzx5bv2ncfjcu7oyq4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90e67d53-3ac8-fbdd-bc69-000049749521","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yggqtlqhmjzuv2lffbc4hyhkvc53bppyazpgo4345vxulhgnaxrbuaad.onion/","pattern":"[url:value = 'http://yggqtlqhmjzuv2lffbc4hyhkvc53bppyazpgo4345vxulhgnaxrbuaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f19477cd-2e73-8fec-f323-0000fa1df820","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fozerypvwcn6p2zrpzmtzshiewg2eusz3ag46atxiuw2otdxhnc24xyd.onion/","pattern":"[url:value = 'http://fozerypvwcn6p2zrpzmtzshiewg2eusz3ag46atxiuw2otdxhnc24xyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50ccf84a-ad85-0d1f-753b-0000c7cca8c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://z73yj7qwpbntsvoctsioizbhxxmqrtjiio3q6fsscfayge6gqzh37wid.onion/","pattern":"[url:value = 'http://z73yj7qwpbntsvoctsioizbhxxmqrtjiio3q6fsscfayge6gqzh37wid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9ffa4f9-1165-6613-b7c1-0000a90a9b78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://e43pziezfuzpede56vrywuvmkfszvuh47md537p6eg4vg6rz7knbljyd.onion/","pattern":"[url:value = 'http://e43pziezfuzpede56vrywuvmkfszvuh47md537p6eg4vg6rz7knbljyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34948de1-ffc4-1852-d17d-000025194e56","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lkfra3hoenzn545wxjuffdnnik3n6ny42glyvbtnzdzxmcra4sdeu4qd.onion/","pattern":"[url:value = 'http://lkfra3hoenzn545wxjuffdnnik3n6ny42glyvbtnzdzxmcra4sdeu4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04a28234-20c9-95fe-36b7-0000e67930eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5kmpnanl32r6kiltzwendnf47u55dd77ykgrx3w5qdchunnese6fruid.onion/","pattern":"[url:value = 'http://5kmpnanl32r6kiltzwendnf47u55dd77ykgrx3w5qdchunnese6fruid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f8c1545-e649-d24c-acd6-0000519c23a5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kaet2hxifahyruhfczz5nuwb2anocqw6gwsfe4tubgqtngvzweff5wyd.onion/","pattern":"[url:value = 'http://kaet2hxifahyruhfczz5nuwb2anocqw6gwsfe4tubgqtngvzweff5wyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--608bf817-405e-8a95-195f-00004b10c126","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://athwchhervsimhondaj32uhoxjwl5tbetulxzn6xkbwjst7z25raprqd.onion/","pattern":"[url:value = 'http://athwchhervsimhondaj32uhoxjwl5tbetulxzn6xkbwjst7z25raprqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f786a41e-d3de-bb19-0eef-00002c7e94db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://divywzl6p4ftha2aunljszhmqat2y7alo6y32xzxvvoz5bhoqymp37ad.onion/","pattern":"[url:value = 'http://divywzl6p4ftha2aunljszhmqat2y7alo6y32xzxvvoz5bhoqymp37ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be5b4d88-bd21-6244-025d-0000a23eb61c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3vnpzcnzsjel2f6obkaijal4k4mz2hqghpmelfotnxqntzwycvdvhcyd.onion/","pattern":"[url:value = 'http://3vnpzcnzsjel2f6obkaijal4k4mz2hqghpmelfotnxqntzwycvdvhcyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--252832f5-a7de-a63e-13d8-00009fbc083b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vne7nzaz6ruazkv5rj7lwphlkqnw4xtz6h53fvfmce6kyrk4v2pe5kid.onion/","pattern":"[url:value = 'http://vne7nzaz6ruazkv5rj7lwphlkqnw4xtz6h53fvfmce6kyrk4v2pe5kid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51b37f2d-2347-d19b-84c9-00003e2c1743","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vtoq7ltt3gfexaratzzqkjd73yhdtrhj64z7qwtvgs5gfyzhlwddzyyd.onion/","pattern":"[url:value = 'http://vtoq7ltt3gfexaratzzqkjd73yhdtrhj64z7qwtvgs5gfyzhlwddzyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b15763c-5da4-f7d5-facc-0000cdbf635a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://72j5cqqpqz64yxfbx2v6bntogxvl5zkiirhjhp3e5nmlgnofixgyahad.onion/","pattern":"[url:value = 'http://72j5cqqpqz64yxfbx2v6bntogxvl5zkiirhjhp3e5nmlgnofixgyahad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--195e33e9-5f98-45f3-1735-00002afdb75b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wherm2w63n32q2noek7gfr6ovrrrhcfc7blyyg7t32tvfey6tqtxpoad.onion/","pattern":"[url:value = 'http://wherm2w63n32q2noek7gfr6ovrrrhcfc7blyyg7t32tvfey6tqtxpoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b7f2c8b-7f69-c9eb-4bc9-0000e09db687","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cdtjmysl6xjyjwa327agvh5yvv4ivmk3xjzigpi56vl6oll3t7lmcbad.onion/","pattern":"[url:value = 'http://cdtjmysl6xjyjwa327agvh5yvv4ivmk3xjzigpi56vl6oll3t7lmcbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c479ee8-152f-cbe0-d349-000054fdb77d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bxhtbrcwpx5upf2qu42jagrvwxa63nhmcdatd4jlzhwhmrq37fl5vtad.onion/","pattern":"[url:value = 'http://bxhtbrcwpx5upf2qu42jagrvwxa63nhmcdatd4jlzhwhmrq37fl5vtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--767657d5-8ccd-a737-55c9-000033a8ad99","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zgz5tfqj3z3nfvcdeefu4ip6gnwbomwwcevqwykwcvmi2ubmpvtqstid.onion/","pattern":"[url:value = 'http://zgz5tfqj3z3nfvcdeefu4ip6gnwbomwwcevqwykwcvmi2ubmpvtqstid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a288b126-d15a-7701-b3ed-0000d60bebb5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mt25rmrccjob5tobrpydqgzo2zuil2hgbfpdcotu2comvxo6zx7ix4yd.onion/","pattern":"[url:value = 'http://mt25rmrccjob5tobrpydqgzo2zuil2hgbfpdcotu2comvxo6zx7ix4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b03b23f9-4633-8e36-c152-000041c19304","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dqcownxteexcpxjupxy3octo452rua7lepygsc2hd6wuengrl2j6vgqd.onion/","pattern":"[url:value = 'http://dqcownxteexcpxjupxy3octo452rua7lepygsc2hd6wuengrl2j6vgqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35947eed-c4be-ce2e-f635-00001392054d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://c2sq63lsvbteng7z3bknme22t4vdwyeihgyeyvpucc3ugqpej7ecoqyd.onion/","pattern":"[url:value = 'http://c2sq63lsvbteng7z3bknme22t4vdwyeihgyeyvpucc3ugqpej7ecoqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--371707b8-dde0-c223-d496-0000f3a9f931","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kg2pf5nokg5xg2ahzbhzf5kucr5bc4y4ojordiebakopioqkk4vgz6ad.onion/","pattern":"[url:value = 'http://kg2pf5nokg5xg2ahzbhzf5kucr5bc4y4ojordiebakopioqkk4vgz6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49c22211-0d2b-1661-b457-00003b4a691c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://o37ozxfklmenvcmbck6hnbdb2bozaarpiqoefff7rsn7n62oz3en72id.onion","pattern":"[url:value = 'http://o37ozxfklmenvcmbck6hnbdb2bozaarpiqoefff7rsn7n62oz3en72id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1b7b132-2bc9-ed88-2254-00007b42cd67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftp://185.196.8.92/","pattern":"[url:value = 'http://ftp://185.196.8.92/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f264dfd1-aca7-270f-d1a0-0000344266ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://u4celkv4ge65uxulffd47gyf2zbxgtbzktl5ubhjiiwqm2q5cjtm2lqd.onion/","pattern":"[url:value = 'http://u4celkv4ge65uxulffd47gyf2zbxgtbzktl5ubhjiiwqm2q5cjtm2lqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aeda9d4-1fad-97b7-b9ee-0000df88417d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nj5lfmji6svckid5tzwd7rc3jg3gnzaoswsmqtea7n3lm2qy5yndlyad.onion","pattern":"[url:value = 'http://nj5lfmji6svckid5tzwd7rc3jg3gnzaoswsmqtea7n3lm2qy5yndlyad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cadfdae1-31b7-08a8-0f05-000031ed1d23","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftp://208.76.221.205/","pattern":"[url:value = 'http://ftp://208.76.221.205/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5383084-0aa3-f7ca-8fe8-0000e50e782a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftp://datashare:ENqh0jBHKia2L22fxzivbhRL@64.176.162.76","pattern":"[url:value = 'http://ftp://datashare:ENqh0jBHKia2L22fxzivbhRL@64.176.162.76']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3cf9ff0-ac51-f429-4f4d-0000bcb07f59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://wikileaks2.site/","pattern":"[url:value = 'https://wikileaks2.site/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d556be0-ad7c-de5d-30b0-0000c09c8244","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ifjnyofk7xpdrqzp3pgyorwgoyrxjkjic4aqxcz4sjxjhbpewfoxngad.onion","pattern":"[url:value = 'http://ifjnyofk7xpdrqzp3pgyorwgoyrxjkjic4aqxcz4sjxjhbpewfoxngad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0541892-6faa-71e5-ab8b-0000e4fc2434","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zlubnjgvsf6ifxswnvpfgvp36tlzubzggn4txk5mi5qgt377ytzai6yd.onion","pattern":"[url:value = 'http://zlubnjgvsf6ifxswnvpfgvp36tlzubzggn4txk5mi5qgt377ytzai6yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2f4ee30-86a0-575a-18e6-0000aa3048eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://djixgstarlzvmqsqcewlsfxlqzwd3i2eqs24mccfrfvrhqihjmssahqd.onion","pattern":"[url:value = 'http://djixgstarlzvmqsqcewlsfxlqzwd3i2eqs24mccfrfvrhqihjmssahqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2933ca4e-e1ad-215e-69f0-000000b7bb9f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://z2rmyu57rkmlsfif4lovlz36ph7lxmjiawilmeryfoupwnbuplm4suqd.onion","pattern":"[url:value = 'http://z2rmyu57rkmlsfif4lovlz36ph7lxmjiawilmeryfoupwnbuplm4suqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--876afecc-b26a-0a70-a44b-00004b9b6e78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion/","pattern":"[url:value = 'http://ji57fr53anp7wb44tbbnp72qcgbhqywy4jmbncawdcrejj5amuvh3zqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--945edbc9-daff-518c-e08d-0000841788d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://22odvea7bampzr7k2dztbqda67fpau6hcy7sgn2npucaz5gcjmmzrgqd.onion/","pattern":"[url:value = 'http://22odvea7bampzr7k2dztbqda67fpau6hcy7sgn2npucaz5gcjmmzrgqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8780eb35-2d93-9b02-ccb7-000086e4cb55","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ytdfc3dvgudgq4zyjwtipzbsu7arbiqvygfqdyqiygkvry2hy47oq2ad.onion","pattern":"[url:value = 'http://ytdfc3dvgudgq4zyjwtipzbsu7arbiqvygfqdyqiygkvry2hy47oq2ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--044a9ebb-75ea-8fbb-8e72-000044b65b41","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p2zg4yqlsflg77opdzcjiu3reyj3wx2owwez2tcyv3vemmz7wbyccyqd.onion/","pattern":"[url:value = 'http://p2zg4yqlsflg77opdzcjiu3reyj3wx2owwez2tcyv3vemmz7wbyccyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--170a95a3-6476-1946-b3fb-0000c3ab31c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vn2untbh4etoqoc4rfsrzlautth7vm62swv7ohemsy4tgh3a4j5ykgyd.onion","pattern":"[url:value = 'http://vn2untbh4etoqoc4rfsrzlautth7vm62swv7ohemsy4tgh3a4j5ykgyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccdc46c3-7fa1-a5e0-cbd5-00004ed91b07","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@185.196.10.19","pattern":"[url:value = 'http://ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@185.196.10.19']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae951f4d-4679-760a-fce5-00006d3c2105","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"ip: 185.196.10.52","pattern":"[ipv4-addr:value = '185.196.10.52']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6a8e86f-45b0-aae4-6b38-0000f9579b2b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftp://datashare:C}^SLA\\","pattern":"[url:value = 'http://ftp://datashare:C}^SLA\\\\']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--248a1aaa-c3ee-3170-50a4-00009dd90dd9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6d453sm6732jpr5gjs6zrjzysurnmrwi67624goptyly2xuz2kmjixad.onion","pattern":"[url:value = 'http://6d453sm6732jpr5gjs6zrjzysurnmrwi67624goptyly2xuz2kmjixad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ff51dd4-ac6a-e1fb-9e0b-00004c4db2f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@185.39.17.75","pattern":"[url:value = 'http://ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@185.39.17.75']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdd326ea-34d5-b08e-bcd0-00008c07105f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ugefls6xolqo6anb6jydjtwqbr5h3st2stfo6j4or2hp7ak5zypwq2yd.onion","pattern":"[url:value = 'http://ugefls6xolqo6anb6jydjtwqbr5h3st2stfo6j4or2hp7ak5zypwq2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4af006d-f8c8-13fe-9237-0000f210a370","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@176.113.115.209","pattern":"[url:value = 'http://ftp://dataShare:2bTWYKNn7aK7Rqp9mnv3@176.113.115.209']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48fff2f1-b6b7-c1e8-0f58-00004bf830b3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ftp://dataShare:nX4aJxu3rYUMiLjCMtuJYTKS@176.113.115.97","pattern":"[url:value = 'http://ftp://dataShare:nX4aJxu3rYUMiLjCMtuJYTKS@176.113.115.97']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5a2e221-4860-d87c-d84a-000099693a36","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kbsqoiyihadmwczmxkbovk7ss2dcynitwhhfu5yw725dbogo5kthfaad.onion","pattern":"[url:value = 'http://kbsqoiyihadmwczmxkbovk7ss2dcynitwhhfu5yw725dbogo5kthfaad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d45dede-5c0c-782f-479f-00006a6c0047","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ijzn3sicrcy7quixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvad.onion","pattern":"[url:value = 'http://ijzn3sicrcy7quixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--369a3096-19ab-4c67-99a1-0000c274cd73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://31.41.244.100/","pattern":"[url:value = 'https://31.41.244.100/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1630fba3-3010-1566-0716-00000aa661a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"ip: 188.119.66.189","pattern":"[ipv4-addr:value = '188.119.66.189']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e62473a1-8e19-130a-4fc9-0000dbf3f827","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"ip: 85.209.11.49","pattern":"[ipv4-addr:value = '85.209.11.49']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4c55896-fefb-840a-67a9-00009484603b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://wikileaksv2.com","pattern":"[url:value = 'https://wikileaksv2.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ee517b5-0ca9-86a4-d6e3-0000e200eb3a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion/","pattern":"[url:value = 'http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4501be4b-cb7e-4176-7976-000085f8946a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion/blog","pattern":"[url:value = 'http://wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion/blog']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3683770-b27c-3756-61d4-000073e96453","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://24kckepr3tdbcomkimbov5nqv2alos6vmrmlxdr76lfmkgegukubctyd.onion","pattern":"[url:value = 'http://24kckepr3tdbcomkimbov5nqv2alos6vmrmlxdr76lfmkgegukubctyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9273a7d5-0d29-f5e4-73f7-0000577eb84f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion/","pattern":"[url:value = 'http://ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d3ee51b-32c6-be64-fd0c-0000066d1330","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/prometheus","pattern":"[url:value = 'https://www.ransomlook.io/group/prometheus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f93d0067-3a7c-f70f-ec94-0000e186d4e3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/spook-ransomware-prometheus-derivative-names-those-that-pay-shames-those-that-dont/","pattern":"[url:value = 'https://www.sentinelone.com/labs/spook-ransomware-prometheus-derivative-names-those-that-pay-shames-those-that-dont/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29d0b9e3-7a6f-25c7-948e-0000ec06ec5b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/cybereason-vs.-prometheus-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/cybereason-vs.-prometheus-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53b2e325-45cb-5d73-0c0a-00009accb379","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/inversecos/status/1441252744258461699?s=20","pattern":"[url:value = 'https://twitter.com/inversecos/status/1441252744258461699?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5580f0e-6ba3-fa34-0e1a-00001cc0ad18","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/decryptor-released-for-prometheus-ransomware-victims/","pattern":"[url:value = 'https://therecord.media/decryptor-released-for-prometheus-ransomware-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e23e2a3-13d2-9b28-7b61-0000e1674615","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityintelligence.com/posts/ransomware-encryption-goes-wrong/","pattern":"[url:value = 'https://securityintelligence.com/posts/ransomware-encryption-goes-wrong/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98d54ce0-5cb4-32ff-ce88-0000f7e1b3c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/prometheus-x-spook-prometheus-ransomware-rebranded-spook-ransomware-6f93bd8ab5dd","pattern":"[url:value = 'https://medium.com/s2wlab/prometheus-x-spook-prometheus-ransomware-rebranded-spook-ransomware-6f93bd8ab5dd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6200daa-dc44-b0fd-334e-0000ae59c34b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/cycraft/prometheus-decryptor-6933e7bac1ea","pattern":"[url:value = 'https://medium.com/cycraft/prometheus-decryptor-6933e7bac1ea']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b31e8d70-cb19-ae1e-528e-0000d4a5f628","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2021/05/prometheus-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2021/05/prometheus-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7d143e1-cd98-80f9-2d03-000076d6015a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/prometheus-ransomwar","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/prometheus-ransomwar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87aa4fb4-41b7-9dcb-3f03-000077c30ad9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/decryptor-released-for-prometheus-ransomware-victims","pattern":"[url:value = 'https://therecord.media/decryptor-released-for-prometheus-ransomware-victims']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9086a317-dcfa-7bb2-412c-00006cee39f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://promethw27cbrcot.onion/ticket.php?track=","pattern":"[url:value = 'http://promethw27cbrcot.onion/ticket.php?track=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47a30b9a-8f16-d73d-741b-0000a8d95356","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/payloadbin","pattern":"[url:value = 'https://www.ransomlook.io/group/payloadbin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9d9abdc-edb7-fd8a-951b-0000c2198651","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cyberintelmag.com/malware-viruses/payloadbin-ransomware-attributed-to-evil-corp","pattern":"[url:value = 'https://cyberintelmag.com/malware-viruses/payloadbin-ransomware-attributed-to-evil-corp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69b54345-3d15-baca-618a-0000e2785129","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/onepercent","pattern":"[url:value = 'https://www.ransomlook.io/group/onepercent']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d2927b2-4c37-c0bf-8c75-0000aadb45c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/nokoyawa","pattern":"[url:value = 'https://www.ransomlook.io/group/nokoyawa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ef17a47-8818-6b7f-857f-00009ec98d73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wcch72vqgvsgcv4ic3awnonoqgspum6p47m4thum52rbq4fu3ctu6sqd.onion","pattern":"[url:value = 'http://wcch72vqgvsgcv4ic3awnonoqgspum6p47m4thum52rbq4fu3ctu6sqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cabf59e0-ab70-943b-c826-00006d33ddc4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://stockkyjeldgtaj3evbtfb4id7jxnde6qnt6so3ndipcndykgknjlyyd.onion","pattern":"[url:value = 'http://stockkyjeldgtaj3evbtfb4id7jxnde6qnt6so3ndipcndykgknjlyyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e2cda67-00d3-ade1-d206-0000f0e1d973","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://snodfytsyn25r2umgfbygj7gxvul7egr4yx4j4n4yn7nb7crabafzwid.onion","pattern":"[url:value = 'http://snodfytsyn25r2umgfbygj7gxvul7egr4yx4j4n4yn7nb7crabafzwid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c04c5a1e-651d-5234-a448-0000ddf07371","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sabinwgf7aryxeel2ivx243tzymlsuk2s4lmrqnqn7hug5xecy6ob6ad.onion","pattern":"[url:value = 'http://sabinwgf7aryxeel2ivx243tzymlsuk2s4lmrqnqn7hug5xecy6ob6ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2386304a-1dc1-a308-a22b-000052e65d7d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rwavdkltqjoi62kvugd5m576uyn4yrlxcpwril5simavxv7z6xrxrbyd.onion","pattern":"[url:value = 'http://rwavdkltqjoi62kvugd5m576uyn4yrlxcpwril5simavxv7z6xrxrbyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--273c7596-b3e3-e4f5-4d30-000070cf70ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://roadiewfshampm6ee56olxymma7iwlhecjgekezmfviua5zv6vkoqzad.onion","pattern":"[url:value = 'http://roadiewfshampm6ee56olxymma7iwlhecjgekezmfviua5zv6vkoqzad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cfac79a-ed4d-140b-f45e-0000dd21222f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rcdauehrqqex6pghmphfqz2jpuro2guhyenkolm2wld6bez344cbvmad.onion","pattern":"[url:value = 'http://rcdauehrqqex6pghmphfqz2jpuro2guhyenkolm2wld6bez344cbvmad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8369fa30-18d2-9035-b315-00000a207076","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pueblogmiocdtzj2of5556yzcl7frldcmqztxr6qcirgamzencolyhad.onion","pattern":"[url:value = 'http://pueblogmiocdtzj2of5556yzcl7frldcmqztxr6qcirgamzencolyhad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71bc0475-0c55-ea01-e866-000000f7d5c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pea3gvx6uyywne2f4dokv5cznsvzcayxsroai2ehozffkd576xfdm5yd.onion","pattern":"[url:value = 'http://pea3gvx6uyywne2f4dokv5cznsvzcayxsroai2ehozffkd576xfdm5yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--994abe47-bc59-a318-914e-00006decf5ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://muaedu3espka2gw5yqopmglslckonkeiduvymfkxjkggvtfqxkqydjqd.onion","pattern":"[url:value = 'http://muaedu3espka2gw5yqopmglslckonkeiduvymfkxjkggvtfqxkqydjqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ac06d71-7aee-71a8-fa54-0000ea7290a9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://msxiy2dutavkdwxbjge2lnut4x7ai4z2xb3ay324tqzxgryrhahbazad.onion","pattern":"[url:value = 'http://msxiy2dutavkdwxbjge2lnut4x7ai4z2xb3ay324tqzxgryrhahbazad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40706b3d-7f4b-d7ba-5a9d-00000ec9f07d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://modestorxo4s2vkjxo6xyue2lz7zefavtftb44apjojc5qhszq4dqnyd.onion","pattern":"[url:value = 'http://modestorxo4s2vkjxo6xyue2lz7zefavtftb44apjojc5qhszq4dqnyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e359771a-c6b6-ca24-50b1-0000970e658a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mruedu746yv2hnsfxwgglxpqbtlgfu7xwschm7w5cl2okanfjhu6vgad.onion","pattern":"[url:value = 'http://mruedu746yv2hnsfxwgglxpqbtlgfu7xwschm7w5cl2okanfjhu6vgad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0535a8f5-c928-af63-63f8-000077140652","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hyundaiyo7kxalnkcghqpkfvapevwicis3ytnnue6xqivuvuvi5cnhyd.onion","pattern":"[url:value = 'http://hyundaiyo7kxalnkcghqpkfvapevwicis3ytnnue6xqivuvuvi5cnhyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02141fb3-f759-3db4-aa84-0000e4eedf06","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://guardxxhqcmyddgikmgmdjpljhgwo7s4p7nnfljo54ogjd5vpu2labid.onion","pattern":"[url:value = 'http://guardxxhqcmyddgikmgmdjpljhgwo7s4p7nnfljo54ogjd5vpu2labid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a9429a6-ca27-6b2d-a104-00009aa7ac90","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://grsrobpx6t7j7eu4zi2xqm6fsrztaoptz4tie5xoamge6c3byeo462qd.onion","pattern":"[url:value = 'http://grsrobpx6t7j7eu4zi2xqm6fsrztaoptz4tie5xoamge6c3byeo462qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a44d8c0-42e5-61f0-35b6-00005d89195a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gaston333sywqydo4mudwjgbeieryqut4trd34kntirejrvwefp4wwyd.onion","pattern":"[url:value = 'http://gaston333sywqydo4mudwjgbeieryqut4trd34kntirejrvwefp4wwyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d5f9915-e96d-0e21-1918-0000b5cc599e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://frescayge2pa3epoytdocxz2vzagphzmrl6sqxrvrowftso4oqreh3ad.onion","pattern":"[url:value = 'http://frescayge2pa3epoytdocxz2vzagphzmrl6sqxrvrowftso4oqreh3ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64ff25a7-9bab-1011-c8e3-0000edb03145","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eperfs2u7bnyzpavtje6ruuwzatpzexdbjejdijgmgbe7wjje7lmkqyd.onion","pattern":"[url:value = 'http://eperfs2u7bnyzpavtje6ruuwzatpzexdbjejdijgmgbe7wjje7lmkqyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2889f7b7-23e0-9428-78c9-0000fbfee1ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://domaing5xpfmowjeah2z3icrxcbxd6e5mzk5gduohgzijrmm6lr3vxyd.onion","pattern":"[url:value = 'http://domaing5xpfmowjeah2z3icrxcbxd6e5mzk5gduohgzijrmm6lr3vxyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b749b32-0fdc-961e-489f-0000164492df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://comcomtjphtjl5mrtguatt5rgi4hymyrnzpqi6faztwmt6kw5tczqyad.onion","pattern":"[url:value = 'http://comcomtjphtjl5mrtguatt5rgi4hymyrnzpqi6faztwmt6kw5tczqyad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2f204a3-396c-e9d2-5672-00001897f001","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cnaaiic2skxbhnm35xmh3sohqgulpiyocj7yv7shrw4t34r5bvqbbayd.onion","pattern":"[url:value = 'http://cnaaiic2skxbhnm35xmh3sohqgulpiyocj7yv7shrw4t34r5bvqbbayd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbaf70ec-9661-2f0c-7335-00003dd8ab2e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://chattms45un5jmh23dak7udp2vt3dp25rlifqszvrhx2mb2psieyybid.onion","pattern":"[url:value = 'http://chattms45un5jmh23dak7udp2vt3dp25rlifqszvrhx2mb2psieyybid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b87d559-544c-53a7-c139-000018887713","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://canarodqqttgf2ofv7rkj74jvani7f2ftrbkmuw7zwyydlxikazimyqd.onion","pattern":"[url:value = 'http://canarodqqttgf2ofv7rkj74jvani7f2ftrbkmuw7zwyydlxikazimyqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c46a15e-8e3d-e3e1-0d98-0000baf72f65","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://accurfjvcphjtfogx42gpmoobffwqpqzvv2mf7smr6no62fy7ootjnid.onion","pattern":"[url:value = 'http://accurfjvcphjtfogx42gpmoobffwqpqzvv2mf7smr6no62fy7ootjnid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98fe1c87-0fca-c714-462d-0000ac7eca75","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nokoleakb76znymx443veg4n6fytx6spck6pc7nkr4dvfuygpub6jsid.onion/","pattern":"[url:value = 'http://nokoleakb76znymx443veg4n6fytx6spck6pc7nkr4dvfuygpub6jsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c733cbb3-cef0-0b6d-e78a-0000a4b06ab3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lirncvjfmdhv6samxvvlohfqx7jklfxoxj7xn3fh7qeabs3taemdsdqd.onion","pattern":"[url:value = 'http://lirncvjfmdhv6samxvvlohfqx7jklfxoxj7xn3fh7qeabs3taemdsdqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3c8642b-2fab-2780-317a-00005440082d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/nightsky","pattern":"[url:value = 'https://www.ransomlook.io/group/nightsky']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55b85fda-3c9d-5b7c-b717-00008cf18f38","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=Yzt_zOO8pDM","pattern":"[url:value = 'https://www.youtube.com/watch?v=Yzt_zOO8pDM']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfc06b00-d5f9-db2f-549f-0000e91b35cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cynet.com/attack-techniques-hands-on/threats-looming-over-the-horizon/","pattern":"[url:value = 'https://www.cynet.com/attack-techniques-hands-on/threats-looming-over-the-horizon/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d51df2ff-33b9-278c-a712-00000f629e70","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/night-sky-is-the-latest-ransomware-targeting-corporate-networks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/night-sky-is-the-latest-ransomware-targeting-corporate-networks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7577b9cd-ca84-9d59-6d8b-00009667b1a6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/cglyer/status/1480742363991580674","pattern":"[url:value = 'https://twitter.com/cglyer/status/1480742363991580674']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b9166ea-a738-71aa-5d08-0000e4ac7f00","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/nevada","pattern":"[url:value = 'https://www.ransomlook.io/group/nevada']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed84f593-b01b-be4b-aad9-0000883d112b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nevaffcwswjosddmw55qhn4u4secw42wlppzvf26k5onrlxjevm6avad.onion/","pattern":"[url:value = 'http://nevaffcwswjosddmw55qhn4u4secw42wlppzvf26k5onrlxjevm6avad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dff23627-36c7-0af2-8f40-000013db1751","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nevbackvzwfu5yu3gszap77bg66koadds6eln37gxdhdk4jdsbkayrid.onion/","pattern":"[url:value = 'http://nevbackvzwfu5yu3gszap77bg66koadds6eln37gxdhdk4jdsbkayrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e7d65ae-07dc-4994-ac63-000011aea739","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nevcorps5cvivjf6i2gm4uia7cxng5ploqny2rgrinctazjlnqr2yiyd.onion/","pattern":"[url:value = 'http://nevcorps5cvivjf6i2gm4uia7cxng5ploqny2rgrinctazjlnqr2yiyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7502ef8d-661f-d781-5f22-00002a734307","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/netwalker","pattern":"[url:value = 'https://www.ransomlook.io/group/netwalker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d22da5b9-169d-1f27-7bac-0000a856943a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://zero2auto.com/2020/05/19/netwalker-re/","pattern":"[url:value = 'https://zero2auto.com/2020/05/19/netwalker-re/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c93c4b2-925d-ea54-b220-0000f43cbf38","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://zengo.com/bitcoin-ransomware-detective-ucsf/","pattern":"[url:value = 'https://zengo.com/bitcoin-ransomware-detective-ucsf/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4176c0c-26a4-175e-58da-0000b7f71d42","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zeit.de/digital/2021-06/cybercrime-extortion-internet-spyware-ransomware-police-prosecution-hackers","pattern":"[url:value = 'https://www.zeit.de/digital/2021-06/cybercrime-extortion-internet-spyware-ransomware-police-prosecution-hackers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb7ea711-b109-6502-07b0-0000bf69fa07","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=q8of74upT_g","pattern":"[url:value = 'https://www.youtube.com/watch?v=q8of74upT_g']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1e18cd3-8037-8463-7169-00003b82cbbf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ucsf.edu/news/2020/06/417911/update-it-security-incident-ucsf","pattern":"[url:value = 'https://www.ucsf.edu/news/2020/06/417911/update-it-security-incident-ucsf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25a114bd-8eb3-d92f-9b93-0000b68f6ce3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-two-of-three/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-two-of-three/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e67bd1b-fca7-f941-cbde-000066b82dbf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-three-of-three/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-three-of-three/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0571822d-c55d-ff17-54b9-0000ea542b7b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-one-of-three/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-one-of-three/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3154d5c4-e328-4f4b-9ca2-0000f299dfb4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/take-a-netwalk-on-the-wild-side/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/take-a-netwalk-on-the-wild-side/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--038f9544-1eb4-9d63-4c6e-0000f2d4805f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.justice.gov/usao-mdfl/press-release/file/1360846/download","pattern":"[url:value = 'https://www.justice.gov/usao-mdfl/press-release/file/1360846/download']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5d3268d-ec8c-8b00-61e8-0000c19fcde2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.justice.gov/opa/pr/department-justice-launches-global-action-against-netwalker-ransomware","pattern":"[url:value = 'https://www.justice.gov/opa/pr/department-justice-launches-global-action-against-netwalker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e558d035-fa98-5449-9c94-0000325e7ee9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.incibe-cert.es/blog/ransomware-netwalker-analisis-y-medidas-preventivas","pattern":"[url:value = 'https://www.incibe-cert.es/blog/ransomware-netwalker-analisis-y-medidas-preventivas']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8076be50-96d8-c34a-2eaf-00005bea3ca1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/media/news/2020/200929-2.pdf","pattern":"[url:value = 'https://www.ic3.gov/media/news/2020/200929-2.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b83bdd1-1590-319f-9b49-00005de7185d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/","pattern":"[url:value = 'https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e400363-405d-4050-bcb5-0000e31622ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/netwalker-ransomware-infecting-users-via-coronavirus-phishing/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/netwalker-ransomware-infecting-users-via-coronavirus-phishing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f88f0b5-7956-484b-ea2f-0000c03c93a5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/netwalker-ransomware-affiliate-sentenced-to-80-months-in-prison/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/netwalker-ransomware-affiliate-sentenced-to-80-months-in-prison/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fe34064-d6db-42b9-3894-000072d2daea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/michigan-state-university-network-breached-in-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/michigan-state-university-network-breached-in-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--567b9ea9-c423-bd29-f89b-00000aca2c37","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/mailto-netwalker-ransomware-targets-enterprise-networks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/mailto-netwalker-ransomware-targets-enterprise-networks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17342427-ad29-c283-f40f-0000192800cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cf01497-62be-5795-8939-00009f39ce1e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ec8041f-67fc-bbbf-fc8d-000012df2efb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/netwalker-ransomware-group-enters-advanced-targeting-game","pattern":"[url:value = 'https://www.advanced-intel.com/post/netwalker-ransomware-group-enters-advanced-targeting-game']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--344ec97c-ba81-5486-5c20-000022c1d43e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/","pattern":"[url:value = 'https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--825f0f97-ad06-07e8-2440-00007066bbf3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://tccontre.blogspot.com/2020/05/netwalker-ransomware-api-call.html","pattern":"[url:value = 'https://tccontre.blogspot.com/2020/05/netwalker-ransomware-api-call.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d794f553-3333-55a1-edf8-000004259735","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://seguranca-informatica.pt/netwalker-ransomware-full-analysis/","pattern":"[url:value = 'https://seguranca-informatica.pt/netwalker-ransomware-full-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--776aa49e-4390-987c-bdb8-000064f72188","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://s3.documentcloud.org/documents/21199896/vachon-desjardins-court-docs.pdf","pattern":"[url:value = 'https://s3.documentcloud.org/documents/21199896/vachon-desjardins-court-docs.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--088154b2-57c0-e13a-67cc-000076c4443e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b706576-22f1-4fdb-0f57-0000ec85bf19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lopqto.me/posts/automated-dynamic-import-resolving","pattern":"[url:value = 'https://lopqto.me/posts/automated-dynamic-import-resolving']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--460cea94-4384-3e6e-3daf-0000a34b0289","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2021/01/arrest-seizures-tied-to-netwalker-ransomware","pattern":"[url:value = 'https://krebsonsecurity.com/2021/01/arrest-seizures-tied-to-netwalker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99f235a3-99ea-9688-4d44-0000decaf788","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2019/09/koko-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2019/09/koko-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27c7dfc2-9f32-39b8-12f5-000065fd8964","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://danusminimus.github.io/Zero2Auto-Netwalker-Walkthrough/","pattern":"[url:value = 'https://danusminimus.github.io/Zero2Auto-Netwalker-Walkthrough/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b19a8da-e24c-842b-a9f2-000076dd6b02","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cert-agid.gov.it/news/netwalker-il-ransomware-che-ha-beffato-lintera-community/","pattern":"[url:value = 'https://cert-agid.gov.it/news/netwalker-il-ransomware-che-ha-beffato-lintera-community/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f06dd6e-4457-21cc-fc0f-00006bcabddc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2021/03/zerologon-to-ransomware","pattern":"[url:value = 'https://blogs.blackberry.com/en/2021/03/zerologon-to-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5d46662-fb34-06be-c03d-00000d3c80f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://0x00-0x7f.github.io/Netwalker-from-Powershell-reflective-loader-to-injected-Dll/","pattern":"[url:value = 'https://0x00-0x7f.github.io/Netwalker-from-Powershell-reflective-loader-to-injected-Dll/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c8d93ee-129f-0bc3-4b6f-00009e6f9ecc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ncsc.org/trends/monthly-trends-articles/2020/netwalker-ransomware","pattern":"[url:value = 'https://www.ncsc.org/trends/monthly-trends-articles/2020/netwalker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e426666d-b006-8931-2055-000055d354e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/cybereason-vs.-netwalker-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/cybereason-vs.-netwalker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e205221-c6b6-9848-d7bf-00007e1a7619","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/netwalker-ransomware-suspect-charged/163405","pattern":"[url:value = 'https://threatpost.com/netwalker-ransomware-suspect-charged/163405']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c368169-dc0e-933f-6463-00005e5289de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion/","pattern":"[url:value = 'http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--192a76d2-0347-e359-5ade-0000d8a5b34f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/n3tworm","pattern":"[url:value = 'https://www.ransomlook.io/group/n3tworm']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42280715-b4c0-d4be-af6c-0000946f1a4a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/mydecryptor","pattern":"[url:value = 'https://www.ransomlook.io/group/mydecryptor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--597afa28-9fe1-8661-addf-00009cabc3ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/monti","pattern":"[url:value = 'https://www.ransomlook.io/group/monti']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--280642e9-1650-033b-b163-00007969261b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cls2wzky5vxgu54fg4fqdj4q4olyvmwt6rinmtgqsq5d3vubv7bdzgqd.onion/","pattern":"[url:value = 'http://cls2wzky5vxgu54fg4fqdj4q4olyvmwt6rinmtgqsq5d3vubv7bdzgqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be07a94c-f955-3495-1448-00006c57a3b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://il6jcce6f5htppc3smu4olpt5pz3akdg5h7k7tb4n45jixxu2o2oxlid.onion/","pattern":"[url:value = 'http://il6jcce6f5htppc3smu4olpt5pz3akdg5h7k7tb4n45jixxu2o2oxlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e2119ef-2051-482f-67f7-000081a16b0b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://monti5o7lvyrpyk26lqofnfvajtyqruwatlfaazgm3zskt3xiktudwid.onion","pattern":"[url:value = 'http://monti5o7lvyrpyk26lqofnfvajtyqruwatlfaazgm3zskt3xiktudwid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff41c56d-7743-70c1-fcc6-0000032f4f2f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion","pattern":"[url:value = 'http://qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2388e53-2123-c50d-34c7-0000178ed8ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion/chat","pattern":"[url:value = 'http://myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion/chat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e87dc5c-26ad-0931-3503-0000cf810ed4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://v4httzsp6ri6xcw7lpmdduvhce5avtla3yocfru5suxpgcgo7rw7slyd.onion/","pattern":"[url:value = 'http://v4httzsp6ri6xcw7lpmdduvhce5avtla3yocfru5suxpgcgo7rw7slyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18276f16-fd72-aaea-b193-0000abb25877","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yyn3h2lnr5joqebus5syb2p3fzdms7avulvsn3m3gsdvwtgu2ow5c6ad.onion/","pattern":"[url:value = 'http://yyn3h2lnr5joqebus5syb2p3fzdms7avulvsn3m3gsdvwtgu2ow5c6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8780ed8e-f14a-5c9e-0fff-000019b57d22","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t4h4hbkrrbrrfkbf6luhnewykjr52gkdmgfr6hbeeub5t2rcyhb4buad.onion/","pattern":"[url:value = 'http://t4h4hbkrrbrrfkbf6luhnewykjr52gkdmgfr6hbeeub5t2rcyhb4buad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c962a9f-6d72-5f63-39aa-0000743e4006","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://drfxoorlgu5n4c4uhnfli7saprnl2p46i36duhyehmfp7ysn44e3quid.onion/","pattern":"[url:value = 'http://drfxoorlgu5n4c4uhnfli7saprnl2p46i36duhyehmfp7ysn44e3quid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c40d7c6-d5ee-9393-4355-0000d9f1bd48","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bvxhv3zfewf5jx4gcrsxrwbuwmjggffxjyv42vwj6b6u2clmgchxtfid.onion/","pattern":"[url:value = 'http://bvxhv3zfewf5jx4gcrsxrwbuwmjggffxjyv42vwj6b6u2clmgchxtfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a65ed341-09d0-a0e8-109b-0000a3e848d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://usmrktigxirv2qvpkwjr5n3pxz5hpsucffzujuo7e6f3y6se7uiqzwyd.onion/","pattern":"[url:value = 'http://usmrktigxirv2qvpkwjr5n3pxz5hpsucffzujuo7e6f3y6se7uiqzwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0ec64df-86cf-69fa-11b2-0000da8e3783","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://trqm74keteqm7jdathr2fgljf5tdhtifocoii4inmdu66ekpaotihvyd.onion/","pattern":"[url:value = 'http://trqm74keteqm7jdathr2fgljf5tdhtifocoii4inmdu66ekpaotihvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06c412b8-494a-f06b-eb46-0000dbc69c7a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://363zyixg32bdudpakmd4n4bclbprcqrkyvdssv6yamozfurodktss2qd.onion/","pattern":"[url:value = 'http://363zyixg32bdudpakmd4n4bclbprcqrkyvdssv6yamozfurodktss2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20dd888a-8490-c4ea-a7f6-000013ec67f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gchf5ohuxo36metdnt3hfdz6m4up3pmv6t6m63llvldtnh57guwnp4qd.onion/","pattern":"[url:value = 'http://gchf5ohuxo36metdnt3hfdz6m4up3pmv6t6m63llvldtnh57guwnp4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9827f3bb-14d9-1e15-0d80-0000a7e653d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://edaus74qljecooagcvcg67quldd2hwokkr5zqj5jtdeuidgjoesvwdad.onion/","pattern":"[url:value = 'http://edaus74qljecooagcvcg67quldd2hwokkr5zqj5jtdeuidgjoesvwdad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12a08175-8d35-ca60-e9d7-00005202e5e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://egtqjenfxq7g6sqnjknww3tsnlutzqlq747cf73ni3xsfxzqqz2f5qad.onion/","pattern":"[url:value = 'http://egtqjenfxq7g6sqnjknww3tsnlutzqlq747cf73ni3xsfxzqqz2f5qad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb4dd06a-59da-c6fe-2798-00003863f391","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jblxfrssnygh7bsoyict5wccgahvqp6tauncixr3y3dxypidiqy4tjyd.onion/","pattern":"[url:value = 'http://jblxfrssnygh7bsoyict5wccgahvqp6tauncixr3y3dxypidiqy4tjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e629c944-6f0f-9669-4540-0000db6f943f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://oiatmncwdk6jnavutic5zusl4sttwschx7nicvqykluyckekex3zqaad.onion/","pattern":"[url:value = 'http://oiatmncwdk6jnavutic5zusl4sttwschx7nicvqykluyckekex3zqaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aaf7e35-8c32-4869-b1d5-0000210388be","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fzuaswymt34cbkneudijgqrzkalrgpsyfbo6uuodoeifwiqf3cwqscid.onion/","pattern":"[url:value = 'http://fzuaswymt34cbkneudijgqrzkalrgpsyfbo6uuodoeifwiqf3cwqscid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--371b7223-bb74-84bf-d6df-000059116fb8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion/","pattern":"[url:value = 'http://mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50ccb603-5c6a-dd6c-da1b-0000d67d7c02","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/monte","pattern":"[url:value = 'https://www.ransomlook.io/group/monte']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9de9de9b-6252-8030-8ad1-0000c35da06f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://monteoamwxlutyovf7oxeviwjlbu3vbgdmkncecl2ydteqncrmcv67yd.onion/catalog/","pattern":"[url:value = 'http://monteoamwxlutyovf7oxeviwjlbu3vbgdmkncecl2ydteqncrmcv67yd.onion/catalog/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fdf781c-6015-0230-ab7f-000010c0236e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://monteoamwxlutyovf7oxeviwjlbu3vbgdmkncecl2ydteqncrmcv67yd.onion/","pattern":"[url:value = 'http://monteoamwxlutyovf7oxeviwjlbu3vbgdmkncecl2ydteqncrmcv67yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cd8733e-9d8e-02d5-3d2b-00005699fdbb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/moisha","pattern":"[url:value = 'https://www.ransomlook.io/group/moisha']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd0ca3fd-93a7-7805-a6b1-0000c5f60691","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://moishddxqnpdxpababec6exozpl2yr7idfhdldiz5525ao25bmasxhid.onion","pattern":"[url:value = 'http://moishddxqnpdxpababec6exozpl2yr7idfhdldiz5525ao25bmasxhid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb513f4c-833f-3622-0230-0000c9447aef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/midas","pattern":"[url:value = 'https://www.ransomlook.io/group/midas']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d9b797f-492d-2d1a-92ef-000032fbe2ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/midas-ransomware-tracing-evolution-thanos-ransomware-variants","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/midas-ransomware-tracing-evolution-thanos-ransomware-variants']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04846e9d-1ce7-906b-092f-000010166f19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityboulevard.com/2022/03/midas-ransomware-tracing-the-evolution-of-thanos-ransomware-variants/","pattern":"[url:value = 'https://securityboulevard.com/2022/03/midas-ransomware-tracing-the-evolution-of-thanos-ransomware-variants/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cbde204-38b1-3e61-7f8d-00002ae7b3b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2022/01/25/windows-services-lay-the-groundwork-for-a-midas-ransomware-attack/","pattern":"[url:value = 'https://news.sophos.com/en-us/2022/01/25/windows-services-lay-the-groundwork-for-a-midas-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65e3f398-b75a-4476-b00d-000001e4ad3f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/mbc","pattern":"[url:value = 'https://www.ransomlook.io/group/mbc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e866e727-93f5-1f62-3e94-00007c9ab465","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/mallox","pattern":"[url:value = 'https://www.ransomlook.io/group/mallox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e4f4812-4d42-ac59-38d7-00003517abe2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin","pattern":"[url:value = 'http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6d0619f-a266-86d1-ae9d-0000f80c3297","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wtyafjyizleuw4yhepmdsrcfjwmtiysunos6ixchw3r5d7eeimw2rrid.onion","pattern":"[url:value = 'http://wtyafjyizleuw4yhepmdsrcfjwmtiysunos6ixchw3r5d7eeimw2rrid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f81cb21-38f4-b20d-2cc3-00007f48d415","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/lv","pattern":"[url:value = 'https://www.ransomlook.io/group/lv']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be87bef0-7dd9-7a59-9761-00004828a375","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityaffairs.co/wordpress/119306/malware/lv-ransomware-repurposed-revil-binary.html","pattern":"[url:value = 'https://securityaffairs.co/wordpress/119306/malware/lv-ransomware-repurposed-revil-binary.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceac7a9c-6544-34e7-14f2-00000acf7a4b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l55ysq5qjpin2vq23ul3gc3h62vp4wvenl7ov6fcn65vir7kc7gb5fyd.onion/","pattern":"[url:value = 'http://l55ysq5qjpin2vq23ul3gc3h62vp4wvenl7ov6fcn65vir7kc7gb5fyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2083a0a-e683-4904-0887-0000d29396f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion/","pattern":"[url:value = 'http://rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1dff7d9-669b-adf5-07a8-00003bbff3cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/lolnek","pattern":"[url:value = 'https://www.ransomlook.io/group/lolnek']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c913eaba-476b-463b-3bfb-00001c906419","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion","pattern":"[url:value = 'http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3935227c-7674-eb4e-54e3-0000589c56a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://u2kqti2utfaiefucegnmd6yh6hledbsfanaehhnnn3q5usk6bvndahqd.onion","pattern":"[url:value = 'http://u2kqti2utfaiefucegnmd6yh6hledbsfanaehhnnn3q5usk6bvndahqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3edb33dc-48cb-3c92-70e2-0000958fe7a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://34vm2smykaqtzzzm4bgycfzg5fwyhhksrkpahdbiswmmuwuu7hmvuvqd.onion","pattern":"[url:value = 'http://34vm2smykaqtzzzm4bgycfzg5fwyhhksrkpahdbiswmmuwuu7hmvuvqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--187191a3-4ace-7fa7-fc7d-000060105c7e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tzw7ckhurmxgcpajx6gy57dkrysl2sigfrt6nk4a3rvedfldigtor7ad.onion","pattern":"[url:value = 'http://tzw7ckhurmxgcpajx6gy57dkrysl2sigfrt6nk4a3rvedfldigtor7ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79a46ee9-ed77-6ef5-9dba-000078808f20","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/","pattern":"[url:value = 'http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--619ce65f-50f7-e0a4-c891-0000620ba747","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/lockbit3","pattern":"[url:value = 'https://www.ransomlook.io/group/lockbit3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36faae49-146c-52ef-d05e-0000e6d179b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/lockbit-ransomware-proliferates-globally/168746","pattern":"[url:value = 'https://threatpost.com/lockbit-ransomware-proliferates-globally/168746']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5eda1701-80ab-e5e8-8f69-00009631909b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion/","pattern":"[url:value = 'http://lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c61420f7-9886-2866-0f15-0000cba3d0e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion/","pattern":"[url:value = 'http://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--968b601e-17b4-4f1a-ca2b-0000fd59fa4d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion/","pattern":"[url:value = 'http://lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ff9b1af-4069-afa6-ebfd-00001fed8a8d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion/","pattern":"[url:value = 'http://lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a89884ff-0991-791d-7410-0000ebd537d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion/","pattern":"[url:value = 'http://lockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4064495a-33c4-22de-6ffa-0000fe39bf85","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitbvcwegcbou4fulv3iy3bpwh2do3y243w2riwbgcdpl3hd3uyd.onion/","pattern":"[url:value = 'http://lockbitbvcwegcbou4fulv3iy3bpwh2do3y243w2riwbgcdpl3hd3uyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98eb5c40-c436-cc8a-354e-0000a53ae15e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit7xn7nqc5f5gfhv6qrf46xlh65lscuzctwnmomthcigu2m3tad.onion/","pattern":"[url:value = 'http://lockbit7xn7nqc5f5gfhv6qrf46xlh65lscuzctwnmomthcigu2m3tad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a4ec4e3-fb42-b8ed-f67b-0000612055a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitpntsng25yxacx5jqdccvoqd5qtyzzximljfskvtk6ektjhvad.onion/","pattern":"[url:value = 'http://lockbitpntsng25yxacx5jqdccvoqd5qtyzzximljfskvtk6ektjhvad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7d05986-4cc6-69ae-7e4c-0000fc6416a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitpn7doehfdzu3r2orcibdx6njq62aavkr4hgh3p6rednr5gfad.onion/","pattern":"[url:value = 'http://lockbitpn7doehfdzu3r2orcibdx6njq62aavkr4hgh3p6rednr5gfad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5239580e-a217-3db8-ebd9-0000d38f37a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitpn4nmflibn4cooh4sydie6bpoy33tbxa3rjebryxc5vblkwyd.onion/","pattern":"[url:value = 'http://lockbitpn4nmflibn4cooh4sydie6bpoy33tbxa3rjebryxc5vblkwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7f90b0c-2c56-db8d-b1c1-0000daf92f5e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitfsxt2gdyz72harnb7qa5qa6sf73bvy7wz65fuiw7vlxarujid.onion/","pattern":"[url:value = 'http://lockbitfsxt2gdyz72harnb7qa5qa6sf73bvy7wz65fuiw7vlxarujid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d3eb6c6-96ae-9de4-0f44-000012aabb94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitfsnvvv5dbubfbhb4qo23olw5n3a2pqs72p3yh2g6prkxrhvad.onion/","pattern":"[url:value = 'http://lockbitfsnvvv5dbubfbhb4qo23olw5n3a2pqs72p3yh2g6prkxrhvad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b059bfc-5232-3606-cdd6-0000aa77686f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitfshjx7xrlafzhohinfu3theolrjakrlxoduwk65d755yahuqd.onion/","pattern":"[url:value = 'http://lockbitfshjx7xrlafzhohinfu3theolrjakrlxoduwk65d755yahuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97ff4faf-e30e-e4a1-a87c-00007cb1e323","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/","pattern":"[url:value = 'http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78c8e057-dc86-a6e7-2690-00005644c48d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion/","pattern":"[url:value = 'http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63011b2e-729a-2018-2855-00001894d52b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion/","pattern":"[url:value = 'http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08495a25-154d-cd22-5ce6-000085a48d47","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion/","pattern":"[url:value = 'http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0edb576-5a2e-fc4f-250f-0000e30395d4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion/","pattern":"[url:value = 'http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93479a75-7b79-c924-1a76-0000c55a5925","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion/","pattern":"[url:value = 'http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56c30ae1-1d7a-6552-3b35-0000a4d484ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion/","pattern":"[url:value = 'http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1f1f64c-e123-3a5d-1512-000005aab56a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion/","pattern":"[url:value = 'http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--912da668-0091-610a-4a3f-00000f3098bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion/","pattern":"[url:value = 'http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0cd7711-4e05-4762-31bd-00006c39dd35","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion/","pattern":"[url:value = 'http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91f8cee8-c750-5094-0cfe-0000b59844c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/ec_page3.php","pattern":"[url:value = 'http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/ec_page3.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--509e1008-1cbd-7e86-8563-0000a710b854","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion/","pattern":"[url:value = 'http://lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ee54b8-feaa-3021-c837-0000a65ebd1e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion/","pattern":"[url:value = 'http://lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9c711aa-a5aa-6d49-839b-00007640e9b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion/","pattern":"[url:value = 'http://lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae9d90cc-a75e-f77c-6399-0000933c4fc7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion/","pattern":"[url:value = 'http://lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ae03231-0f38-289f-b470-00009ca57c9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion/","pattern":"[url:value = 'http://lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--395899cd-1716-f392-203d-0000a832a811","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion/","pattern":"[url:value = 'http://lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3c26d23-e489-7ac5-4f8b-00006b440bd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion/","pattern":"[url:value = 'http://lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--784586e6-1cc0-25ec-2069-000032766316","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion/","pattern":"[url:value = 'http://lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--406687ab-2455-5588-7587-0000f1483d8e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion/","pattern":"[url:value = 'http://lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b1d3231-f21a-a100-5125-00005fa9f2ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion/","pattern":"[url:value = 'http://lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96dcd93d-4023-0c70-cfa5-0000075ad352","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion/","pattern":"[url:value = 'http://lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98341f11-f7f0-0145-a9e1-0000057c765a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion/","pattern":"[url:value = 'http://lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9be19a41-35da-7ebe-312d-0000d98d12bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion/","pattern":"[url:value = 'http://lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d526269b-6b12-c5a6-8b0d-000014e314b3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion/","pattern":"[url:value = 'http://lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f71d0da9-fb03-ee5c-94ef-0000f4773122","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion/","pattern":"[url:value = 'http://lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44855e41-4760-3b79-a738-00003cc4a568","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion/","pattern":"[url:value = 'http://lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ece24cd6-f4a4-1328-1fc1-00006fba8f9d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion/","pattern":"[url:value = 'http://lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81aedc15-ca00-1bbf-b905-0000f2782048","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion/","pattern":"[url:value = 'http://lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fc3d280-6b01-1293-cdfb-0000a4206a26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion/","pattern":"[url:value = 'http://lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02e3010d-5e78-d556-89f8-0000dcb6547c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/pgp.txt","pattern":"[url:value = 'http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/pgp.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27e912da-c2ee-455b-aadc-0000d54adf60","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit3hdu7e4sv3ecg6mmqmeihjcizebcxic6t4eqwar6f2e7rxpad.onion","pattern":"[url:value = 'http://lockbit3hdu7e4sv3ecg6mmqmeihjcizebcxic6t4eqwar6f2e7rxpad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd5c4c4f-796b-01e9-78a2-0000b1a19238","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit4r3ly63w22jhkg33emtqwxw436wkftosscvdal2prdlwzknyd.onion","pattern":"[url:value = 'http://lockbit4r3ly63w22jhkg33emtqwxw436wkftosscvdal2prdlwzknyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5cc3cad-56dc-6387-754f-0000c4f77c0c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit7bb4b6n27feok2rc7ri75udaqkfppjvtkxlwh7qldygbopmad.onion","pattern":"[url:value = 'http://lockbit7bb4b6n27feok2rc7ri75udaqkfppjvtkxlwh7qldygbopmad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cf24d64-297b-2299-0401-0000adcc8426","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit7xn7nqc5f5gfhv6qrf46xh65lscuzctwnmomthcigu2m3tad.onion","pattern":"[url:value = 'http://lockbit7xn7nqc5f5gfhv6qrf46xh65lscuzctwnmomthcigu2m3tad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--209cfd2a-a1b8-cb87-f958-00009907c627","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitb63zs7f4rdjcsn2etkqaswurk6hh55sa2ojeilxcnwf6qbkqd.onion","pattern":"[url:value = 'http://lockbitb63zs7f4rdjcsn2etkqaswurk6hh55sa2ojeilxcnwf6qbkqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5760622e-690f-e44f-cc2e-0000dcdc466e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitbtdk33k75rsl6uhn6bewd5g6z3hp42z6vb2hfk54oja55h7id.onion","pattern":"[url:value = 'http://lockbitbtdk33k75rsl6uhn6bewd5g6z3hp42z6vb2hfk54oja55h7id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--029d5fdb-848a-0c06-d71a-0000c637311f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitdzjxsgyacnmfte6nfgqfcyhedkduimi4tsajvrwi4ljbos7id.onion","pattern":"[url:value = 'http://lockbitdzjxsgyacnmfte6nfgqfcyhedkduimi4tsajvrwi4ljbos7id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--448eed2f-4962-6a99-34f6-000026b767b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitehorki5kh6s3n27hi3serhzr7htlshfqyg5ex32dyr5efhfyd.onion","pattern":"[url:value = 'http://lockbitehorki5kh6s3n27hi3serhzr7htlshfqyg5ex32dyr5efhfyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa5492af-fb2a-41ef-ddd1-00000923227c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitffcjqi2wpwhjgubkjihhc7seaujqgzscvwvdiftunl6hn5oyd.onion","pattern":"[url:value = 'http://lockbitffcjqi2wpwhjgubkjihhc7seaujqgzscvwvdiftunl6hn5oyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2008785-2e41-c5dc-9767-0000674a929b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion","pattern":"[url:value = 'http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d591cd89-6b39-e340-a3a8-0000e3ce6fa5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion","pattern":"[url:value = 'http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ff5927a-8317-5609-ce24-000023b0465c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion","pattern":"[url:value = 'http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--158c9a87-1405-b354-6238-00007face525","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion","pattern":"[url:value = 'http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73edb80a-b3f9-0f42-2a27-00000b467a7e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion","pattern":"[url:value = 'http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--722f2273-cfab-a734-4d99-0000aea2e8ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion","pattern":"[url:value = 'http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5524c55a-0e3a-2057-23a9-00001fd32947","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion","pattern":"[url:value = 'http://ockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4c33743-7ca3-cf66-2e35-000014c045bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/","pattern":"[url:value = 'http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7164cf06-b2df-1883-04a5-0000f64657ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/","pattern":"[url:value = 'http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d0a5e41-159d-2bc6-2b5f-000041c33bd0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitapt.uz","pattern":"[url:value = 'http://lockbitapt.uz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73883a93-7f36-14b4-12a1-0000cde9961f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion/","pattern":"[url:value = 'http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1006656-db45-265c-971e-0000afe0db2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/lilith","pattern":"[url:value = 'https://www.ransomlook.io/group/lilith']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06a4bee1-7921-e10f-a0ce-0000f7ab1bf8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://yoroi.company/research/a-deep-dive-into-eternity-group-a-new-emerging-cyber-threat/","pattern":"[url:value = 'https://yoroi.company/research/a-deep-dive-into-eternity-group-a-new-emerging-cyber-threat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c789b1a-7270-4679-d2a3-000029acc9db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/594/original/Network_IOCs_list_for_coverage.txt?1625657479","pattern":"[url:value = 'https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/594/original/Network_IOCs_list_for_coverage.txt?1625657479']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3877aa6-4a77-f57a-a3b6-00008f8fe360","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/592/original/Hashes_IOCs_for_coverage.txt","pattern":"[url:value = 'https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/592/original/Hashes_IOCs_for_coverage.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--126c7c7b-b2d2-08f6-7fbd-00006b5cd984","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388","pattern":"[url:value = 'https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5da05432-6c2a-7b05-e512-0000db984fb5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf","pattern":"[url:value = 'https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bc11b38-04a3-b8a4-1994-00009b5bc811","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/werkamsus/Lilith","pattern":"[url:value = 'https://github.com/werkamsus/Lilith']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e398e37-8e9c-1ecf-61fc-00002f578b18","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/operation-endtrade-finding-multi-stage-backdoors-that-tick/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/operation-endtrade-finding-multi-stage-backdoors-that-tick/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3d3fd83-d6f3-9dbb-b70d-0000a9cdfc5a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2022/07/12/new-ransomware-groups-on-the-rise/","pattern":"[url:value = 'https://blog.cyble.com/2022/07/12/new-ransomware-groups-on-the-rise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0168c48-e0d2-7770-cd93-0000e91dfb10","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion/","pattern":"[url:value = 'http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a98e7454-7e0f-2e67-b0fc-0000de90d1be","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/d/lapsus-group-social-engineering.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/d/lapsus-group-social-engineering.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--137d3fe2-6ba5-9788-4654-0000287a66ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-083a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-083a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b8af9e5-1636-8e8c-fb88-0000934c67a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lapsus-hacking-group-claims-breach-of-microsoft/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lapsus-hacking-group-claims-breach-of-microsoft/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2bb1143-ad19-b998-cadf-000089c03f91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/lapsus$","pattern":"[url:value = 'https://www.ransomlook.io/group/lapsus$']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38ee00a4-9e7c-0758-00f1-00006db57f55","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lapsus.bz/","pattern":"[url:value = 'https://lapsus.bz/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34d860dc-f2ad-8099-596b-00009d10b88f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tw3wa46dm7avezfqdc3ei5ckxm5cvvz6fae73h3pbxjvrokbxmhkk7yd.onion/","pattern":"[url:value = 'http://tw3wa46dm7avezfqdc3ei5ckxm5cvvz6fae73h3pbxjvrokbxmhkk7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55164dc0-698b-b33d-967d-0000d4da57a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vunk5dvj634b75xpsj64zvhmglv6xzajcanj4g2gxo34q6ot7il3axqd.onion/","pattern":"[url:value = 'http://vunk5dvj634b75xpsj64zvhmglv6xzajcanj4g2gxo34q6ot7il3axqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13c35367-40c9-a972-7390-00002a150585","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lapsus.by/","pattern":"[url:value = 'https://lapsus.by/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7e46fcd-66d0-42e3-899e-000028031103","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://t.me/minsaudebr","pattern":"[url:value = 'https://t.me/minsaudebr']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb77c10d-1c9c-2167-2526-0000e02ed4d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityaffairs.com/129992/hacktivism/kelvin-security-group-claims-breaches.html","pattern":"[url:value = 'https://securityaffairs.com/129992/hacktivism/kelvin-security-group-claims-breaches.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4fe978e-98a7-92fd-bf60-00007bd8b026","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cybernews.com/news/kelvin-security-claims-data-breach-on-european-govt-agencies/","pattern":"[url:value = 'https://cybernews.com/news/kelvin-security-claims-data-breach-on-european-govt-agencies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c37cf16-6963-c1c5-c10b-00001802f4ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hackread.com/kelvin-security-hacks-30-govt-universities/","pattern":"[url:value = 'https://www.hackread.com/kelvin-security-hacks-30-govt-universities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7880968b-e794-43a2-279a-0000d3b51f0b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/kelvin","pattern":"[url:value = 'https://www.ransomlook.io/group/kelvin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--735742c4-fc31-3dad-5305-000055909291","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/justice_blade","pattern":"[url:value = 'https://www.ransomlook.io/group/justice_blade']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51211cf0-893c-253f-d92a-0000ebac7b2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://justice-blade.io","pattern":"[url:value = 'https://justice-blade.io']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f703ae3-2b2f-6133-7aa2-00002a7e847d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/icefire","pattern":"[url:value = 'https://www.ransomlook.io/group/icefire']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f8161af-743b-1f6d-638a-0000c00bb63c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nxx3cy6aee2s53v7v5pxrfv7crfssw7hmgejbj47cv6xuak3bgncllqd.onion/","pattern":"[url:value = 'http://nxx3cy6aee2s53v7v5pxrfv7crfssw7hmgejbj47cv6xuak3bgncllqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c17b9484-cae7-227e-9dca-0000c0b01199","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hotarus-ransomware-gang-hacks-ecuadorian-government-agencies-banks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hotarus-ransomware-gang-hacks-ecuadorian-government-agencies-banks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e03894a7-1b74-e5de-88ae-0000156ef92b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityaffairs.com/117387/cyber-crime/hotarus-cybercrime-group.html","pattern":"[url:value = 'https://securityaffairs.com/117387/cyber-crime/hotarus-cybercrime-group.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d57418a0-35e4-e573-c203-0000f87d3567","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/hotarus","pattern":"[url:value = 'https://www.ransomlook.io/group/hotarus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--532b0646-4921-1361-7860-00007a87ea49","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/haron","pattern":"[url:value = 'https://www.ransomlook.io/group/haron']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4709a4a6-4fe6-d0cc-a894-00009a34a572","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/ransomware-gangs-haron-blackmatter/168212","pattern":"[url:value = 'https://threatpost.com/ransomware-gangs-haron-blackmatter/168212']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c63473c8-364d-e9a9-77d6-00004e6c5c10","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/new-haron-ransomware-gang-emerges-borrowing-from-avaddon-and-thanos","pattern":"[url:value = 'https://therecord.media/new-haron-ransomware-gang-emerges-borrowing-from-avaddon-and-thanos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8648fd65-ac3d-19cd-e5e1-0000637f1ab1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/groove","pattern":"[url:value = 'https://www.ransomlook.io/group/groove']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--811dca32-9162-3347-720e-0000818a27cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates","pattern":"[url:value = 'https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b40a65b7-ea6a-b143-a72f-0000cc38db73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/groove-gang-ransomware-babuk-revil-blackmatter","pattern":"[url:value = 'https://intel471.com/blog/groove-gang-ransomware-babuk-revil-blackmatter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe5bdf7b-f913-95d5-154d-000056cb934d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/i/grief-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/i/grief-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c9fb612-9fe7-e219-d473-000039fbb577","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.treasury.gov/news/press-releases/jy0333","pattern":"[url:value = 'https://www.treasury.gov/news/press-releases/jy0333']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36fa7ca3-1967-79aa-824d-0000f1aa8b59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-243a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-243a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--825b2811-91c9-9384-8b10-00004876aabd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/grief-ransomware-linked-to-evil-corp-hackers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/grief-ransomware-linked-to-evil-corp-hackers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--779045cf-8e96-0fc0-4480-00001384bca0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/grief","pattern":"[url:value = 'https://www.ransomlook.io/group/grief']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cc53c57-fc60-fff6-b0e6-0000057832c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://heimdalsecurity.com/blog/doppelpaymer-gets-a-rebranding","pattern":"[url:value = 'https://heimdalsecurity.com/blog/doppelpaymer-gets-a-rebranding']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3f6bcc3-e36a-9076-aa9b-00007b31dbd9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://payorgz3j6hs2gj66nk6omfw65atgmqwzxqbbxnqi3bv2mlwgcirunad.onion/","pattern":"[url:value = 'http://payorgz3j6hs2gj66nk6omfw65atgmqwzxqbbxnqi3bv2mlwgcirunad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1a35e9c-c5d1-cd90-93ee-00006b988643","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/fsteam","pattern":"[url:value = 'https://www.ransomlook.io/group/fsteam']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c9af4dd-0095-0ff4-59d8-0000112dbd22","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hkk62og3s2tce2gipcdxg3m27z4b62mrmml6ugctzdxs25o26q3a4mid.onion/","pattern":"[url:value = 'http://hkk62og3s2tce2gipcdxg3m27z4b62mrmml6ugctzdxs25o26q3a4mid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a156ea08-abbb-9ec3-e7f8-0000dcfcfb10","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/freecivilian","pattern":"[url:value = 'https://www.ransomlook.io/group/freecivilian']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac129b83-fc93-c56c-de62-00007609c242","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id.onion/","pattern":"[url:value = 'http://gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76a5e7c3-e8e5-d337-17cc-0000d01c5f8d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/everest-ransomware-now-selling-company-data-on-hacker-forums/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/everest-ransomware-now-selling-company-data-on-hacker-forums/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9b67075-7a07-56d1-5c40-0000ab718093","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/research/everest-ransomware-gang-offers-access-to-compromised-networks.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/research/everest-ransomware-gang-offers-access-to-compromised-networks.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12ca0c72-d01e-fe77-75ed-000074079d20","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/everest-ransomware-extortion","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/everest-ransomware-extortion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e01eba0-8521-25cc-684b-0000e7830221","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/everest","pattern":"[url:value = 'https://www.ransomlook.io/group/everest']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba85f9cf-d0d4-c3d5-3e22-00003629b932","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.reuters.com/article/us-usa-products-colonial-pipeline-ransom/more-ransomware-websites-disappear-in-aftermath-of-colonial-pipeline-hack-idUSKCN2CX0KT","pattern":"[url:value = 'https://www.reuters.com/article/us-usa-products-colonial-pipeline-ransom/more-ransomware-websites-disappear-in-aftermath-of-colonial-pipeline-hack-idUSKCN2CX0KT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d68bf126-9707-5366-a5b4-0000bf7bf57e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gxp6yt3wdj7yky27j37jfrrbkuy24n2zo5uxyuoy23uf76d6m2gnfpid.onion","pattern":"[url:value = 'http://gxp6yt3wdj7yky27j37jfrrbkuy24n2zo5uxyuoy23uf76d6m2gnfpid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--527e4c2b-6f6c-fc5b-974c-00002b1fb0cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://aihvh6j6fbkfjyc6jqbsh2ed4s3rym2v2pu6kd3z3exdso2xc2qwcuqd.onion/","pattern":"[url:value = 'http://aihvh6j6fbkfjyc6jqbsh2ed4s3rym2v2pu6kd3z3exdso2xc2qwcuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79867bd0-d57c-8510-0d6c-0000b1eff6cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bifpwatchoxp7tsb2kpes37b23ogjrb2kj4wgr7yncf4hhgsfahu7jad.onion/","pattern":"[url:value = 'http://bifpwatchoxp7tsb2kpes37b23ogjrb2kj4wgr7yncf4hhgsfahu7jad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d379d417-5b0e-9af8-752e-00002192390b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2vqamwfdpis5rkjtpkutigykp56n6hkxfurm6qukdxp6uz5uff5kkaid.onion/","pattern":"[url:value = 'http://2vqamwfdpis5rkjtpkutigykp56n6hkxfurm6qukdxp6uz5uff5kkaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4456d03-2fd9-757f-99c4-000020d55bb6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onion","pattern":"[url:value = 'http://ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99e11437-5668-ceb8-9d75-00002cf1b399","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ep918","pattern":"[url:value = 'https://www.ransomlook.io/group/ep918']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b40f7fcc-239b-b339-dd79-000054db5296","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/entropy","pattern":"[url:value = 'https://www.ransomlook.io/group/entropy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cf846ac-6a60-3003-c1df-00003151733b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/?cmp=30728","pattern":"[url:value = 'https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/?cmp=30728']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2453b2da-b187-c6bd-16f1-000050f93918","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/","pattern":"[url:value = 'https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e35be063-d496-8b8a-e7c2-00001c204ba4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/adversaries/butler-spider/","pattern":"[url:value = 'https://www.crowdstrike.com/adversaries/butler-spider/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f345cfb-9a91-b6a3-4b6b-00007a5d3f4d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://en.wikipedia.org/wiki/IntelBroker","pattern":"[url:value = 'https://en.wikipedia.org/wiki/IntelBroker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1c29e5c-5a16-e306-dfb7-00000b789683","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mphasis.com/content/dam/mphasis-com/global/en/home/services/cybersecurity/june-21-12-the-intelbroker-data-leak-threat-actor.pdf","pattern":"[url:value = 'https://www.mphasis.com/content/dam/mphasis-com/global/en/home/services/cybersecurity/june-21-12-the-intelbroker-data-leak-threat-actor.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34faba4e-5d82-d0d0-593a-0000cd30b860","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/endurance","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/endurance']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--864385e6-365a-4628-5e73-0000f038951e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/endurance","pattern":"[url:value = 'https://www.ransomlook.io/group/endurance']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--486ff118-8ebd-1b15-2e88-000036e91b1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://h44jyyfomcbnnw5dha7zgwgkvpzbzbdyx2onu4fxaa5smxrgbjgq7had.onion/","pattern":"[url:value = 'http://h44jyyfomcbnnw5dha7zgwgkvpzbzbdyx2onu4fxaa5smxrgbjgq7had.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--614bc5cd-afe3-e0d6-1ecd-00003a82fbcf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.securityweek.com/donut-leaks-ransomware-group-claims-attack-on-continental/","pattern":"[url:value = 'https://www.securityweek.com/donut-leaks-ransomware-group-claims-attack-on-continental/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dbc9818-e8f3-d07a-b43d-00009d0c48ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/continental-confirms-data-breach-donut-leaks-ransomware","pattern":"[url:value = 'https://therecord.media/continental-confirms-data-breach-donut-leaks-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eb21e88-efb0-e78d-5900-0000ea7ee297","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/continental-confirms-data-breach-after-donut-leaks-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/continental-confirms-data-breach-after-donut-leaks-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f57f13b-da53-4637-7c7a-000024e05b2b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/donutleaks","pattern":"[url:value = 'https://www.ransomlook.io/group/donutleaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef448826-8f08-ad95-2940-00004a5de8d9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5zhg2foerm66oqdpmhs52pzfkwqx5rcfhje5j5rltctq5cjs653u3rid.onion","pattern":"[url:value = 'http://5zhg2foerm66oqdpmhs52pzfkwqx5rcfhje5j5rltctq5cjs653u3rid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7a82be3-c912-f42e-a796-0000f1affd03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dk4mkfzqai6ure62oukzgtypedmwlfq57yj2fube7j5wsoi6tuia7nyd.onion/index.php?","pattern":"[url:value = 'http://dk4mkfzqai6ure62oukzgtypedmwlfq57yj2fube7j5wsoi6tuia7nyd.onion/index.php?']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb76784-3b30-610c-e89f-00006df32de2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://sbc2zv2qnz5vubwtx3aobfpkeao6l4igjegm3xx7tk5suqhjkp5jxtqd.onion/","pattern":"[url:value = 'https://sbc2zv2qnz5vubwtx3aobfpkeao6l4igjegm3xx7tk5suqhjkp5jxtqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0618d728-31cf-6da5-f6ee-00001f3d997e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/diavol","pattern":"[url:value = 'https://www.ransomlook.io/group/diavol']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e12b4a64-13b5-c43e-aa0c-00001d82787c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.scythe.io/library/adversary-emulation-diavol-ransomware-threatthursday","pattern":"[url:value = 'https://www.scythe.io/library/adversary-emulation-diavol-ransomware-threatthursday']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26125938-4c59-e955-d478-000046ce66f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2022/220120.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2022/220120.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6077899-55a6-8b21-edda-00007f36a02a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63265583-61af-181e-0e94-000002c4ccf8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fbi-links-diavol-ransomware-to-the-trickbot-cybercrime-group/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fbi-links-diavol-ransomware-to-the-trickbot-cybercrime-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--519338f6-be14-d4ae-7213-00003ba63498","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/diavol-ransomware-sample-shows-stronger-connection-to-trickbot-gang/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/diavol-ransomware-sample-shows-stronger-connection-to-trickbot-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8019c5f0-1043-ab8b-90bc-00009354bd35","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.binarydefense.com/threat_watch/new-ransomware-diavol-being-dropped-by-trickbot/","pattern":"[url:value = 'https://www.binarydefense.com/threat_watch/new-ransomware-diavol-being-dropped-by-trickbot/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee08d024-daf5-3252-1f4a-000044d1e651","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityintelligence.com/posts/analysis-of-diavol-ransomware-link-trickbot-gang/","pattern":"[url:value = 'https://securityintelligence.com/posts/analysis-of-diavol-ransomware-link-trickbot-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a874556-5b58-91bd-f0a3-00006295ba45","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/walmartglobaltech/diavol-the-enigma-of-ransomware-1fd78ffda648","pattern":"[url:value = 'https://medium.com/walmartglobaltech/diavol-the-enigma-of-ransomware-1fd78ffda648']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70dc0dbc-7273-e852-4f9b-000002f9a218","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/walmartglobaltech/diavol-resurfaces-91dd93c7d922","pattern":"[url:value = 'https://medium.com/walmartglobaltech/diavol-resurfaces-91dd93c7d922']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2eb62326-0913-a6c1-0c30-0000541d1e0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://heimdalsecurity.com/blog/is-diavol-ransomware-connected-to-wizard-spider/","pattern":"[url:value = 'https://heimdalsecurity.com/blog/is-diavol-ransomware-connected-to-wizard-spider/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd5d28af-b5a0-0b7c-0c7a-00006ed5dced","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://chuongdong.com/reverse%20engineering/2021/12/17/DiavolRansomware/","pattern":"[url:value = 'https://chuongdong.com/reverse%20engineering/2021/12/17/DiavolRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0de51db0-6ccd-bf5b-137f-00001e24c158","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/dataleak","pattern":"[url:value = 'https://www.ransomlook.io/group/dataleak']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--633d23c8-c2ff-fecb-e16d-00008d0bb945","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://woqjumaahi662ka26jzxyx7fznbp4kg3bsjar4b52tqkxgm2pylcjlad.onion/atom.xml","pattern":"[url:value = 'http://woqjumaahi662ka26jzxyx7fznbp4kg3bsjar4b52tqkxgm2pylcjlad.onion/atom.xml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93d4051f-5123-e352-17f5-00001fc543f8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://elastio.com/detectable-ransomware/darkbit/","pattern":"[url:value = 'https://elastio.com/detectable-ransomware/darkbit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bd930a8-6c06-8a1e-8aff-00000354159e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/anthology/darkbit/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/darkbit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93b41d85-e752-71cf-9ac8-000020e887df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cyberscoop.com/new-cybercrime-group-darkbit-israel/","pattern":"[url:value = 'https://cyberscoop.com/new-cybercrime-group-darkbit-israel/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--537ffdd5-32b7-aa0c-ad63-00001e9c417b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2023/02/darkbit-ransomware-targets-israel","pattern":"[url:value = 'https://blogs.blackberry.com/en/2023/02/darkbit-ransomware-targets-israel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cbf4ba7-b738-5c06-c069-0000601236a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/darkbit01","pattern":"[url:value = 'https://www.ransomlook.io/group/darkbit01']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a858698e-9915-cef3-0120-0000ce527aa4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion/support/","pattern":"[url:value = 'http://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion/support/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7947d3f6-2a1f-b08c-2e68-00000792085a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mphasis.com/content/dam/mphasis-com/global/en/home/services/cybersecurity/dark-angels-ransomware-apr28-22-5.pdf","pattern":"[url:value = 'https://www.mphasis.com/content/dam/mphasis-com/global/en/home/services/cybersecurity/dark-angels-ransomware-apr28-22-5.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d8f9073-9ba1-780c-1471-0000ae878781","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2024/08/low-drama-dark-angels-reap-record-ransoms/","pattern":"[url:value = 'https://krebsonsecurity.com/2024/08/low-drama-dark-angels-reap-record-ransoms/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07e97093-6ddc-11c7-f069-0000fdca602a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/anthology/dark-angels-team-ransomware/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/dark-angels-team-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--add38497-2df5-861d-8271-00004c1f3557","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.isaca.org/resources/news-and-trends/industry-news/2024/darkangels-strikes-big-record-breaking-ransom-secured","pattern":"[url:value = 'https://www.isaca.org/resources/news-and-trends/industry-news/2024/darkangels-strikes-big-record-breaking-ransom-secured']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ab634b4-e3b4-ef75-cb12-0000af09f616","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/shining-light-dark-angels-ransomware-group","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/shining-light-dark-angels-ransomware-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2abe90bf-eace-4425-4341-000067ece838","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/darkangel","pattern":"[url:value = 'https://www.ransomlook.io/group/darkangel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46dea058-247d-8c2a-2414-000059b579da","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://wemo2ysyeq6km2nqhcrz63dkdhez3j25yw2nvn7xba2z4h7v7gyrfgid.onion/","pattern":"[url:value = 'https://wemo2ysyeq6km2nqhcrz63dkdhez3j25yw2nvn7xba2z4h7v7gyrfgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22dc22c7-6857-3eff-0389-000048411d96","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/dark-power-nim-based-ransomware-demands-10k-from-victims/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/dark-power-nim-based-ransomware-demands-10k-from-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c06d8832-9add-d4bc-1ca4-000013c07b36","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/research/dark-power-ransomware.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/research/dark-power-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da447d1b-a74a-96b7-503c-00000f258bd7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/dark","pattern":"[url:value = 'https://www.ransomlook.io/group/dark']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--842fdd62-f8f9-c45c-eeb3-00002062dc6f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2022/221025.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2022/221025.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c698b9c-925b-4acb-e834-0000ec669cca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/daixin-ransomware-hits-healthcare-targets-leaks-stolen-data/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/daixin-ransomware-hits-healthcare-targets-leaks-stolen-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41165fa6-8fa6-b91f-9a19-0000e07490f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/daixin","pattern":"[url:value = 'https://www.ransomlook.io/group/daixin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--382f1f26-9097-e597-8f6e-0000ae3d4c03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://htz6biyazjyzzxllx4knuvux26xa2ixyjshjtwtgq4cm3vczylikm3id.onion/data/gift1/","pattern":"[url:value = 'http://htz6biyazjyzzxllx4knuvux26xa2ixyjshjtwtgq4cm3vczylikm3id.onion/data/gift1/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--813bb65c-22c4-f981-cb11-0000924472e1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://v66nzl27xxmrulq6c2plrzr7tryv2idflhclpoyxrrn3kfw5gkkpveid.onion","pattern":"[url:value = 'http://v66nzl27xxmrulq6c2plrzr7tryv2idflhclpoyxrrn3kfw5gkkpveid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64fff649-5349-5e6a-0e76-0000e4d95a33","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://r3h2balq6aa7plwe5p5bhxzwzxusrtldbfaamfseg33a5hk77bohzxyd.onion","pattern":"[url:value = 'http://r3h2balq6aa7plwe5p5bhxzwzxusrtldbfaamfseg33a5hk77bohzxyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38bb450a-4157-d6aa-0af0-0000285c1104","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qlfnwdg2fyvmzmqkk33iwku32ynsbbk6hysorsvvadr4o7gfzs4t46yd.onion","pattern":"[url:value = 'http://qlfnwdg2fyvmzmqkk33iwku32ynsbbk6hysorsvvadr4o7gfzs4t46yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--710f763c-f44b-9df5-5f06-000030dd9aca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pkx3r7xe42z7fgkjjbocf7okdh77bsvngwvp6arykksob7gleyswicyd.onion","pattern":"[url:value = 'http://pkx3r7xe42z7fgkjjbocf7okdh77bsvngwvp6arykksob7gleyswicyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0264b20-0557-9d44-39d9-00000dbb10cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kyk6lixosktvbtf3g6zte7kdzid2lwrprfod55mhwunafx6jzeoui7yd.onion","pattern":"[url:value = 'http://kyk6lixosktvbtf3g6zte7kdzid2lwrprfod55mhwunafx6jzeoui7yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2300ab03-99be-03f5-8795-0000bbc39ef6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kolbh6putvp6aw3vpmsppor4kyzs7ctxfbp2donetycftz5jru73ytid.onion","pattern":"[url:value = 'http://kolbh6putvp6aw3vpmsppor4kyzs7ctxfbp2donetycftz5jru73ytid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e05c3987-efc4-758c-67a9-00007c55d82e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://htz6biyazjyzzxllx4knuvux26xa2ixyjshjtwtgq4cm3vczylikm3id.onion","pattern":"[url:value = 'http://htz6biyazjyzzxllx4knuvux26xa2ixyjshjtwtgq4cm3vczylikm3id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5312917a-0e6e-0f2e-9370-000036f36268","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onion/","pattern":"[url:value = 'http://7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55b0edbe-d708-f196-1cc3-00001b07a8cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://profero.io/posts/cubaransomware/Cuba-Ransomware-Group-on-a-roll.pdf","pattern":"[url:value = 'https://profero.io/posts/cubaransomware/Cuba-Ransomware-Group-on-a-roll.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bc7d86b-266d-2806-6177-0000fc157930","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-335a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-335a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3f4e832-2e4f-a3fc-44ce-0000ffee3b62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41d71a38-33a1-e380-e5f3-000076944c6b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2023/08/cuba-ransomware-deploys-new-tools-targets-critical-infrastructure-sector-in-the-usa-and-it-integrator-in-latin-america","pattern":"[url:value = 'https://blogs.blackberry.com/en/2023/08/cuba-ransomware-deploys-new-tools-targets-critical-infrastructure-sector-in-the-usa-and-it-integrator-in-latin-america']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6abb541-ccc0-8672-2490-00005d988232","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/cuba","pattern":"[url:value = 'https://www.ransomlook.io/group/cuba']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0729638a-ac50-8054-fb55-000014b67bf7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/f/cuba-ransomware-group-s-new-variant-found-using-optimized-infect.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/f/cuba-ransomware-group-s-new-variant-found-using-optimized-infect.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6ff4a8a-7048-5483-317d-00003f40930c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-threat-report-a-quick-primer-on-cuba-ransomware","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-threat-report-a-quick-primer-on-cuba-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c85be7b0-69d9-77a0-109d-0000dcae5621","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mandiant.com/resources/unc2596-cuba-ransomware","pattern":"[url:value = 'https://www.mandiant.com/resources/unc2596-cuba-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2e38919-893b-2a84-2f92-000034c34d73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.it-connect.fr/le-ransomware-cuba-sen-prend-aux-serveurs-exchange/","pattern":"[url:value = 'https://www.it-connect.fr/le-ransomware-cuba-sen-prend-aux-serveurs-exchange/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9151c55-63de-7528-7078-000015ab10aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2021/211203-2.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2021/211203-2.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c61efa9f-c442-7d6d-7644-000016658ef1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.guidepointsecurity.com/blog/using-hindsight-to-close-a-cuba-cold-case/","pattern":"[url:value = 'https://www.guidepointsecurity.com/blog/using-hindsight-to-close-a-cuba-cold-case/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95b3a40d-2d15-d49e-00b4-000064ad4db3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fortinet.com/blog/threat-research/ransomware-roundup-gwisin-kriptor-cuba-and-more","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/ransomware-roundup-gwisin-kriptor-cuba-and-more']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad2e0592-8e76-0682-dbe3-0000ab40d017","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elastic.co/security-labs/cuba-ransomware-malware-analysis","pattern":"[url:value = 'https://www.elastic.co/security-labs/cuba-ransomware-malware-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05aa732b-04df-0b96-315b-0000f27f8c69","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis","pattern":"[url:value = 'https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4e784ca-aa09-bd67-c250-000009cf7c48","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbf23bd9-9b7b-456a-c97a-0000192f37a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/","pattern":"[url:value = 'https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bda33d9-5247-3379-c641-0000e44315e0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cf7a24b-b722-6241-162e-000037519e37","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://shared-public-reports.s3-eu-west-1.amazonaws.com/Cuba+Ransomware+Group+-+on+a+roll.pdf","pattern":"[url:value = 'https://shared-public-reports.s3-eu-west-1.amazonaws.com/Cuba+Ransomware+Group+-+on+a+roll.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4605b672-1086-0998-c7ca-000061f60467","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lab52.io/blog/cuba-ransomware-analysis/","pattern":"[url:value = 'https://lab52.io/blog/cuba-ransomware-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8114280-1496-e0ea-5ddc-0000bdbc5393","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2019/12/cuba-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2019/12/cuba-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b140802-c79d-9610-cdb0-000025f1cfee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.group-ib.com/hancitor-cuba-ransomware","pattern":"[url:value = 'https://blog.group-ib.com/hancitor-cuba-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85cc44ef-06b9-5bd7-cbc5-0000500fd62c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://digital.nhs.uk/cyber-alerts/2021/cc-3855","pattern":"[url:value = 'https://digital.nhs.uk/cyber-alerts/2021/cc-3855']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b24924f-67a2-e39d-8039-0000f0c48341","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://kcfgfs7cclscxloy3bf2xtwnayimawtzrbfirfbvl47xt7n2brfiizyd.onion/","pattern":"[url:value = 'https://kcfgfs7cclscxloy3bf2xtwnayimawtzrbfirfbvl47xt7n2brfiizyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c76e6cb-aee6-32dd-1c40-0000d8cebc30","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://i34gbmo5rxx3bxc4yl7f4erkyo2oldwavhpdragnjjvhni6fwvptp2id.onion","pattern":"[url:value = 'http://i34gbmo5rxx3bxc4yl7f4erkyo2oldwavhpdragnjjvhni6fwvptp2id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ba6cd22-98d9-d1a3-9342-00008e5e78e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/","pattern":"[url:value = 'http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--414d80e8-bf89-b84c-2e5c-000060696191","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.watchguard.com/","pattern":"[url:value = 'https://www.watchguard.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a85e648-279c-6cac-9873-00001f09ba39","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.singleton.com/blog/describing-crylock-ransomware","pattern":"[url:value = 'https://www.singleton.com/blog/describing-crylock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59759e6f-ee15-8a29-0ec1-00007850ebcd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.alartindex.com","pattern":"[url:value = 'https://www.alartindex.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d88a2eb1-5e16-9d4d-b13c-00003680b243","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.crylock.h","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.crylock.h']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc08f546-21cc-7076-cc21-0000e77129ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/removal-guides/16814-crylock-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/16814-crylock-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79cb5cd1-e6dd-9342-1ea8-0000628513b0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/crylock","pattern":"[url:value = 'https://www.ransomlook.io/group/crylock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cba576a-9b8c-c754-92d7-00006f789a15","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.telekom.com/en/blog/group/article/lockdata-auction-631300","pattern":"[url:value = 'https://www.telekom.com/en/blog/group/article/lockdata-auction-631300']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9881f9e6-de64-1a13-6849-000006d80066","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Cryakl-B/detailed-analysis.aspx","pattern":"[url:value = 'https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Cryakl-B/detailed-analysis.aspx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad0344e1-86f2-f159-1f48-0000514a242f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process","pattern":"[url:value = 'https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ff85f35-e2eb-53ef-65ee-00005893590f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/971164798376468481","pattern":"[url:value = 'https://twitter.com/demonslay335/status/971164798376468481']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec35a1a9-c114-7565-ff7b-0000c3706a26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/bartblaze/status/1305197264332369920","pattern":"[url:value = 'https://twitter.com/bartblaze/status/1305197264332369920']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50ea40fc-975a-7cf9-5475-0000f80e8b29","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/albertzsigovits/status/1217866089964679174","pattern":"[url:value = 'https://twitter.com/albertzsigovits/status/1217866089964679174']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc21a95f-af93-3a29-c30d-0000a03a3b01","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.ru/shifrovalshhik-cryakl-ili-fantomas-razbushevalsya/24070/","pattern":"[url:value = 'https://securelist.ru/shifrovalshhik-cryakl-ili-fantomas-razbushevalsya/24070/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca8cddd6-b320-b21a-91ae-0000adea78bf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/the-return-of-fantomas-or-how-we-deciphered-cryakl/86511/","pattern":"[url:value = 'https://securelist.com/the-return-of-fantomas-or-how-we-deciphered-cryakl/86511/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a35c166-efe1-9fdc-875c-00003c7ed06a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/cis-ransomware/104452/","pattern":"[url:value = 'https://securelist.com/cis-ransomware/104452/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddd20ffb-6118-311b-6ec9-0000a2a27675","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://hackmag.com/security/ransomware-russian-style/","pattern":"[url:value = 'https://hackmag.com/security/ransomware-russian-style/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3848a15-5e01-e568-3fb4-0000c522136e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.checkpoint.com/2015/11/04/offline-ransomware-encrypts-your-data-without-cc-communication/","pattern":"[url:value = 'https://blog.checkpoint.com/2015/11/04/offline-ransomware-encrypts-your-data-without-cc-communication/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e9c1c57-845b-befa-d1f4-0000824bfff7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://bartblaze.blogspot.com/2016/02/vipasana-ransomware-new-ransom-on-block.html","pattern":"[url:value = 'https://bartblaze.blogspot.com/2016/02/vipasana-ransomware-new-ransom-on-block.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--290a0607-4049-5d51-8124-000047b61d9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/cooming","pattern":"[url:value = 'https://www.ransomlook.io/group/cooming']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12372ae6-6463-4e30-4d30-00009e9b6637","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: coomingproject.com","pattern":"[domain-name:value = 'coomingproject.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8eabe14-3851-e0aa-e65f-0000d5c0c6ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://heimdalsecurity.com/blog/cheerscrypt-ransomware-strain-attributed-to-chinese-hacking-group/","pattern":"[url:value = 'https://heimdalsecurity.com/blog/cheerscrypt-ransomware-strain-attributed-to-chinese-hacking-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4a098f5-ba30-0c77-de05-00002837579b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sygnia.co/threat-reports-and-advisories/revealing-emperor-dragonfly-a-chinese-ransomware-group/","pattern":"[url:value = 'https://www.sygnia.co/threat-reports-and-advisories/revealing-emperor-dragonfly-a-chinese-ransomware-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c60e96f6-b190-bbd5-234d-0000859c4a91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/anthology/cheerscrypt/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/cheerscrypt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a7a89be-355c-62ec-0e67-000061272dee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cec592fe-f4ae-5cb1-6e47-0000e355c51d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.watchguard.com/wgrd-ransomware/cheerscrypt","pattern":"[url:value = 'https://www.watchguard.com/wgrd-ransomware/cheerscrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c51b25b7-0d0f-4f4f-e279-000056f1b4f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/cheers","pattern":"[url:value = 'https://www.ransomlook.io/group/cheers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50969f65-95ef-2bda-1512-000055dfec91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rwiajgajdr4kzlnrj5zwebbukpcbrjhupjmk6gufxv6tg7myx34iocad.onion/","pattern":"[url:value = 'http://rwiajgajdr4kzlnrj5zwebbukpcbrjhupjmk6gufxv6tg7myx34iocad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b89c424e-74b9-6696-bdd1-0000b5841734","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/bonacigroup","pattern":"[url:value = 'https://www.ransomlook.io/group/bonacigroup']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c2b1a71-a18d-6df5-f72b-0000bdd4440e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cloudsek.com/blog/technical-analysis-of-bluesky-ransomware","pattern":"[url:value = 'https://www.cloudsek.com/blog/technical-analysis-of-bluesky-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c35904cf-3793-51eb-1ad1-0000185eb844","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.unit42.paloaltonetworks.com/bluesky-ransomware/","pattern":"[url:value = 'https://www.unit42.paloaltonetworks.com/bluesky-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30db4cef-19ab-3e2c-a8db-00001b05d956","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/anthology/bluesky/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/bluesky/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1ece567-a93c-8608-93d7-0000335b3120","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.watchguard.com/wgrd-ransomware/bluesky","pattern":"[url:value = 'https://www.watchguard.com/wgrd-ransomware/bluesky']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70c43751-95f4-67fe-a0ca-00009506a7c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/bluesky","pattern":"[url:value = 'https://www.ransomlook.io/group/bluesky']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bc10b9c-089c-2007-e556-00000fe82f4c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://yoroi.company/research/dissecting-bluesky-ransomware-payload/","pattern":"[url:value = 'https://yoroi.company/research/dissecting-bluesky-ransomware-payload/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b10c7288-566d-a6d0-3954-00000fef5878","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/blog/bluesky-ransomware-ad-lateral-movement-evasion-and-fast-encryption-puts-threat-on-the-radar/","pattern":"[url:value = 'https://www.sentinelone.com/blog/bluesky-ransomware-ad-lateral-movement-evasion-and-fast-encryption-puts-threat-on-the-radar/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75991a2e-967f-de5d-ef73-0000ff5bff0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/bluesky-ransomware/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/bluesky-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f95dc10f-b2bb-c81b-4321-00003811c92c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/blacktor","pattern":"[url:value = 'https://www.ransomlook.io/group/blacktor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1042f824-3370-f612-bf47-00008f85e08b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bl%40ckt0r:bl%40ckt0r@bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion/0x00/data-breach.html","pattern":"[url:value = 'http://bl%40ckt0r:bl%40ckt0r@bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion/0x00/data-breach.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1588e6f7-4541-4ca5-6f91-0000afba7f96","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://heimdalsecurity.com/blog/cyberserve-hijacked-by-blackshadow-hacker-group-to-extort-customers/","pattern":"[url:value = 'https://heimdalsecurity.com/blog/cyberserve-hijacked-by-blackshadow-hacker-group-to-extort-customers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26b8ece7-0af2-3627-b0e7-00006faa04f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyberscoop.com/hack-and-leak-group-black-shadow-keeps-targeting-israeli-victims/","pattern":"[url:value = 'https://www.cyberscoop.com/hack-and-leak-group-black-shadow-keeps-targeting-israeli-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd75b142-7d3e-e51f-302f-00005ad906f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/blackshadow","pattern":"[url:value = 'https://www.ransomlook.io/group/blackshadow']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bf2eb9d-da74-0fc9-985c-0000ef84d711","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blackshadow.cc","pattern":"[url:value = 'http://blackshadow.cc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--505e5342-532d-e37c-e74b-00009a2d6e34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/bianlian","pattern":"[url:value = 'https://www.ransomlook.io/group/bianlian']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4478a9ec-0527-5205-6e8b-000075959280","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=DPFcvSy4OZk","pattern":"[url:value = 'https://www.youtube.com/watch?v=DPFcvSy4OZk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--542e59e2-4985-436b-4d70-0000e9bfaae6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Hunting-the-Android-BianLian-botnet.pdf","pattern":"[url:value = 'https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Hunting-the-Android-BianLian-botnet.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04201a71-311e-1db1-b1b7-00002a069dde","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.virusbulletin.com/uploads/pdf/conference/vb2022/slides/VB2022-Hunting-the-Android-BianLian-botnet.pdf","pattern":"[url:value = 'https://www.virusbulletin.com/uploads/pdf/conference/vb2022/slides/VB2022-Hunting-the-Android-BianLian-botnet.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dfeb6f6-4b1f-f03e-193c-0000ada59ce4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.threatfabric.com/blogs/bianlian_from_rags_to_riches_the_malware_dropper_that_had_a_dream.html","pattern":"[url:value = 'https://www.threatfabric.com/blogs/bianlian_from_rags_to_riches_the_malware_dropper_that_had_a_dream.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e7b2601-668f-38b9-ad0e-0000f1bd0477","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fa19a4d-9945-3516-d7a7-0000a64baa9c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1558548947584548865","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1558548947584548865']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a7069cf-7a50-a582-5310-00008abf350b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://rhisac.org/threat-intelligence/bianlian-ransomware-expanding-c2-infrastructure-and-operational-tempo/","pattern":"[url:value = 'https://rhisac.org/threat-intelligence/bianlian-ransomware-expanding-c2-infrastructure-and-operational-tempo/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3315dd52-96f3-f04d-b5af-0000c205e0fa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/","pattern":"[url:value = 'https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa315fe3-4aef-21d6-3a49-0000332f6a5c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cryptax.medium.com/quick-look-into-a-new-sample-of-android-bianlian-bc5619efa726","pattern":"[url:value = 'https://cryptax.medium.com/quick-look-into-a-new-sample-of-android-bianlian-bc5619efa726']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3cd468f-7c6b-f877-6adf-00005de94f5e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cryptax.medium.com/multidex-trick-to-unpack-android-bianlian-ed52eb791e56","pattern":"[url:value = 'https://cryptax.medium.com/multidex-trick-to-unpack-android-bianlian-ed52eb791e56']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07ad5be3-3bee-8ad6-0bca-0000aefa709a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cryptax.medium.com/creating-a-safe-dummy-c-c-to-test-android-bots-ffa6e7a3dce5","pattern":"[url:value = 'https://cryptax.medium.com/creating-a-safe-dummy-c-c-to-test-android-bots-ffa6e7a3dce5']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fbd1c82-0ceb-5b5f-b0c2-000045601863","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cryptax.medium.com/bianlian-c-c-domain-name-4f226a29e221","pattern":"[url:value = 'https://cryptax.medium.com/bianlian-c-c-domain-name-4f226a29e221']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbec4ac8-c14c-92a8-5371-0000c8e08b41","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cryptax.medium.com/android-bianlian-payload-61febabed00a","pattern":"[url:value = 'https://cryptax.medium.com/android-bianlian-payload-61febabed00a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a11f8334-d205-863e-5d11-00004ab2ce3e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2022/10/bianlian-ransomware-encrypts-files-in-the-blink-of-an-eye","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/10/bianlian-ransomware-encrypts-files-in-the-blink-of-an-eye']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--924e3ca7-35a3-dfe3-ebed-0000cad61bb1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2022/08/18/bianlian-new-ransomware-variant-on-the-rise/","pattern":"[url:value = 'https://blog.cyble.com/2022/08/18/bianlian-new-ransomware-variant-on-the-rise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dee8d405-eb0c-6fe1-f517-0000b938edca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/bianlian-fig05.png","pattern":"[url:value = 'https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/bianlian-fig05.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bc82788-b3ea-44de-f571-0000542af76a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/v28_screenshot.png","pattern":"[url:value = 'https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/v28_screenshot.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd8ac30a-af0c-012f-b21b-0000145b2e06","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/v8_screenshot.png","pattern":"[url:value = 'https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/v8_screenshot.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f7fb115-c225-6d27-97ed-0000d3ffd72e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://qtox.github.io/\\n\\nAdd","pattern":"[url:value = 'https://qtox.github.io/\\\\n\\\\nAdd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4878d297-f43b-1c6c-f32b-0000e1fab500","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bianlianvjr9vhy72f782342yvygfciusgfisgiygfs1bredw.i2p/","pattern":"[url:value = 'http://bianlianvjr9vhy72f782342yvygfciusgfisgiygfs1bredw.i2p/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2bdfa6b-f22d-e4fc-8f23-0000eb77a7db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion/","pattern":"[url:value = 'http://bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cff1980d-fc53-eb16-e663-00008f8c14aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion/","pattern":"[url:value = 'http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a531c0ef-0548-ea86-f17e-0000ccec05e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/babyduck","pattern":"[url:value = 'https://www.ransomlook.io/group/babyduck']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fac404c-9ffb-6569-dfe8-0000a2ef91f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/PolarToffee/status/1445873002801889280/photo/3","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/1445873002801889280/photo/3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3b31292-c858-7489-389d-0000207dbb36","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://digitalrecovery.com/wp-content/uploads/2022/12/Ransomware-Baby-Duck.webp","pattern":"[url:value = 'https://digitalrecovery.com/wp-content/uploads/2022/12/Ransomware-Baby-Duck.webp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34eb4c67-bfbb-4a3f-0b9a-00000d471fd4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: README.babyduck","pattern":"[domain-name:value = 'README.babyduck']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ca79d3c-0979-8099-1952-0000555a9b4a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.torproject.org/download/)","pattern":"[url:value = 'https://www.torproject.org/download/)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be7ee944-1890-9f20-65aa-0000bbe47492","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/babuk-locker","pattern":"[url:value = 'https://www.ransomlook.io/group/babuk-locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8c265dc-0c0f-e00a-2771-00001d05b53c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyberint.com/babuk-locker","pattern":"[url:value = 'https://blog.cyberint.com/babuk-locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18461017-91d7-e8b5-2863-0000386206b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/babuk-ransomwares-full-source-code-leaked-on-hacker-forum","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/babuk-ransomwares-full-source-code-leaked-on-hacker-forum']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8181ec04-aa54-dc0d-d8d1-00009b0be2a5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f806946-f300-6da7-5605-0000d9e6e73d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid.onion/#section-3","pattern":"[url:value = 'http://nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid.onion/#section-3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--968ab682-8098-fbab-831d-0000a935e9d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/aztroteam","pattern":"[url:value = 'https://www.ransomlook.io/group/aztroteam']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--306baf20-d386-9a48-722b-00003fc41b88","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/avaddon","pattern":"[url:value = 'https://www.ransomlook.io/group/avaddon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47d26014-ac58-a90e-330e-0000e279961a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.welivesecurity.com/la-es/2021/05/31/ransomware-avaddon-principales-caracteristicas/","pattern":"[url:value = 'https://www.welivesecurity.com/la-es/2021/05/31/ransomware-avaddon-principales-caracteristicas/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fea01ac9-174a-540c-3a9d-00000cf3b1ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ba4630d-d684-624e-2b4e-000063c58933","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tgsoft.it/files/report/download.asp?id=568531345","pattern":"[url:value = 'https://www.tgsoft.it/files/report/download.asp?id=568531345']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e330f66c-42fd-4541-eb4a-0000d184019e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.swascan.com/it/avaddon-ransomware/","pattern":"[url:value = 'https://www.swascan.com/it/avaddon-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cf17acc-60d8-7aa6-770b-000073a979f0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/","pattern":"[url:value = 'https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb87112f-193e-dd68-f091-0000e762710b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.connectwise.com/resources/avaddon-profile","pattern":"[url:value = 'https://www.connectwise.com/resources/avaddon-profile']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59dbff68-ba7a-8f6c-6ecf-000030972941","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93e1b49d-d8a4-4a9d-ffa9-00005619d7cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--062a97a7-88ca-2a63-0968-0000cdfadb46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/the-rise-demise-of-multi-million-ransomware-business-empire","pattern":"[url:value = 'https://www.advanced-intel.com/post/the-rise-demise-of-multi-million-ransomware-business-empire']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea4c564f-623f-cc56-9098-00001c3b78d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/dk_samper/status/1348560784285167617","pattern":"[url:value = 'https://twitter.com/dk_samper/status/1348560784285167617']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--562dbe34-3b54-3b06-f1d4-0000e88dd7f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/Securityinbits/status/1271065316903120902","pattern":"[url:value = 'https://twitter.com/Securityinbits/status/1271065316903120902']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e62d56f7-54ae-f90a-68c1-0000edc386ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure","pattern":"[url:value = 'https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b429c062-b227-ceeb-f855-0000366d1576","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/avaddon-ransomware-operation-shuts-down-and-releases-decryption-keys/","pattern":"[url:value = 'https://therecord.media/avaddon-ransomware-operation-shuts-down-and-releases-decryption-keys/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1037916d-5830-c1e2-2e1e-0000649e0399","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/quick-analysis-of-haron-ransomware-feat-avaddon-and-thanos-1ebb70f64dc4","pattern":"[url:value = 'https://medium.com/s2wlab/quick-analysis-of-haron-ransomware-feat-avaddon-and-thanos-1ebb70f64dc4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7afb2a4-5650-b040-f544-0000ba9dc2f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage/","pattern":"[url:value = 'https://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b847f31e-4792-e1b1-ae2b-000035e7ad21","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyber.gov.au/sites/default/files/2021-05/2021-003%20Ongoing%20campaign%20using%20Avaddon%20Ransomware%20-%2020210508.pdf","pattern":"[url:value = 'https://www.cyber.gov.au/sites/default/files/2021-05/2021-003%20Ongoing%20campaign%20using%20Avaddon%20Ransomware%20-%2020210508.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e440c8b-2431-f47f-1be4-0000c4127bc4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.acronis.com/en-us/articles/avaddon-ransomware","pattern":"[url:value = 'https://www.acronis.com/en-us/articles/avaddon-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--689d7758-12bd-6ff2-b874-000078193a06","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://atos.net/en/lp/securitydive/avaddon-ransomware-analysis","pattern":"[url:value = 'https://atos.net/en/lp/securitydive/avaddon-ransomware-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a4dac17-3069-e886-373f-0000e7c03e99","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://heimdalsecurity.com/blog/avaddon-ransomware/","pattern":"[url:value = 'https://heimdalsecurity.com/blog/avaddon-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--438e575f-1bcf-0871-4f86-00006c6c49d4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://avaddonbotrxmuyl.onion/","pattern":"[url:value = 'http://avaddonbotrxmuyl.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fa1bb1d-b270-0cdf-f371-0000466891ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/atomsilo","pattern":"[url:value = 'https://www.ransomlook.io/group/atomsilo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91216d65-6905-194d-9a18-000026504940","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/1437664046556274694?s=20","pattern":"[url:value = 'https://twitter.com/siri_urz/status/1437664046556274694?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94ec1e0c-7824-32f7-2943-000080912dd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://chuongdong.com//reverse%20engineering/2021/10/13/AtomSiloRansomware/","pattern":"[url:value = 'https://chuongdong.com//reverse%20engineering/2021/10/13/AtomSiloRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9892649-029a-412e-d17b-0000dc874b88","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de0307a5-ff18-fe99-d263-0000fd8d1d86","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decoded.avast.io/threatintel/decryptor-for-atomsilo-and-lockfile-ransomware/","pattern":"[url:value = 'https://decoded.avast.io/threatintel/decryptor-for-atomsilo-and-lockfile-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d1b2216-03ce-ef10-b04b-0000c10a15fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://chuongdong.com/reverse%20engineering/2021/10/13/AtomSiloRansomware/","pattern":"[url:value = 'https://chuongdong.com/reverse%20engineering/2021/10/13/AtomSiloRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7ac1ee6-c5c5-b019-b01b-000052383957","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23ef7aaf-89fb-be26-b350-0000c3373145","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/1437664046556274694","pattern":"[url:value = 'https://twitter.com/siri_urz/status/1437664046556274694']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--549c9da2-ddcf-99eb-4c31-000013dce7cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/atomsilo-ransomware-enters-league-double-extortion","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/atomsilo-ransomware-enters-league-double-extortion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--678b0ab5-e5e7-b646-3baa-0000b766cb10","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyfirma.com/outofband/malware-research-on-atomsilo-ransomware/","pattern":"[url:value = 'https://www.cyfirma.com/outofband/malware-research-on-atomsilo-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e37ca253-d8bd-fb4b-a19b-00005f0e36d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202109/atomsilo-ransomware-ransom-note-in-gif-image.gif","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202109/atomsilo-ransomware-ransom-note-in-gif-image.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87f9816f-bea7-c45e-9ef5-000051042a86","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyfirma.com/media/2021/10/Fig-2-B.png","pattern":"[url:value = 'https://www.cyfirma.com/media/2021/10/Fig-2-B.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d54c8202-9734-58bc-1803-0000812d6667","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyfirma.com/media/2021/10/Fig-2.png","pattern":"[url:value = 'https://www.cyfirma.com/media/2021/10/Fig-2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--502bde05-dce4-a2e2-391f-0000da2e480f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: download-easy.html.en","pattern":"[domain-name:value = 'download-easy.html.en']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88a68976-301e-30c6-8da0-000041022ed5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: atomsilo.com","pattern":"[domain-name:value = 'atomsilo.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac6a8a82-60c7-6259-b455-00008b7eb088","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: AtomSilo.Sorry","pattern":"[domain-name:value = 'AtomSilo.Sorry']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--294af2d1-5983-a6ac-8624-0000c8be3131","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://npmh5ahrgakbniuntyc7io4adm6ietbdbuejrfonowqtyqn24or556qd.onion/","pattern":"[url:value = 'http://npmh5ahrgakbniuntyc7io4adm6ietbdbuejrfonowqtyqn24or556qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67f2523e-7c97-7cf7-f6b4-000001bd21b5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/arvin-club","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/arvin-club']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33442c24-615f-4460-ab43-000083b24586","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cloudsek.com/ar/threatintelligence/ransomware-group-profile-arvin-club","pattern":"[url:value = 'https://cloudsek.com/ar/threatintelligence/ransomware-group-profile-arvin-club']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa8ff99b-fd7f-47b1-5c12-0000bd49d600","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/arvinclub","pattern":"[url:value = 'https://www.ransomlook.io/group/arvinclub']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6319f9de-f876-d587-7199-0000d274afc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t.me/arvin_club","pattern":"[url:value = 'http://t.me/arvin_club']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49dbd0ce-a8e8-3b2c-639e-0000ff7e30ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://arvinc7prj6ln5wpd6yydfqulsyepoc7aowngpznbn3lrap2aib6teid.onion/","pattern":"[url:value = 'http://arvinc7prj6ln5wpd6yydfqulsyepoc7aowngpznbn3lrap2aib6teid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--023ebff3-79e5-1090-f7c4-0000e1c827f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://sonicwall.com/blog/ako-ransomware-demands-3000-operators-hide-behind-tor","pattern":"[url:value = 'https://sonicwall.com/blog/ako-ransomware-demands-3000-operators-hide-behind-tor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb4ce812-667a-e9ec-b7b3-000002194604","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://attackiq.com/2025/01/09/emulating-ako-ransomware","pattern":"[url:value = 'https://attackiq.com/2025/01/09/emulating-ako-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c03e19cb-8b64-e4fa-2c68-000033ed887c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://tripwire.com/state-of-security/ako-ransomware-using-spam-attachments-to-target-networks","pattern":"[url:value = 'https://tripwire.com/state-of-security/ako-ransomware-using-spam-attachments-to-target-networks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b48dfd9e-5b19-437a-a8e3-000031e0b08d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ako","pattern":"[url:value = 'https://www.ransomlook.io/group/ako']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46eb99dd-2e93-9702-7cf6-0000e67ce928","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202010/ako-ransomware-update-2020-10-15-text-file.gif","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202010/ako-ransomware-update-2020-10-15-text-file.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75012268-ef33-eb3e-55c5-00006207a9f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202004/ako-update-2020-04-21-html-file.jpg","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202004/ako-update-2020-04-21-html-file.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27d9354f-7d0a-9b77-c659-0000d28e27b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202004/ako-update-2020-04-21-text-file.jpg","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202004/ako-update-2020-04-21-text-file.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec7c6048-aaee-5f18-7419-0000b6b1cf8a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202004/ako-ransomware-update-2020-04-09-text-file.jpg","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202004/ako-ransomware-update-2020-04-09-text-file.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b39781f4-9334-ef04-3779-00000a4831fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202001/ako-ransom-note-second_variant.jpg","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202001/ako-ransom-note-second_variant.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--657db063-65db-ab9e-2225-00007496938b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/removal-guides/16737-ako-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/16737-ako-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87f98e0c-f58f-a8ee-72a0-00009c0d4330","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://digital.nhs.uk/cyber-alerts/2020/cc-3345","pattern":"[url:value = 'https://digital.nhs.uk/cyber-alerts/2020/cc-3345']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f824e261-4939-2d8d-b6e5-0000ed2891fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202001/ako-ransom-note.jpg","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202001/ako-ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff4ea0b2-821b-4362-b122-000045df2800","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ako-readme.txt","pattern":"[domain-name:value = 'ako-readme.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ade279ad-4c3c-a7fe-2097-00005b3fd905","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: thcw5gz75qncv7rbhyad.onion","pattern":"[domain-name:value = 'thcw5gz75qncv7rbhyad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7030c26-28e5-b69e-e60f-000035f93a0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: buydecrypt.hk","pattern":"[domain-name:value = 'buydecrypt.hk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d0e5119-b33f-1ad9-8535-00001e9ec283","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: cw5gz75qncv7rbhyad.onion","pattern":"[domain-name:value = 'cw5gz75qncv7rbhyad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0609b4f6-a851-0d2d-bb89-0000f8a079e3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: www.torproject.org","pattern":"[domain-name:value = 'www.torproject.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59bb2580-873f-0f1b-9af9-0000a103e494","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/","pattern":"[url:value = 'http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e34b891-60e4-27a8-d5ef-0000050f47f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.knowbe4.com/hitler-ransomware-just-deletes-files-instead-of-encrypting-them","pattern":"[url:value = 'https://blog.knowbe4.com/hitler-ransomware-just-deletes-files-instead-of-encrypting-them']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e26ae59-ff17-b129-2a0b-000075924485","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://siliconangle.com/2016/08/10/hitler-ransomware-may-be-goosestepping-onto-a-computer-near-you/","pattern":"[url:value = 'https://siliconangle.com/2016/08/10/hitler-ransomware-may-be-goosestepping-onto-a-computer-near-you/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--316615ec-d552-5323-cfdd-0000c7ea4e22","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.theregister.com/2016/08/10/hitler_ransomware/","pattern":"[url:value = 'https://www.theregister.com/2016/08/10/hitler_ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54de6b07-89fc-5801-f726-0000165b1ec0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.infosecurity-magazine.com/news/hitler-ransomware-deletes-users/","pattern":"[url:value = 'https://www.infosecurity-magazine.com/news/hitler-ransomware-deletes-users/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a54b5dc-ce6d-f4de-a24e-000085514680","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.securityweek.com/unfinished-hitler-ransomware-variant-deletes-user-files/","pattern":"[url:value = 'https://www.securityweek.com/unfinished-hitler-ransomware-variant-deletes-user-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2912dbfb-8f6b-b675-4f55-0000dc92b42a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/development-version-of-the-hitler-ransomware-discovered/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/development-version-of-the-hitler-ransomware-discovered/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7675419f-e0ea-119a-aff0-0000cb3441e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/agl0bgvycg","pattern":"[url:value = 'https://www.ransomlook.io/group/agl0bgvycg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8085dcdd-b060-3c96-994a-0000c1781ef1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/fr0s7_/status/1460229982278541315","pattern":"[url:value = 'https://twitter.com/fr0s7_/status/1460229982278541315']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58987187-0c71-d26a-6279-0000d8fc1b32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://raw.githubusercontent.com/stamparm/maltrail/master/trails/static/malware/hitler_ransomware.txt","pattern":"[url:value = 'https://raw.githubusercontent.com/stamparm/maltrail/master/trails/static/malware/hitler_ransomware.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00d976bc-8d39-c12e-f7b8-0000be58f6da","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hitleransomware[.]cf/","pattern":"[url:value = 'http://hitleransomware[.]cf/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07c7da6f-c5ef-e073-84cb-0000c92ab332","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hitlerransomware[.]000webhostapp[.]com/","pattern":"[url:value = 'http://hitlerransomware[.]000webhostapp[.]com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01ff1865-e4a0-6164-1de3-000015733bb0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/abrahams-ax","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/abrahams-ax']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86320d3e-34ef-47af-6545-0000a7faa27f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/abrahams_ax","pattern":"[url:value = 'https://www.ransomlook.io/group/abrahams_ax']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--625e8850-ccce-c47b-c108-0000e74305cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/blog/abrahams-ax-likely-linked-to-moses-staff","pattern":"[url:value = 'https://www.secureworks.com/blog/abrahams-ax-likely-linked-to-moses-staff']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19b75242-c994-b1c4-a101-00005ae005e0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://abrahamm32umasogaqojib3ey2w2nwoafffrguq43tsyke4s3fz3w4yd.onion/","pattern":"[url:value = 'http://abrahamm32umasogaqojib3ey2w2nwoafffrguq43tsyke4s3fz3w4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c165ced0-eb10-a32f-e869-00007f27afd8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: EgenSajt.se","pattern":"[domain-name:value = 'EgenSajt.se']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50911f98-8064-fd26-8f31-00004d2401fa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/0mega","pattern":"[url:value = 'https://www.ransomlook.io/group/0mega']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d58b153-fee5-04f4-30fb-000002e293e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cyware.com/news/new-0mega-ransomware-joins-the-double-extortion-threat-landscape-158fb321","pattern":"[url:value = 'https://cyware.com/news/new-0mega-ransomware-joins-the-double-extortion-threat-landscape-158fb321']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e853288-15c7-4628-d773-00006bf22cc6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5890bd5-ee83-dfec-750c-0000b1d4ea0c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: DECRYPT-FILES.txt","pattern":"[domain-name:value = 'DECRYPT-FILES.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e894470-c178-7064-9e45-0000a0f69c25","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kbavsfyafrpsostfrkg2w2f7ttf55sz3pfqmoza3o2t3mhrdalvdu7yd.onion","pattern":"[url:value = 'http://kbavsfyafrpsostfrkg2w2f7ttf55sz3pfqmoza3o2t3mhrdalvdu7yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d072310b-3a7e-2c32-3963-00008075bd3d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://0mega.ws/","pattern":"[url:value = 'https://0mega.ws/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--819f28f6-ee72-be60-114f-000078d26a32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://0mega.cc/","pattern":"[url:value = 'https://0mega.cc/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--832d6610-ccf4-e7d1-fe9b-00009e287609","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://omegalock5zxwbhswbisc42o2q2i54vdulyvtqqbudqousisjgc7j7yd.onion/","pattern":"[url:value = 'http://omegalock5zxwbhswbisc42o2q2i54vdulyvtqqbudqousisjgc7j7yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4dc8385-6aca-5942-4cbd-00008c43c976","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/f/karakurt-data-extortion-group.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/f/karakurt-data-extortion-group.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f22870f0-c1a4-8534-2aec-00005b38e780","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/karakurt-data-extortion-group-linked-to-conti-ransomware-gang/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/karakurt-data-extortion-group-linked-to-conti-ransomware-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f8a3baf-e428-9601-8857-0000178dda9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/karakurt","pattern":"[url:value = 'https://www.ransomlook.io/group/karakurt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56edcd8d-2db4-54fb-4c3c-0000bd74faed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://t5sb509msc3q4ls06o1g8e4egfxl1o7e79yvlldakfphc0nf7rwiyphv.onion","pattern":"[url:value = 'https://t5sb509msc3q4ls06o1g8e4egfxl1o7e79yvlldakfphc0nf7rwiyphv.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54863e85-7d32-99c7-c540-00005696a1f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nrulhk2lbzt7jw6tnsq6gkjrn37j7uwfu5oxbuxezgherhuhakl2tqid.onion","pattern":"[url:value = 'http://nrulhk2lbzt7jw6tnsq6gkjrn37j7uwfu5oxbuxezgherhuhakl2tqid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c2f6795-4cfa-29dc-4be7-00008ec3fff0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jo7jezin3bmprlivyleqfv7rq3j4m36hd7bf2bguabxf2rlyrvrjwhad.onion","pattern":"[url:value = 'http://jo7jezin3bmprlivyleqfv7rq3j4m36hd7bf2bguabxf2rlyrvrjwhad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df26c8ea-ca6b-720b-1def-0000812dc8bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://53dxw3yoeirahqn263a7ihzv2hhsjzdgvwqxdcuujlsrctmqzsph6tid.onion","pattern":"[url:value = 'http://53dxw3yoeirahqn263a7ihzv2hhsjzdgvwqxdcuujlsrctmqzsph6tid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2eb9ff9e-ec79-ecc0-f4bf-000022622620","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onion/","pattern":"[url:value = 'https://omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--616bc6e9-a521-9b45-35c0-0000158566f8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://karakurt.tech","pattern":"[url:value = 'https://karakurt.tech']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--468dfc9f-f946-db7f-06c6-00002939eb09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.karanews.live","pattern":"[url:value = 'https://www.karanews.live']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3067320f-84a0-402e-4bc2-0000c18ca229","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion/","pattern":"[url:value = 'https://3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--706f7f91-5fee-a5c6-1508-00007d0d8ee9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion","pattern":"[url:value = 'http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab8b77fb-6195-a5cc-a874-000057f36cad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion","pattern":"[url:value = 'http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6830317-809d-9232-d334-0000b28371f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/anthology/avoslocker/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/avoslocker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b80c850-13df-887b-dd48-00007651b5f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://purplesec.us/breach-report/avoslocker-ransomware/","pattern":"[url:value = 'https://purplesec.us/breach-report/avoslocker-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4741339-ee0e-a76b-896c-0000e94b6fb2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/retrospective-avoslocker","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/retrospective-avoslocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d69b20b-d370-1043-187f-00001abebfb4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-284a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-284a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18f3cc96-f71b-836c-4f34-00004e13ba10","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/avos","pattern":"[url:value = 'https://www.ransomlook.io/group/avos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f3ac6c5-8a75-1203-44e9-000038beb800","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/avoslocker","pattern":"[url:value = 'https://www.ransomlook.io/group/avoslocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d60f59c4-cc69-edba-ed15-000099168068","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/2022/06/avoslocker-new-arsenal.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2022/06/avoslocker-new-arsenal.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b5b21b9-9d43-9cfd-abe5-00004edf1de5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ed74f2c-cab4-3aa6-71f4-0000aa77eee9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07209790-729e-0cc1-a945-00000c0bc14c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2021/07/23/deep-dive-analysis-avoslocker-ransomware","pattern":"[url:value = 'https://blog.cyble.com/2021/07/23/deep-dive-analysis-avoslocker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ec6a40d-dde9-e462-0987-000044c2c8cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a6212e8-2d86-aee3-d938-000088cfb43b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cdn.pathfactory.com/assets/10555/contents/400686/13f4424c-05b4-46db-bb9c-6bf9b5436ec4.pdf","pattern":"[url:value = 'https://cdn.pathfactory.com/assets/10555/contents/400686/13f4424c-05b4-46db-bb9c-6bf9b5436ec4.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fe34b07-554a-8faf-10c1-0000dbb77668","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/12/22/avos-locker-remotely-accesses-boxes-even-running-in-safe-mode/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/12/22/avos-locker-remotely-accesses-boxes-even-running-in-safe-mode/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de1bdb20-d5c9-ab03-171c-00002492d6a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2022/01/17/avoslocker-ransomware-linux-version-targets-vmware-esxi-servers/","pattern":"[url:value = 'https://blog.cyble.com/2022/01/17/avoslocker-ransomware-linux-version-targets-vmware-esxi-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98abd99a-b0ab-bae7-a0fc-0000150c7c26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.vmware.com/security/2022/02/avoslocker-modern-linux-ransomware-threats.html","pattern":"[url:value = 'https://blogs.vmware.com/security/2022/02/avoslocker-modern-linux-ransomware-threats.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fed333d-902f-433f-fdb0-0000f215c8a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.lexfo.fr/Avoslocker.html","pattern":"[url:value = 'https://blog.lexfo.fr/Avoslocker.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8018bfa-769b-d768-f6a7-0000e355c246","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.qualys.com/vulnerabilities-threat-research/2022/03/06/avoslocker-ransomware-behavior-examined-on-windows-linux","pattern":"[url:value = 'https://blog.qualys.com/vulnerabilities-threat-research/2022/03/06/avoslocker-ransomware-behavior-examined-on-windows-linux']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--280a3492-317e-078e-5eb4-0000511e33f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2022/04/threat-thursday-avoslocker-prompts-advisory-from-fbi-and-fincen","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/04/threat-thursday-avoslocker-prompts-advisory-from-fbi-and-fincen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dd18810-c7a3-d3e2-e789-0000eade16d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3ac2a68-8d2b-ffe0-9219-000002b9fc6e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/elf.avoslocker","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/elf.avoslocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7473996-c624-01ae-b2ed-0000ebd4d8a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tripwire.com/state-of-security/avoslocker-ransomware-what-you-need-to-know","pattern":"[url:value = 'https://www.tripwire.com/state-of-security/avoslocker-ransomware-what-you-need-to-know']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaf50a0b-d6c8-5fca-1e84-0000cf1b44fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.techrepublic.com/article/avos-ransomware-updates-attack/","pattern":"[url:value = 'https://www.techrepublic.com/article/avos-ransomware-updates-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d8a2ac8-8e3b-7d98-8d85-000009cc247d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://brandefense.io/blog/ransomware/in-depth-analysis-of-avoslocker-ransomware/","pattern":"[url:value = 'https://brandefense.io/blog/ransomware/in-depth-analysis-of-avoslocker-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--824041f2-f8ab-67c6-f096-0000dd88dd46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.picussecurity.com/resource/avos-locker-ransomware-group","pattern":"[url:value = 'https://www.picussecurity.com/resource/avos-locker-ransomware-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0339b708-2411-120a-7ac7-00000ee4a462","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.kroll.com/en/insights/publications/cyber/avoslocker-ransomware-update","pattern":"[url:value = 'https://www.kroll.com/en/insights/publications/cyber/avoslocker-ransomware-update']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bef598b-6881-0d42-17de-000042daa850","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/avoslocker-ransomware/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/avoslocker-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd97f881-8971-6ae0-3452-0000a68f59f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.avertium.com/resources/threat-reports/in-depth-look-at-avoslocker-ransomware","pattern":"[url:value = 'https://www.avertium.com/resources/threat-reports/in-depth-look-at-avoslocker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2cadbde-ea12-4720-1da9-00006a1c6a3c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/content/images/AVvXsEhKEpexiVYKoELvESd2mP0ZXLbQYgWcVJaE5VB9--yD3vS6FTVNfNbPkAHtJp3KjN1ANKVLa4zWvuEFN68QaepAj_xF3j9TrzqUMoOwvQXx_zIOH9Ar31JgWYX4mlpUIPLaLi76aWawvifF56qKZ1mgXncCRwAmu_fjqmD_PTWu_84E_uTqnW2qZIPM/s16000/image4.png","pattern":"[url:value = 'https://blog.talosintelligence.com/content/images/AVvXsEhKEpexiVYKoELvESd2mP0ZXLbQYgWcVJaE5VB9--yD3vS6FTVNfNbPkAHtJp3KjN1ANKVLa4zWvuEFN68QaepAj_xF3j9TrzqUMoOwvQXx_zIOH9Ar31JgWYX4mlpUIPLaLi76aWawvifF56qKZ1mgXncCRwAmu_fjqmD_PTWu_84E_uTqnW2qZIPM/s16000/image4.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--273a1de7-11c9-39e2-2a7d-000061bb3602","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion","pattern":"[url:value = 'http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7149b8b-d5a7-2225-1bbb-0000917936c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.torproject.org/download/\\nDetails","pattern":"[url:value = 'https://www.torproject.org/download/\\\\nDetails']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5690242-eb41-408a-a9fe-00008130a7bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion.\\nThis","pattern":"[url:value = 'http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion.\\\\nThis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac4f4ff3-046d-96ba-3fe8-0000d2768740","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/redalert","pattern":"[url:value = 'https://www.ransomlook.io/group/redalert']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43f905c9-ed6a-f8e8-ed39-0000d31e56df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gwvueqclwkz3h7u75cks2wmrwymg3qemfyoyqs7vexkx7lhlteagmsyd.onion/","pattern":"[url:value = 'http://gwvueqclwkz3h7u75cks2wmrwymg3qemfyoyqs7vexkx7lhlteagmsyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9435b18b-97c4-7e58-6e88-0000b27bea81","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ybxtfftwy2iwfqjy7fvvcrt5sd55fx3sk2yuztbx3y2dxb4dvqdhsiid.onion","pattern":"[url:value = 'http://ybxtfftwy2iwfqjy7fvvcrt5sd55fx3sk2yuztbx3y2dxb4dvqdhsiid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6195651-5fd3-ac0a-10ed-0000118253ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ocsmkribkmoij3uhvhxlpxlpebqhzo5uingee7mvebnv57jqya745uyd.onion","pattern":"[url:value = 'http://ocsmkribkmoij3uhvhxlpxlpebqhzo5uingee7mvebnv57jqya745uyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4b5817e-f9bd-1a2d-b6e8-0000338aee19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qrcxhs4x2n4a65rk3zbwm5hu6475bi4w2mdjhfmusovnjc6hc6qcv3ad.onion","pattern":"[url:value = 'http://qrcxhs4x2n4a65rk3zbwm5hu6475bi4w2mdjhfmusovnjc6hc6qcv3ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--367ca4d3-75a5-22e3-30a4-0000e8618a0b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog2hkbm6gogpv2b3uytzi3bj5d5zmc4asbybumjkhuqhas355janyd.onion/","pattern":"[url:value = 'http://blog2hkbm6gogpv2b3uytzi3bj5d5zmc4asbybumjkhuqhas355janyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--441f4a0d-8afb-2700-146a-00007b307cc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/blackbyte","pattern":"[url:value = 'https://www.ransomlook.io/group/blackbyte']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afdfb99a-e873-8367-b24e-00002799a293","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/my/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/my/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c011e128-47e8-e4a3-1553-0000effdb069","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/trellix-global-defenders-analysis-and-protections-for-blackbyte-ransomware.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/trellix-global-defenders-analysis-and-protections-for-blackbyte-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9f81056-b480-0a41-bdb1-000065e37f1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://de.darktrace.com/blog/detecting-the-unknown-revealing-uncategorised-ransomware-using-darktrace","pattern":"[url:value = 'https://de.darktrace.com/blog/detecting-the-unknown-revealing-uncategorised-ransomware-using-darktrace']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46a18aa5-aa49-692b-20f2-00004b7839dc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b823644f-1795-ffd5-fd6f-00002c46503a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/","pattern":"[url:value = 'https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e61bfc8-641f-d65d-0da4-000032226171","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/","pattern":"[url:value = 'https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2aa393e4-0196-2231-8e82-00004f2e1673","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/the-blackbyte-ransomware-group-is/","pattern":"[url:value = 'https://blog.talosintelligence.com/the-blackbyte-ransomware-group-is/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5c29e16-0767-ac3f-5cf7-000076759ed1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/analysis-blackbyte-ransomwares-go-based-variants","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/analysis-blackbyte-ransomwares-go-based-variants']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fa98cf8-1f05-a6b8-8279-0000779dabe2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/research/trellix-global-defenders-analysis-and-protections-for-blackbyte-ransomware.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/research/trellix-global-defenders-analysis-and-protections-for-blackbyte-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33829c95-aee6-63a4-5f76-0000d1ec189c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fbi-blackbyte-ransomware-breached-us-critical-infrastructure/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fbi-blackbyte-ransomware-breached-us-critical-infrastructure/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9173cc0f-8e59-a691-e774-00005169bac6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/san-francisco-49ers-confirm-ransomware-attack/","pattern":"[url:value = 'https://therecord.media/san-francisco-49ers-confirm-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac0e18bb-0f2d-fc76-3ac1-000058dee1ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2022/220211.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2022/220211.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e243f85a-6fab-d3c1-dd27-0000a6ed95b5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://redcanary.com/blog/blackbyte-ransomware/","pattern":"[url:value = 'https://redcanary.com/blog/blackbyte-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58c01768-cd41-b722-2643-00002c559948","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lh5.googleusercontent.com/sw0iG6WGVHRRM7NQsTjmt1ut60TH-_VPe1Fo57XuYeBOMw9PrvI4lCqyCPueiEXvbAZ-ks3KHXmnS81JvGYaMf31tSL1Eejx-BZ973EctAqjb-u3R6k-9UC0GqhkLQxgMC6lqtp7","pattern":"[url:value = 'https://lh5.googleusercontent.com/sw0iG6WGVHRRM7NQsTjmt1ut60TH-_VPe1Fo57XuYeBOMw9PrvI4lCqyCPueiEXvbAZ-ks3KHXmnS81JvGYaMf31tSL1Eejx-BZ973EctAqjb-u3R6k-9UC0GqhkLQxgMC6lqtp7']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a513fd2f-1c4e-9e7f-5d6a-0000e2cb9af8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://torproject.org/\\n\\n2)","pattern":"[url:value = 'https://torproject.org/\\\\n\\\\n2)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6265ea00-d713-187d-85f2-00006d3fcb7d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://torproject.org/","pattern":"[url:value = 'https://torproject.org/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6d0698d-89cd-6cc5-95da-00002f77cfa1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kpfj3bmo77bwpy2f5zzwj4knatueuv7t3ldlpp4tlrmv2buiziw2tdyd.onion","pattern":"[url:value = 'http://kpfj3bmo77bwpy2f5zzwj4knatueuv7t3ldlpp4tlrmv2buiziw2tdyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d36b6744-0404-33df-e597-0000733925d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p5quu5ujzzswxv4nxyuhgg3fjj2vy2a3zmtcowalkip2temdfadanlyd.onion/","pattern":"[url:value = 'http://p5quu5ujzzswxv4nxyuhgg3fjj2vy2a3zmtcowalkip2temdfadanlyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--816e4850-3026-fa85-ffe3-00000a60e2cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://inbukcc4xk67uzbgkzufdqq3q3ikhwtebqxza5zlfbtzwm2g6usxidqd.onion:81","pattern":"[url:value = 'http://inbukcc4xk67uzbgkzufdqq3q3ikhwtebqxza5zlfbtzwm2g6usxidqd.onion:81']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0788178-1120-1868-79eb-0000d2d22cb2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vzzf6yg67cffqndnwg56e4psw45rup45f2mis7bwblg5fs7e5voagsqd.onion:81","pattern":"[url:value = 'http://vzzf6yg67cffqndnwg56e4psw45rup45f2mis7bwblg5fs7e5voagsqd.onion:81']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2886f67f-2794-6ced-c85a-0000ede60ac5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://a2dbso6dijaqsmut36r6y4nps4cwivmfog5bpzf6uojovce6f3gl36id.onion:81","pattern":"[url:value = 'http://a2dbso6dijaqsmut36r6y4nps4cwivmfog5bpzf6uojovce6f3gl36id.onion:81']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2033b395-8dc4-1a91-28bb-00007f96a3f8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion/","pattern":"[url:value = 'http://53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--175b154e-c88f-6c92-8e61-0000457e8b1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion/","pattern":"[url:value = 'http://jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47e0965a-1941-28d0-c3d5-0000124c216b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion","pattern":"[url:value = 'http://dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8de4d0e1-a204-dd31-00a0-00007a091cca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/blackbasta-ransomware-linked-to-conti-gang/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/blackbasta-ransomware-linked-to-conti-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51000db9-da3e-b24c-57da-00008b57fe2d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/f/blackbasta-ransomware-attacks-target-windows-and-linux.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/f/blackbasta-ransomware-attacks-target-windows-and-linux.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d398d8a-178f-ed6e-cfb8-0000c9fcb56b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/blackbasta-ransomware-group-an-analysis/","pattern":"[url:value = 'https://www.sentinelone.com/labs/blackbasta-ransomware-group-an-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5efe0641-f2a9-04af-2224-00008971da9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55799751-a7bd-b30c-94c1-00008ed1d439","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/blackbasta","pattern":"[url:value = 'https://www.ransomlook.io/group/blackbasta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c18f901a-5f27-7a50-5a86-0000e9817762","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/","pattern":"[url:value = 'https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d2fa97c-6e6f-f137-097a-00007d89ee2e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5f5c699-2233-647c-2b67-000056c3b02f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41b9b72a-eb6b-5583-1dda-0000d895b58e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityscorecard.com/research/a-deep-dive-into-black-basta-ransomware","pattern":"[url:value = 'https://securityscorecard.com/research/a-deep-dive-into-black-basta-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6265cd4-a166-a1ca-d5cc-0000baf54f11","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/luna-black-basta-ransomware/106950/","pattern":"[url:value = 'https://securelist.com/luna-black-basta-ransomware/106950/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2c36f8e-1c08-c3c6-32a4-0000ffd59794","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd0901f7-dc38-3e63-bd72-0000243aa9a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://gbhackers.com/black-basta-ransomware/","pattern":"[url:value = 'https://gbhackers.com/black-basta-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d23d15a-bee3-9c39-30f2-0000af196bb9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityintelligence.com/posts/black-basta-ransomware-group-besting-network/","pattern":"[url:value = 'https://securityintelligence.com/posts/black-basta-ransomware-group-besting-network/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d0a9361-1ac3-eaa9-eadf-000007dad473","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75eaa9d6-fe88-8328-e5f9-00004268009f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--755e53a5-51ed-bb85-9284-00003680a834","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--051046d0-f885-6d20-b273-0000c26b887c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f162813-0206-6c24-e8f4-0000439f43e3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/e/examining-the-black-basta-ransomwares-infection-routine/blackbasta08PII.PNG","pattern":"[url:value = 'https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/e/examining-the-black-basta-ransomwares-infection-routine/blackbasta08PII.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46363abf-3cfd-b8f6-afee-0000d067b725","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/e/examining-the-black-basta-ransomwares-infection-routine/blackbasta07PII.PNG","pattern":"[url:value = 'https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/e/examining-the-black-basta-ransomwares-infection-routine/blackbasta07PII.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39751d02-dc04-9834-7ec7-000028f17856","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/b/black-basta/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/b/black-basta/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e582b11c-67bc-9434-9038-00001f2262aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/b/black-basta/wallpaper.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/b/black-basta/wallpaper.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1abfad5-e508-d058-af5f-0000d063c1d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://aazsbsgya565y1u2c6Lay6yfiebkcbtvvcytyolt33s77xypi7nypxyd.onion/","pattern":"[url:value = 'https://aazsbsgya565y1u2c6Lay6yfiebkcbtvvcytyolt33s77xypi7nypxyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b064f35-f601-6608-0119-0000485494a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://torproject.org)","pattern":"[url:value = 'https://torproject.org)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55aa82e8-c278-c670-bbb2-00006c3174dc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ond5arqab77n6tykvi4aqp7oqegqdfgqfyf7fzyhfyhmbp7iafpzdtad.onion/","pattern":"[url:value = 'http://ond5arqab77n6tykvi4aqp7oqegqdfgqfyf7fzyhfyhmbp7iafpzdtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fbaa0ee-0603-a870-1180-0000d2b95e20","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bpeln2aqs66qqfuex2cvcyjiy5ggcwbyh5nbmxzxt6daamkmpmufv4qd.onion/","pattern":"[url:value = 'http://bpeln2aqs66qqfuex2cvcyjiy5ggcwbyh5nbmxzxt6daamkmpmufv4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9356123f-c83b-b110-7737-000021bd6382","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/","pattern":"[url:value = 'https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion:80/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a2002a5-08b7-7eed-60a4-0000229d98f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://onlylegalstuff6.top/","pattern":"[url:value = 'http://onlylegalstuff6.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34ab0f8f-de7a-8785-b783-0000d8837f88","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l6zxfn3u2s4bl4vt3nvpve6uibqn3he3tgwdpkeeplhwlfwy3ifbt5id.onion/","pattern":"[url:value = 'http://l6zxfn3u2s4bl4vt3nvpve6uibqn3he3tgwdpkeeplhwlfwy3ifbt5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05e6b450-6648-809e-5bb4-0000510a47ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://databasebb3.top/","pattern":"[url:value = 'http://databasebb3.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffada415-5da2-d474-2753-00008c978272","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://daulpxe3epdysjozaujz4sj7rytanp4suvdnebxkwdfcuzwxlslebvyd.onion/","pattern":"[url:value = 'http://daulpxe3epdysjozaujz4sj7rytanp4suvdnebxkwdfcuzwxlslebvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54c8df72-d6cb-7e50-cefc-0000301c6a96","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fmzipzpirdpfelbbvnfhoehqxbqg7s7efmgce6hpr5xdcmeazdmic2id.onion/","pattern":"[url:value = 'http://fmzipzpirdpfelbbvnfhoehqxbqg7s7efmgce6hpr5xdcmeazdmic2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5981b3f2-1229-6aa0-8f47-00001761ac84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://megatron3.top/","pattern":"[url:value = 'http://megatron3.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6c1c41f-25c4-c716-a639-0000a0f94169","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://greenmotors5.top/","pattern":"[url:value = 'http://greenmotors5.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11d18a66-dcd5-bbf3-c20c-0000889460ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://stuffstevenpeters4.top/","pattern":"[url:value = 'http://stuffstevenpeters4.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ed81ff1-b8e1-b850-eef9-00000522082f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://thesiliconroad1.top/","pattern":"[url:value = 'http://thesiliconroad1.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--949f5b5a-9302-760b-4800-0000aca2e416","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://weqv4fxkacebqrjd3lmnss6lrmoxoyihtcc6kdc6mblbv62p5q6skgid.onion/","pattern":"[url:value = 'http://weqv4fxkacebqrjd3lmnss6lrmoxoyihtcc6kdc6mblbv62p5q6skgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45e0fde2-baab-e774-0a6a-00005f083cad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://r6qkk55wxvy2ziy47oyhptesucwdqqaip23uxregdgquq5oxxlpeecad.onion/","pattern":"[url:value = 'http://r6qkk55wxvy2ziy47oyhptesucwdqqaip23uxregdgquq5oxxlpeecad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--621ff378-250e-195a-c17f-00001c0dc3af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6y2qjrzzt4inluxzygdfxccym5qjy2ltyae7vnxtoyeotfg3ljwqtaid.onion/","pattern":"[url:value = 'http://6y2qjrzzt4inluxzygdfxccym5qjy2ltyae7vnxtoyeotfg3ljwqtaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--028bc406-a7f6-5929-ab72-0000250771fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion","pattern":"[url:value = 'https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c2bdcea-0a88-be96-bb14-0000d13263e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://stniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd.onion/","pattern":"[url:value = 'https://stniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aadc473f-6d8e-e5da-8959-0000eb1ca094","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://mphasis.com/content/dam/mphasis-com/global/en/home/services/cybersecurity/icedid-infection-to-dagon-locker-ransomware-apr29-22-7.pdf","pattern":"[url:value = 'https://mphasis.com/content/dam/mphasis-com/global/en/home/services/cybersecurity/icedid-infection-to-dagon-locker-ransomware-apr29-22-7.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a649c5e4-985f-a6c1-7ddd-0000e310e74b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.broadcom.com/support/security-center/protection-bulletin/dagon-locker-ransomware","pattern":"[url:value = 'https://www.broadcom.com/support/security-center/protection-bulletin/dagon-locker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0316f42-cf77-a929-1dde-000034d36bb2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://asec.ahnlab.com/en/42037/","pattern":"[url:value = 'https://asec.ahnlab.com/en/42037/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ebe1a74-75ca-6c1d-6f11-00003b7ae10c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/anthology/dagon-locker/","pattern":"[url:value = 'https://www.sentinelone.com/anthology/dagon-locker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdc34c3e-8518-58b7-6960-000084221e8a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/dagonlocker","pattern":"[url:value = 'https://www.ransomlook.io/group/dagonlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b9ea935-45eb-632a-3c39-0000bea4dbbd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/quantum","pattern":"[url:value = 'https://www.ransomlook.io/group/quantum']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46351655-dedf-16f9-ffcc-0000d42ad847","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2022/04/25/quantum-ransomware/","pattern":"[url:value = 'https://thedfirreport.com/2022/04/25/quantum-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0234b404-6a6e-0b48-1438-000052627279","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--352cc7f1-5cb2-349a-e731-0000f6137116","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://kienmanowar.wordpress.com/2021/08/04/quicknote-mountlocker-some-pseudo-code-snippets/","pattern":"[url:value = 'https://kienmanowar.wordpress.com/2021/08/04/quicknote-mountlocker-some-pseudo-code-snippets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10d27f0a-1533-1a82-70ff-0000399b16a9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/","pattern":"[url:value = 'https://chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e850d1c-3025-0d98-5bc6-0000c93616d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/Finch4/Malware-Analysis-Reports/tree/master/MountLocker","pattern":"[url:value = 'https://github.com/Finch4/Malware-Analysis-Reports/tree/master/MountLocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--047a977a-53fd-3d9e-26e4-000023c02cd3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2020/12/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates","pattern":"[url:value = 'https://blogs.blackberry.com/en/2020/12/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c5abe45-a605-b008-2174-000073df3105","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://dissectingmalwa.re/between-a-rock-and-a-hard-place-exploring-mount-locker-ransomware.html","pattern":"[url:value = 'https://dissectingmalwa.re/between-a-rock-and-a-hard-place-exploring-mount-locker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1fb895e-1ae9-a6a4-d509-0000527a4e53","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-now-targets-your-turbotax-tax-returns/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-now-targets-your-turbotax-tax-returns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5bd7b92-425f-d639-e067-000073fa46f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5373c59d-7c3a-acf6-03d9-00007e3c6dd3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityscorecard.pathfactory.com/research/quantum-ransomware","pattern":"[url:value = 'https://securityscorecard.pathfactory.com/research/quantum-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--785be2aa-e5d0-e921-7322-0000b0688472","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f2080a7-411f-4880-60f8-000028acb6f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.guidepointsecurity.com/wp-content/uploads/2021/04/Anonymized-Ransom-Note-1-1024x655.png","pattern":"[url:value = 'https://www.guidepointsecurity.com/wp-content/uploads/2021/04/Anonymized-Ransom-Note-1-1024x655.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cc6a30b-f77d-bef9-156b-00000f0e229c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zes5libwlgrfnttkpgtbimbixyb4t6k6rhuxhayzq76j7zgxqt64piad.onion","pattern":"[url:value = 'http://zes5libwlgrfnttkpgtbimbixyb4t6k6rhuxhayzq76j7zgxqt64piad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00b8852b-8fe7-c61b-1074-00004320bb1f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yizydlt5rl6br3qihvjdgfsprrq2ealnoq2eg6koqs6yv47d3byucxqd.onion","pattern":"[url:value = 'http://yizydlt5rl6br3qihvjdgfsprrq2ealnoq2eg6koqs6yv47d3byucxqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c452e9b8-11eb-37dc-b67a-000035e292bf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xrjwgvn3sv75zrcmfdarz3futzx54uyy6o6si5pj5phhee3nlokkopyd.onion","pattern":"[url:value = 'http://xrjwgvn3sv75zrcmfdarz3futzx54uyy6o6si5pj5phhee3nlokkopyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18eb37fe-533b-2753-91e8-0000ecf380a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://x3djueexuhivjtdj5udkjzfsm37kiaoeqy5ywluljbfsf2wsuom5yyid.onion","pattern":"[url:value = 'http://x3djueexuhivjtdj5udkjzfsm37kiaoeqy5ywluljbfsf2wsuom5yyid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7bc31d3-4233-dfd7-6f07-00007f333665","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wly4qu4q6abduzwm7ryai4ehysgnk5f25v6ddofcyuasbfntwnqjkcid.onion","pattern":"[url:value = 'http://wly4qu4q6abduzwm7ryai4ehysgnk5f25v6ddofcyuasbfntwnqjkcid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc709f71-76b1-73d9-ad0f-00000799a0fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wcmxtfzde2hmhsreqgflwvkawmyfvuyqcebuq5w5qj3rllo2jpb4l2yd.onion","pattern":"[url:value = 'http://wcmxtfzde2hmhsreqgflwvkawmyfvuyqcebuq5w5qj3rllo2jpb4l2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--191d278b-a252-993f-bdd6-0000a0d56f6a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uwr2mmcqtroeyu6bzgivwwzdcpe2a4e74r2srlzveyltsi57n5bnsbqd.onion","pattern":"[url:value = 'http://uwr2mmcqtroeyu6bzgivwwzdcpe2a4e74r2srlzveyltsi57n5bnsbqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ce30880-0a0a-6919-e60d-0000e49967b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rrmywkltwjpntybqj7migd5ibdzzxulnhgndb6dnoe6unlljslqb7lid.onion","pattern":"[url:value = 'http://rrmywkltwjpntybqj7migd5ibdzzxulnhgndb6dnoe6unlljslqb7lid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4970265b-d41f-50c2-a0b7-0000074476ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://q45frho6hatxtx7qxjytt4cswinakvc2h6iag65jlsaws32xdzz47kyd.onion","pattern":"[url:value = 'http://q45frho6hatxtx7qxjytt4cswinakvc2h6iag65jlsaws32xdzz47kyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02d69d06-3f0b-82b3-5fb6-00005ba4baa8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://oyjydoka32xa24doeymhq4thoibxqdd7i7hnngojpycd74frggkvhyyd.onion","pattern":"[url:value = 'http://oyjydoka32xa24doeymhq4thoibxqdd7i7hnngojpycd74frggkvhyyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1b68077-ab5d-8a24-3b71-0000bc49b558","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ohmhgcrvte6aftgnm5lefq7ztannicarzo6lus2bih3zg6ugklf4tsyd.onion","pattern":"[url:value = 'http://ohmhgcrvte6aftgnm5lefq7ztannicarzo6lus2bih3zg6ugklf4tsyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4af9327-9f06-a3ea-2897-0000d57172cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nxvvamxmbdn3latdplq6azgeeuieaek32h674nl6lzavcod2f2obvxyd.onion","pattern":"[url:value = 'http://nxvvamxmbdn3latdplq6azgeeuieaek32h674nl6lzavcod2f2obvxyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c1846aa-022b-8719-aa84-000095d6ed41","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nugus3xk456m3xhokm2q5zusujhqodirm5vfke6jmsej2jy6sgbn4oqd.onion","pattern":"[url:value = 'http://nugus3xk456m3xhokm2q5zusujhqodirm5vfke6jmsej2jy6sgbn4oqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0729f202-d0bf-430c-9c86-000093ca8a94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://leqg2fthiage4ockldnf7trwdx3bvehni7vjf6wbwsitnbjtotbv3nid.onion","pattern":"[url:value = 'http://leqg2fthiage4ockldnf7trwdx3bvehni7vjf6wbwsitnbjtotbv3nid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1e520dd-2a42-ae4c-78bc-000034c3d149","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://k2j6llaw66bvlgxcy67uj2prdqqzbl7aj46wab4mpdyizpmati55kfad.onion","pattern":"[url:value = 'http://k2j6llaw66bvlgxcy67uj2prdqqzbl7aj46wab4mpdyizpmati55kfad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a41e555b-296b-14ac-81c9-0000a95c1029","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://friazjtqhznoknwi5354lnkwa4lhgjti74l4asfhsjeoe5dulwitpcqd.onion","pattern":"[url:value = 'http://friazjtqhznoknwi5354lnkwa4lhgjti74l4asfhsjeoe5dulwitpcqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65b3dae8-6093-83fc-0f31-00007a380b70","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fjlprvuqzs6h4ielcdkmof5nju3ent7c34esaptm7677xono7osvp5yd.onion","pattern":"[url:value = 'http://fjlprvuqzs6h4ielcdkmof5nju3ent7c34esaptm7677xono7osvp5yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4107d19e-f6ab-e441-43ea-000005bcb1e8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dw6sy3pt54fh6d3yo4wpb7qjtwdlyyi3qd5oabdwlmlmuyhsxvnblvqd.onion","pattern":"[url:value = 'http://dw6sy3pt54fh6d3yo4wpb7qjtwdlyyi3qd5oabdwlmlmuyhsxvnblvqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a69f76bf-fe8b-1d98-5648-000023a1ac80","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dblgdn4manmaiewnsqa3vgm26v7ujtx75wtev5pyfmtpww4ofqrqpiid.onion","pattern":"[url:value = 'http://dblgdn4manmaiewnsqa3vgm26v7ujtx75wtev5pyfmtpww4ofqrqpiid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66aa07a4-d261-ea82-a643-000053456c45","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ct7jsq3dbwcvcafnwli7tfv2pf62y2rfhos4a66gu7twqkcclkih6wqd.onion","pattern":"[url:value = 'http://ct7jsq3dbwcvcafnwli7tfv2pf62y2rfhos4a66gu7twqkcclkih6wqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e44610a-1b38-30fc-e2c5-0000f4b61f59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cee77a5wsey5vohubq76en4bgsqbdrasito3zn7ziu5vouhbzxtx6syd.onion","pattern":"[url:value = 'http://cee77a5wsey5vohubq76en4bgsqbdrasito3zn7ziu5vouhbzxtx6syd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0942aa3b-8d07-5931-90e5-000010723b09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bi7v6o5djhfji22usugjzpk26nvvwugaubrf3yypyvmkzw7su2nad5id.onion","pattern":"[url:value = 'http://bi7v6o5djhfji22usugjzpk26nvvwugaubrf3yypyvmkzw7su2nad5id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc13cd14-351d-64c9-5196-000015b3a623","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bfdwhgjey6xb25e6pc6i7upnswh4znqwwnmlmgzapiwfmt7ugzcwvyyd.onion","pattern":"[url:value = 'http://bfdwhgjey6xb25e6pc6i7upnswh4znqwwnmlmgzapiwfmt7ugzcwvyyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62b120e2-7eb3-7daa-2d91-000077f2e6ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://b2rt3dmb62jo62e2rr5rfrpyomka477tjkcni2fsamjd3wksolae5wqd.onion","pattern":"[url:value = 'http://b2rt3dmb62jo62e2rr5rfrpyomka477tjkcni2fsamjd3wksolae5wqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d8c7b21-6053-8ac8-ca7c-0000e53c0672","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://agxyd52t6tfoahsvi6mfk7nqwpoe2xj6wp75vnv7ffrfxg5vtw6guxid.onion","pattern":"[url:value = 'http://agxyd52t6tfoahsvi6mfk7nqwpoe2xj6wp75vnv7ffrfxg5vtw6guxid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bab841a-6d08-d298-10f5-0000fb2c443c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7sqjgyldxtur4p3nkpdzacldqonnovklnibxhz4y6saremsrmh6vf2yd.onion","pattern":"[url:value = 'http://7sqjgyldxtur4p3nkpdzacldqonnovklnibxhz4y6saremsrmh6vf2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2173067d-9a9a-e0a7-0863-00003709398c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7qlb63hy45ijihaeal26uyoms4r33dlrg64dr7ry7blnzhhwhov6jsad.onion","pattern":"[url:value = 'http://7qlb63hy45ijihaeal26uyoms4r33dlrg64dr7ry7blnzhhwhov6jsad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58be63f9-8ae2-d43a-1a34-00002c6aab46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://77jtf3wyb4rtsemeodl6h3hfblhgwj32ex3r7ywigg5mzfaqf7w5x7qd.onion","pattern":"[url:value = 'http://77jtf3wyb4rtsemeodl6h3hfblhgwj32ex3r7ywigg5mzfaqf7w5x7qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6293bf1-4eb4-fd14-9cd4-00003e702bab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6kkjbpmqavf2nvs33furf3hywg2z4e4zrnwnmzegcpq4atfyp3jilnid.onion","pattern":"[url:value = 'http://6kkjbpmqavf2nvs33furf3hywg2z4e4zrnwnmzegcpq4atfyp3jilnid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13c6ee9b-c409-09bb-f647-0000b7caab4b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3uzycwcxrccpvrwx43mpr3gxwcqqgu4x72kedws6zuolp45gopjrzqyd.onion","pattern":"[url:value = 'http://3uzycwcxrccpvrwx43mpr3gxwcqqgu4x72kedws6zuolp45gopjrzqyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6dc2962-ed19-6807-865a-000074065b32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2k5qdebrbzv2uj2xz25f53bhjyqgmv2vixyy7p3vaeeb2bqz6jhnalad.onion","pattern":"[url:value = 'http://2k5qdebrbzv2uj2xz25f53bhjyqgmv2vixyy7p3vaeeb2bqz6jhnalad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fed5463b-0c5b-35cd-a0e7-00008cd281f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2gknqtqreqfoedfd3sey4vqgp7fhc4xyagtj6yl3pz6swkliuakfx7ad.onion","pattern":"[url:value = 'http://2gknqtqreqfoedfd3sey4vqgp7fhc4xyagtj6yl3pz6swkliuakfx7ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dc30ea5-5af0-2a96-1625-0000b72b64ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://275dg33wjetp6arghjtp3d7265nsknx2heho5n6bqioy2ehl7c3i3iyd.onion","pattern":"[url:value = 'http://275dg33wjetp6arghjtp3d7265nsknx2heho5n6bqioy2ehl7c3i3iyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecf70ced-76a6-f137-d88b-0000da202e02","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://26gzvue4vlgxuiaaotxl3bbdepuf55sdrsailywbrc7kdrcgwo62ghqd.onion","pattern":"[url:value = 'http://26gzvue4vlgxuiaaotxl3bbdepuf55sdrsailywbrc7kdrcgwo62ghqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e9eea61-eb6a-0258-87f6-00000e4541c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dgnh6p5uq234zry7qx7bh73hj5ht3jqisgfet6s7j7uyas5i46xfdkyd.onion/?cid=","pattern":"[url:value = 'http://dgnh6p5uq234zry7qx7bh73hj5ht3jqisgfet6s7j7uyas5i46xfdkyd.onion/?cid=']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--829a7bd3-ea0c-22b6-155c-0000a7a81422","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion","pattern":"[url:value = 'http://quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d557b18-fa8e-b955-e3fb-00003189b23d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/hive","pattern":"[url:value = 'https://www.ransomlook.io/group/hive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aff84b7a-2b1a-c090-d729-00000dfb4467","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/","pattern":"[url:value = 'https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a1afaae-4a96-a408-708d-000034a1c503","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.scmagazine.com/brief/breach/novel-obfuscation-leveraged-by-hive-ransomware","pattern":"[url:value = 'https://www.scmagazine.com/brief/breach/novel-obfuscation-leveraged-by-hive-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ae65b5e-9026-4b3a-6f0c-00008272854c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals","pattern":"[url:value = 'https://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0f55849-3956-f37e-dc83-0000348822ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b1fec9a-c719-b450-d43c-00007b31c9e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_hive_2021_v1.pdf","pattern":"[url:value = 'https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_hive_2021_v1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35797dae-5edb-20ba-b5bd-000094d8fbd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2021/210825.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2021/210825.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7cc43cc-1544-c2aa-7aef-00002545b830","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.connectwise.com/resources/hive-profile","pattern":"[url:value = 'https://www.connectwise.com/resources/hive-profile']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86c49087-485d-dd27-bc5e-0000fd44c49e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hive-ransomware-uses-new-ipfuscation-trick-to-hide-payload/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hive-ransomware-uses-new-ipfuscation-trick-to-hide-payload/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07ef5c56-0856-48a0-bec4-0000bafcfa1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.sentinelone.com/hive-attacks-analysis-of-the-human-operated-ransomware-targeting-healthcare/","pattern":"[url:value = 'https://labs.sentinelone.com/hive-attacks-analysis-of-the-human-operated-ransomware-targeting-healthcare/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9bc6c0e-3706-4492-a8cc-0000f577b301","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://yoroi.company/research/on-the-footsteps-of-hive-ransomware/","pattern":"[url:value = 'https://yoroi.company/research/on-the-footsteps-of-hive-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d35ac11-1017-4666-854e-0000bd93bba2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1455628865229950979","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1455628865229950979']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--597d6312-5e29-d7d4-fb8f-00008bb0070c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/ESETresearch/status/1454100591261667329","pattern":"[url:value = 'https://twitter.com/ESETresearch/status/1454100591261667329']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c9ae5cb-284a-ec5a-c371-00005a5f4180","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/hive-ransomware-shuts-down-california-health-care-organization/","pattern":"[url:value = 'https://therecord.media/hive-ransomware-shuts-down-california-health-care-organization/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--482a71a6-bd6b-ce59-bc94-0000c41ce555","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/academics-publish-method-for-recovering-data-encrypted-by-the-hive-ransomware/","pattern":"[url:value = 'https://therecord.media/academics-publish-method-for-recovering-data-encrypted-by-the-hive-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--378bdcfa-c4aa-b097-5a2f-00001bc26324","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thehackernews.com/2022/02/master-key-for-hive-ransomware.html","pattern":"[url:value = 'https://thehackernews.com/2022/02/master-key-for-hive-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--882178e2-040f-6102-317f-0000f59fa248","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityaffairs.co/wordpress/128232/security/recover-files-hive-ransomware.html","pattern":"[url:value = 'https://securityaffairs.co/wordpress/128232/security/recover-files-hive-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eb13fd2-b51b-083b-66d6-00009ec30d48","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lifars.com/2022/02/how-to-decrypt-the-files-encrypted-by-the-hive-ransomware/","pattern":"[url:value = 'https://lifars.com/2022/02/how-to-decrypt-the-files-encrypted-by-the-hive-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ba392c5-cebe-0578-30b5-00006fba0bd4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/rivitna/Malware/tree/main/Hive","pattern":"[url:value = 'https://github.com/rivitna/Malware/tree/main/Hive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--442273bf-1584-524f-df22-0000eb069716","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.group-ib.com/hive","pattern":"[url:value = 'https://blog.group-ib.com/hive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70fcf168-aee0-3301-59d6-00000b1eb18d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://arxiv.org/pdf/2202.08477.pdf","pattern":"[url:value = 'https://arxiv.org/pdf/2202.08477.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15c63313-abe4-7c51-9a04-00006c7a5a27","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.healthcareitnews.com/news/fbi-issues-alert-about-hive-ransomware","pattern":"[url:value = 'https://www.healthcareitnews.com/news/fbi-issues-alert-about-hive-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2571419f-4643-93db-fe74-0000cc5985a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://inf.news/en/tech/c28d9382ab78a5ac3d8fc802f3f0f1e0.html","pattern":"[url:value = 'https://inf.news/en/tech/c28d9382ab78a5ac3d8fc802f3f0f1e0.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40523f6c-989f-8d4d-4cca-000068006d4e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.varonis.com/blog/hive-ransomware-analysis","pattern":"[url:value = 'https://www.varonis.com/blog/hive-ransomware-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cfd8953-02b6-83eb-3ae2-0000b3c178d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://yoroi.company/wp-content/uploads/2022/07/Yoroi-On-The-Footsteps-of-Hive-Ransomware.pdf","pattern":"[url:value = 'https://yoroi.company/wp-content/uploads/2022/07/Yoroi-On-The-Footsteps-of-Hive-Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f640869-7a63-27b5-1b4c-000031769a57","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd2b94fb-69e2-c2ed-ef0b-0000f4766f3c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-hive","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-hive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d6e0cf5-417e-28eb-b4a5-000041c6f7db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/hive-attacks-analysis-of-the-human-operated-ransomware-targeting-healthcare/","pattern":"[url:value = 'https://www.sentinelone.com/labs/hive-attacks-analysis-of-the-human-operated-ransomware-targeting-healthcare/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80cc4ff1-4a72-69f7-2382-0000a5438198","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.hive","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.hive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--411df067-e008-1b0b-d1df-000029471901","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: DECRYPTO.txt","pattern":"[domain-name:value = 'DECRYPTO.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ed8a94e-78c2-bcb0-743d-0000fba18c7c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: key.hive","pattern":"[domain-name:value = 'key.hive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--931718d6-6639-7516-90e2-00007cba1121","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion\\n\\tLogin:","pattern":"[url:value = 'http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion\\\\n\\\\tLogin:']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32ae9beb-8efa-d2c2-89be-0000f7a7bc83","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: key.abc","pattern":"[domain-name:value = 'key.abc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--665e5a99-d902-0250-3a90-0000ca330f9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hive[REDACTED].onion/\\n","pattern":"[url:value = 'http://hive[REDACTED].onion/\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--582e3222-7600-8cef-6852-0000fe198ec6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hive[REDACTED].onion/\\nyou","pattern":"[url:value = 'http://hive[REDACTED].onion/\\\\nyou']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2f58995-8a18-30c8-e256-000028381a86","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/","pattern":"[url:value = 'https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--783022ce-ce33-b3e1-e7a2-0000ee2c8810","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2022/09/Screen-Shot-2022-09-12-at-11.18.04-AM-1024x246.png","pattern":"[url:value = 'https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2022/09/Screen-Shot-2022-09-12-at-11.18.04-AM-1024x246.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faa0264b-6777-3116-c9e6-00009db107b9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion/","pattern":"[url:value = 'http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bd6d189-2b98-5e16-10d2-0000ed01e655","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/uscert/ncas/alerts/aa22-187a","pattern":"[url:value = 'https://www.cisa.gov/uscert/ncas/alerts/aa22-187a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--779a55fd-b982-2286-f354-00009e7c7611","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://stairwell.com/wp-content/uploads/2022/07/Stairwell-Threat-Report-Maui-Ransomware.pdf","pattern":"[url:value = 'https://stairwell.com/wp-content/uploads/2022/07/Stairwell-Threat-Report-Maui-Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b37ce371-b99d-0b39-3165-00008da5da42","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/helloxd-ransomware/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/helloxd-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d5f55f0-69fc-3233-2555-00007daad387","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/wp-content/uploads/2022/06/image13.png","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/wp-content/uploads/2022/06/image13.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90914c18-f11e-3a54-301d-00002dc01584","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Hello.txt","pattern":"[domain-name:value = 'Hello.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ac4344e-5e5b-872d-f2c0-0000a9511060","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/rook","pattern":"[url:value = 'https://www.ransomlook.io/group/rook']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa18ae63-a727-4123-1dba-00009d0f394c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/","pattern":"[url:value = 'https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--960c19bc-8bc2-f72f-2725-0000aa84a77f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://seguranca-informatica.pt/rook-ransomware-analysis/","pattern":"[url:value = 'https://seguranca-informatica.pt/rook-ransomware-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68e6bcdf-fa83-9c2d-28ce-000073ba9132","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit.md","pattern":"[url:value = 'https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb5249f7-0488-848f-d7ed-0000e023e4a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/","pattern":"[url:value = 'https://chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd0144d4-22ad-6978-d7f1-00009de46218","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/techyteachme/status/1464317136944435209","pattern":"[url:value = 'https://twitter.com/techyteachme/status/1464317136944435209']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d884c67-ad7c-acfe-f637-00000641930d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk","pattern":"[url:value = 'https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ec703c4-d5f7-c71f-0200-00004cfd7fec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/pandora","pattern":"[url:value = 'https://www.ransomlook.io/group/pandora']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f960ec6c-83d4-9a33-0193-00000ac2aaab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fortinet.com/blog/threat-research/looking-inside-pandoras-box","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/looking-inside-pandoras-box']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f1533d2-2e94-0cbb-fe10-0000e3cd2554","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fortinet.com/blog/threat-research/Using-emulation-against-anti-reverse-engineering-techniques","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/Using-emulation-against-anti-reverse-engineering-techniques']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--333a7932-468a-d82a-a15b-0000eb686f6e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://kienmanowar.wordpress.com/2022/03/21/quicknote-analysis-of-pandora-ransomware/","pattern":"[url:value = 'https://kienmanowar.wordpress.com/2022/03/21/quicknote-analysis-of-pandora-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66ebe1ca-1c45-f57d-9e22-000018f3af03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://dissectingmalwa.re/blog/pandora/","pattern":"[url:value = 'https://dissectingmalwa.re/blog/pandora/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01aee5df-28f6-90ee-0556-000060c4bee4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cloudsek.com/technical-analysis-of-emerging-sophisticated-pandora-ransomware-group/","pattern":"[url:value = 'https://cloudsek.com/technical-analysis-of-emerging-sophisticated-pandora-ransomware-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0c269b2-6e4f-46e4-5681-0000f3f91c62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/","pattern":"[url:value = 'https://blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2b070d3-c974-70c7-14e3-00009fe7045f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://dissectingmalwa.re/blog/pandora","pattern":"[url:value = 'https://dissectingmalwa.re/blog/pandora']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6afba372-44ca-7628-9c83-00000c463d44","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1501857263493001217","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1501857263493001217']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b1a3542-c0a7-fe90-cfed-0000d83b27a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pandoraxyz.xyz/","pattern":"[url:value = 'http://pandoraxyz.xyz/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0d270d7-7f78-3d6e-f6f8-00003b52acf5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion/","pattern":"[url:value = 'http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--262c6058-aac1-cf0c-534a-0000c1fc3dc4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/03/31/sophos-mtr-in-real-time-what-is-astro-locker-team/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/03/31/sophos-mtr-in-real-time-what-is-astro-locker-team/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f48bfdf-188a-988f-1ddf-000069f94c59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/mount-locker-ransomware-changes-tactics/165559/","pattern":"[url:value = 'https://threatpost.com/mount-locker-ransomware-changes-tactics/165559/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0e03889-d0b2-6182-8c7f-0000ad073bf2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/mount-locker","pattern":"[url:value = 'https://www.ransomlook.io/group/mount-locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f164da5-67ef-1f95-a955-00009ac65e33","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.securitymagazine.com/articles/94954-sophos-identifies-connection-between-mount-locker-and-astro-locker-team-ransomware","pattern":"[url:value = 'https://www.securitymagazine.com/articles/94954-sophos-identifies-connection-between-mount-locker-and-astro-locker-team-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--082a5cb1-85c0-1754-c45a-0000fd5f0a0f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee27e04d-0ef8-6e80-8296-000077401d54","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyclonis.com/mount-locker-ransomware-more-dangerous","pattern":"[url:value = 'https://www.cyclonis.com/mount-locker-ransomware-more-dangerous']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3f86615-dbf3-2713-3a66-00006e5a92c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/alphv","pattern":"[url:value = 'https://www.ransomlook.io/group/alphv']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--960495f9-d53b-f4ed-6ae7-00004538b721","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/","pattern":"[url:value = 'https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e80d1e42-5ef9-c642-0d43-00002d985f8a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--742a769f-38c2-6afa-0c3a-0000a0e7adb1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2022/220420.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2022/220420.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50434f25-e375-9c03-1350-000052c48215","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f50d03e-4214-02b4-228e-000030d01940","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/german-wind-farm-operator-confirms-cybersecurity-incident-after-ransomware-group/","pattern":"[url:value = 'https://therecord.media/german-wind-farm-operator-confirms-cybersecurity-incident-after-ransomware-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--990aa4fa-6770-3262-174a-0000669b23c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware","pattern":"[url:value = 'https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--916a63e8-4261-890f-bd6b-0000b0307405","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityscorecard.com/blog/ttps-associated-with-new-version-of-blackcat-ransomware","pattern":"[url:value = 'https://securityscorecard.com/blog/ttps-associated-with-new-version-of-blackcat-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f4abcf9-1722-772d-d876-0000901a4444","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2021/12/blackcat-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2021/12/blackcat-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a92b5f10-c896-a4fc-3d16-000079cf5eac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/","pattern":"[url:value = 'https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa82fae0-a8c1-8030-9414-0000b0717e9f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/blackcat-ransomware-as-a-service.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/blackcat-ransomware-as-a-service.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3adc13c-ec1a-16df-5d95-0000a38160f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.forescout.com/resources/analysis-of-an-alphv-incident","pattern":"[url:value = 'https://www.forescout.com/resources/analysis-of-an-alphv-incident']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6435c4b4-0696-c07f-f6d1-0000cf04c56f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2e5e86b-45a5-cef2-637a-0000f6330ebe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive","pattern":"[url:value = 'https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f5974dc-d605-d33b-65b7-00002901dcc7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/sisoma2/status/1473243875158499330","pattern":"[url:value = 'https://twitter.com/sisoma2/status/1473243875158499330']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef47d39d-dc7f-61cb-ece3-000043102c0d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/a-bad-luck-blackcat/106254/","pattern":"[url:value = 'https://securelist.com/a-bad-luck-blackcat/106254/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--642e23b4-13be-2481-8570-0000545e69a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/","pattern":"[url:value = 'https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5efbe2e5-a941-102b-f98b-00001d78ed41","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://killingthebear.jorgetesta.tech/actors/alphv","pattern":"[url:value = 'https://killingthebear.jorgetesta.tech/actors/alphv']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bb28a24-785c-7204-b7cc-00002f3109c8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.group-ib.com/blackcat","pattern":"[url:value = 'https://blog.group-ib.com/blackcat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2c5d513-01bd-b483-0151-0000fd575f10","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.emsisoft.com/en/40931/ransomware-profile-alphv/","pattern":"[url:value = 'https://blog.emsisoft.com/en/40931/ransomware-profile-alphv/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76331845-74f0-e8f9-385b-0000bfecf3bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyber.gov.au/acsc/view-all-content/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat","pattern":"[url:value = 'https://www.cyber.gov.au/acsc/view-all-content/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d34c0d07-1475-866d-0903-00003bfd200e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/blackcat-ransomware/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/blackcat-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b22a1800-8646-67a0-1dd2-0000add61493","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.varonis.com/blog/alphv-blackcat-ransomware","pattern":"[url:value = 'https://www.varonis.com/blog/alphv-blackcat-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a700eb78-ba66-65d6-eb10-0000131e56c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/","pattern":"[url:value = 'https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cec9167b-e4fd-5243-6e85-000052f20d12","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/f0wl/blackCatConf","pattern":"[url:value = 'https://github.com/f0wl/blackCatConf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--948af2a9-d07c-513b-024d-00000938cad4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://1-id--ransomware-blogspot-com.translate.goog/2021/12/blackcat-ransomware.html?_x_tr_enc=1&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=ru","pattern":"[url:value = 'https://1-id--ransomware-blogspot-com.translate.goog/2021/12/blackcat-ransomware.html?_x_tr_enc=1&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=ru']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31fc6115-cd5f-443c-a90a-00002676c0d5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c51f6b37-c2bf-0e7a-625d-0000de5309e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-78.png","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-78.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14749fd7-2ec3-774e-ac0b-0000dd0145ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ihoqnxnvdwybrv6kiteiesjc3ic6du6axtv3arouxr6ddswrxa2wrbyd.onion","pattern":"[url:value = 'http://ihoqnxnvdwybrv6kiteiesjc3ic6du6axtv3arouxr6ddswrxa2wrbyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82708afb-8c90-1fb2-bbcb-0000dc8ed8e0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://32b2vdt4nrljyqwinwtqxzech5lqxtj7knkhkgk7akv5b4mfb456lhid.onion/","pattern":"[url:value = 'http://32b2vdt4nrljyqwinwtqxzech5lqxtj7knkhkgk7akv5b4mfb456lhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62982d37-d634-897a-2c56-00000bacf740","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2ehvy7e4ng3hcqp2e6af4pnnhehn3wi6ts5ulal4qtpc73c6y67x4eyd.onion/","pattern":"[url:value = 'http://2ehvy7e4ng3hcqp2e6af4pnnhehn3wi6ts5ulal4qtpc73c6y67x4eyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14b53e88-ed60-61ac-e389-0000e19e53fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://knt3cs4tkxqdnrjrzk3n7txyhb6c5szkgjwy74jomyvy5xuli5qcdsid.onion/","pattern":"[url:value = 'http://knt3cs4tkxqdnrjrzk3n7txyhb6c5szkgjwy74jomyvy5xuli5qcdsid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4998bac9-3f41-9d46-ddb6-00008af6b56c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kgu25rbtoh5v4s65pcsahocn62m6lo3u42odko6dm2oqfg5mzz3zsnid.onion/","pattern":"[url:value = 'http://kgu25rbtoh5v4s65pcsahocn62m6lo3u42odko6dm2oqfg5mzz3zsnid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20e7113d-f07e-df5d-631b-0000b5726786","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g7btluffqpexhytokv5yjvbksuzcp5ngt5jkcsvnuhajsl42q6s7fpyd.onion/","pattern":"[url:value = 'http://g7btluffqpexhytokv5yjvbksuzcp5ngt5jkcsvnuhajsl42q6s7fpyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa2fec68-753b-4643-7d26-0000eba85e25","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3id2g6u3dwvg7nsarfkgsdf3odp5hb7owvnoqbipbisekudptetuxtad.onion/","pattern":"[url:value = 'http://3id2g6u3dwvg7nsarfkgsdf3odp5hb7owvnoqbipbisekudptetuxtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e2fd515-a144-6c10-3058-0000b9052838","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4qmsi7vcdrrutxapxbc7eofjjzfsvam3fehgmk6xyivwcroqkqjij5qd.onion/","pattern":"[url:value = 'http://4qmsi7vcdrrutxapxbc7eofjjzfsvam3fehgmk6xyivwcroqkqjij5qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd7d6ded-f463-0ac5-eb04-0000abab1ecb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3xa42kwkeiwzhjybddfeifad7vn2kvsslybquledvib5xsfkylwtwyid.onion/","pattern":"[url:value = 'http://3xa42kwkeiwzhjybddfeifad7vn2kvsslybquledvib5xsfkylwtwyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5618afbc-99e0-7bef-e9b2-000002c17afc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ajdtbop62plz3s2uw3rjtegilw4lfmixl7h4p6oset5rq5jihwtehtad.onion/","pattern":"[url:value = 'http://ajdtbop62plz3s2uw3rjtegilw4lfmixl7h4p6oset5rq5jihwtehtad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe9da02f-d9c7-11d4-437d-0000e7de179d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ni2bv45lwna3rshqcmr5hegowp764qhzooi42bddf52557uhaafbdvid.onion/","pattern":"[url:value = 'http://ni2bv45lwna3rshqcmr5hegowp764qhzooi42bddf52557uhaafbdvid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f0380a1-a81e-044e-d563-00008e46bb67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://authil5bvxkjdiwk7qmdxhxlu2mfinm4hhdcnv24chrc5wzvua2kadad.onion/","pattern":"[url:value = 'http://authil5bvxkjdiwk7qmdxhxlu2mfinm4hhdcnv24chrc5wzvua2kadad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07f8bf45-6ed5-d5af-16b3-0000521cc2db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g5a2thsvpabyjp6prphsque7nyaauul4rryr2nulytakggkecls23bad.onion/","pattern":"[url:value = 'http://g5a2thsvpabyjp6prphsque7nyaauul4rryr2nulytakggkecls23bad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bd7532a-581b-84c0-05fd-0000488dcff3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tslnzzg2kkczuo44rdoqkskzaopsqnhrm54bq5sfocxc2fvzll5roqyd.onion/","pattern":"[url:value = 'http://tslnzzg2kkczuo44rdoqkskzaopsqnhrm54bq5sfocxc2fvzll5roqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00a89cbc-2bd3-b531-2c9d-00003dcbac16","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fymqpsou7kwvovkh5uxr4ehwd2tibqhmp25p2mzoi2thtrcstwb2ojid.onion/","pattern":"[url:value = 'http://fymqpsou7kwvovkh5uxr4ehwd2tibqhmp25p2mzoi2thtrcstwb2ojid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4ecfc87-cc8b-3b3f-f41c-000001b948bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kwjsef73vtinlkt7t4hp3qsjga7uue65elq7jgmtovejsemhp56mnyqd.onion/","pattern":"[url:value = 'http://kwjsef73vtinlkt7t4hp3qsjga7uue65elq7jgmtovejsemhp56mnyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eca8d321-99e0-5fff-8118-0000bfe1d493","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ezh5qco6s7hju7uutdogqebrrq6qn3gixodtdnks6t6bbumw4n6c4aad.onion/","pattern":"[url:value = 'http://ezh5qco6s7hju7uutdogqebrrq6qn3gixodtdnks6t6bbumw4n6c4aad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63deee6e-3cb5-2cd3-6f90-000017a98256","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7u36ktiv5idgyhyyeociikvftwfkaihisndnqick4qoe4wssjphdihqd.onion/","pattern":"[url:value = 'http://7u36ktiv5idgyhyyeociikvftwfkaihisndnqick4qoe4wssjphdihqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--541095ba-9e05-1d10-0054-00002d3e5007","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://u65evpr7ejtac7cfi3getxwehllwgjdjgkxvrvjq2dmetjuj2uuii7qd.onion/","pattern":"[url:value = 'http://u65evpr7ejtac7cfi3getxwehllwgjdjgkxvrvjq2dmetjuj2uuii7qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51216ff4-f71b-d229-55e9-0000e8b7f9c5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pfdyhkswxf33nkjlbm2h2lluujca7tdcbmpwd74x5muv4aj5qenaj4qd.onion","pattern":"[url:value = 'http://pfdyhkswxf33nkjlbm2h2lluujca7tdcbmpwd74x5muv4aj5qenaj4qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ab82553-ede5-56c3-3aad-0000b7c53e84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6424n6oazcc5r2waycgrnu57lorupzvcjjphqhu75pn4atcd6oedjgad.onion/","pattern":"[url:value = 'http://6424n6oazcc5r2waycgrnu57lorupzvcjjphqhu75pn4atcd6oedjgad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d82f90cb-d5ac-4393-9fb1-0000b31c8b94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xxulor6gj34lqgvj25t6h2giqqic7puhd4khctkr4xb7gsnfdxewfvqd.onion/","pattern":"[url:value = 'http://xxulor6gj34lqgvj25t6h2giqqic7puhd4khctkr4xb7gsnfdxewfvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f0e712b-cd7f-54e0-a77e-000011f28940","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://b34sad6mkvajaffq42fahjiharyfvxwg2va5ybwa2zl5srhmhdhwdqyd.onion/","pattern":"[url:value = 'http://b34sad6mkvajaffq42fahjiharyfvxwg2va5ybwa2zl5srhmhdhwdqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f655b148-ac27-5aac-4b98-00006c20a3a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zcvqzunsmuotuiw7biqbsacf75uam7rvsfa46ppqwncpt2jxp3x5ryad.onion/","pattern":"[url:value = 'http://zcvqzunsmuotuiw7biqbsacf75uam7rvsfa46ppqwncpt2jxp3x5ryad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a26399c9-1fc6-62da-da7c-00001e30e972","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5azi3hg5bhi37z3dwivqrwhooos4wefome5fdbnz3n3kxvzaycqqd2id.onion/","pattern":"[url:value = 'http://5azi3hg5bhi37z3dwivqrwhooos4wefome5fdbnz3n3kxvzaycqqd2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84bf8687-8d47-e01c-7ce8-0000260bd9ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ef4rbuuqzczn2jah6tafzehoglye46vngv55pnddilmh7srpwpfa5fad.onion/","pattern":"[url:value = 'http://ef4rbuuqzczn2jah6tafzehoglye46vngv55pnddilmh7srpwpfa5fad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d57ce397-8dfb-0cd6-9043-000020ca7636","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ra4uys2f4pslov55oj23ckudpbmovj7brrqqnzwu25ux5ul62crbkryd.onion/","pattern":"[url:value = 'http://ra4uys2f4pslov55oj23ckudpbmovj7brrqqnzwu25ux5ul62crbkryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca9ea425-d290-96fb-784b-0000172c06c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dvvn42vb7umu2ldio424mlwhirmi2isxhbmdbhwbcnbhiekovdwe62qd.onion/","pattern":"[url:value = 'http://dvvn42vb7umu2ldio424mlwhirmi2isxhbmdbhwbcnbhiekovdwe62qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7f68af4-a19c-df63-c8ec-0000d309b9ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4ozcr5lsrsdxbo3kuqbayykrrl23j2yzmkc7ucgvsu7ejhwlzktzxcid.onion/","pattern":"[url:value = 'http://4ozcr5lsrsdxbo3kuqbayykrrl23j2yzmkc7ucgvsu7ejhwlzktzxcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5279708a-fefc-2079-4fca-00001e326bc4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cs5c7mye7anrko6axmio5ebugh6gnqas4jbznf4po47i6gfuzuk4zeyd.onion/","pattern":"[url:value = 'http://cs5c7mye7anrko6axmio5ebugh6gnqas4jbznf4po47i6gfuzuk4zeyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f741a220-cfc5-6997-0a84-000051d1acd4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qojfcbvlumvzmiu4tyixawquk6bjiwv74aeaubxwtq7rmw4qq7sv2jad.onion/","pattern":"[url:value = 'http://qojfcbvlumvzmiu4tyixawquk6bjiwv74aeaubxwtq7rmw4qq7sv2jad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--360a2736-7253-303e-73ee-0000ee8087c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l7fuh4h4wiseaarmysosohdsfjyya3nkqqx7o74k7wa63ajvalb4g5id.onion/","pattern":"[url:value = 'http://l7fuh4h4wiseaarmysosohdsfjyya3nkqqx7o74k7wa63ajvalb4g5id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73cb5cb3-c882-e753-8341-000029d60cf4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ajtwxvgqssarrfbgbctqrmujf75hbj5l3yu75du4jdhgigiu6e5xosad.onion/","pattern":"[url:value = 'http://ajtwxvgqssarrfbgbctqrmujf75hbj5l3yu75du4jdhgigiu6e5xosad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04973869-49d2-901d-00fa-0000ca840f19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3hqc4b7iimn3rltumz2l7qbzw4bcx6mgkvbm6yzlkzpcauzmlpqucgid.onion/","pattern":"[url:value = 'http://3hqc4b7iimn3rltumz2l7qbzw4bcx6mgkvbm6yzlkzpcauzmlpqucgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c601d9c-25bb-44f3-8873-0000b2a10922","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qnjf77dap5e34rw56triaklvaepxeebrku5iaqpnzsm6dy2fyob6csid.onion/","pattern":"[url:value = 'http://qnjf77dap5e34rw56triaklvaepxeebrku5iaqpnzsm6dy2fyob6csid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54801fce-de8f-ea4c-febd-00004fa5730e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://o76kftemw4lz2dmbaqlkvlq263cbb2twdy5q3767xb42zs7ovvu3yiqd.onion/","pattern":"[url:value = 'http://o76kftemw4lz2dmbaqlkvlq263cbb2twdy5q3767xb42zs7ovvu3yiqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18a1579e-0e47-94e7-c0fb-000057d088a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kqpmhriaqt4kujfnm3wv7ujgzx5pujqqd4logzgzzq3w5wctm62c5uid.onion/","pattern":"[url:value = 'http://kqpmhriaqt4kujfnm3wv7ujgzx5pujqqd4logzgzzq3w5wctm62c5uid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28e91f64-6ba4-6994-75e5-0000af247238","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://u237r6z6axkagn6t2qiwx2rrvmq7pvz53tph7hl64geg3ee55gw66kad.onion/","pattern":"[url:value = 'http://u237r6z6axkagn6t2qiwx2rrvmq7pvz53tph7hl64geg3ee55gw66kad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13171809-727d-85d2-3b4f-0000fa6f63ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kqmsxmbzkw33qgnbanoaaekuqa65qtk6777w4mkqku4r5kmksk2agtid.onion/","pattern":"[url:value = 'http://kqmsxmbzkw33qgnbanoaaekuqa65qtk6777w4mkqku4r5kmksk2agtid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c826484-d914-ef94-2d7f-0000106dba61","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://y5qmdnyxbvbx7l2uudjgc4nrlwo6zqhvevr3v5ux5ln7dg2yxvnjcvyd.onion/","pattern":"[url:value = 'http://y5qmdnyxbvbx7l2uudjgc4nrlwo6zqhvevr3v5ux5ln7dg2yxvnjcvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd789ca9-70dc-fe98-a545-0000a1f51fe4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xh23q4ps4lgsbkiifbztqt2w7cacjbkv7b3rpl3o6id262lqwmzooyqd.onion/","pattern":"[url:value = 'http://xh23q4ps4lgsbkiifbztqt2w7cacjbkv7b3rpl3o6id262lqwmzooyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8ebfdf4-bd31-c3b7-05b9-0000d0713a0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uduar2yzjwxbrjjnajaoe6y4nlnfx7bighampsukuwc5ibvcpit5okyd.onion/","pattern":"[url:value = 'http://uduar2yzjwxbrjjnajaoe6y4nlnfx7bighampsukuwc5ibvcpit5okyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c9d6175-df3e-3bd6-8338-000054145a56","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://acbyrlcgiv6qotpdynv7fu3bpyqtcbo3g3xqqhxrixrrlr2iiasbzzqd.onion/","pattern":"[url:value = 'http://acbyrlcgiv6qotpdynv7fu3bpyqtcbo3g3xqqhxrixrrlr2iiasbzzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5a5f630-f963-9ee4-8bea-00003447b187","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jow26ytlhvkjjc4dluier5y5ma2bbusexyczpgtfzdx4sh4dzmndbpid.onion/","pattern":"[url:value = 'http://jow26ytlhvkjjc4dluier5y5ma2bbusexyczpgtfzdx4sh4dzmndbpid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0577782f-d09f-0c6d-e10b-0000eee05317","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://snmb65b36sfmx7os37mzqrrmu2zdon237qvafg5p5274nint7i655uqd.onion/","pattern":"[url:value = 'http://snmb65b36sfmx7os37mzqrrmu2zdon237qvafg5p5274nint7i655uqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d5558c5-e5d8-d909-36eb-00000a7163af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tquqffwz5qepxnqtcd5ei3bzqjsyds2g2ywbxxr46nb2z4h7g2jlsjyd.onion/","pattern":"[url:value = 'http://tquqffwz5qepxnqtcd5ei3bzqjsyds2g2ywbxxr46nb2z4h7g2jlsjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--050c1aa9-bc2e-bd4e-091d-00009b4495b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yqnzk23gtyf7ayrsgvo6xstbc7mi4j2g4ux5trnqygjbccmvl6q6qfqd.onion/","pattern":"[url:value = 'http://yqnzk23gtyf7ayrsgvo6xstbc7mi4j2g4ux5trnqygjbccmvl6q6qfqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1c58baa-63a1-7fea-240d-000013e0ea46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ywuqjgj4nnp7sii4ufpqriwinvm5onbxpemr5e6i2bve6nviirqkugqd.onion/","pattern":"[url:value = 'http://ywuqjgj4nnp7sii4ufpqriwinvm5onbxpemr5e6i2bve6nviirqkugqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25df1047-2268-69d4-f0f1-0000dd0d03da","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://f646peycufbfenfevgpgl7kipwd6j4wez6m2phbgtckufnqiq3cedxad.onion/","pattern":"[url:value = 'http://f646peycufbfenfevgpgl7kipwd6j4wez6m2phbgtckufnqiq3cedxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7873ffc-1720-eb1e-89b8-000063aaf362","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bx6b255itzvrlprn7kzdzjg6bly54irlox5csndcbymtfaqecjyfv3qd.onion/","pattern":"[url:value = 'http://bx6b255itzvrlprn7kzdzjg6bly54irlox5csndcbymtfaqecjyfv3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a97a33f-993b-87a0-e035-000030000ea4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ic6owbrtkkymvcyxlvqzocungo54veltezfbvr7dgss4xioi5kfjb5yd.onion/","pattern":"[url:value = 'http://ic6owbrtkkymvcyxlvqzocungo54veltezfbvr7dgss4xioi5kfjb5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88e81fac-93f3-e3ce-11d9-0000479f85f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://prbabjw42fjlzveba3q3wlo47jy2ksa76e2fnkt4tftyvylv32lv7lqd.onion/","pattern":"[url:value = 'http://prbabjw42fjlzveba3q3wlo47jy2ksa76e2fnkt4tftyvylv32lv7lqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46564ee0-7525-184e-e90d-0000b1660302","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tjmo27stmgvg45k3jltnk2zi6xglze2ml7tgx5ihkacrewabdgcw4bad.onion/","pattern":"[url:value = 'http://tjmo27stmgvg45k3jltnk2zi6xglze2ml7tgx5ihkacrewabdgcw4bad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09162038-4d92-5943-1d94-0000bf5e607c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6o345jyfcsrep5dcaqrgd3vv636ctwri44u6fpy4soxg3se7iqhtdgid.onion/","pattern":"[url:value = 'http://6o345jyfcsrep5dcaqrgd3vv636ctwri44u6fpy4soxg3se7iqhtdgid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0470fe52-0927-f9f8-15cb-00004174027b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gtjoeyd6kus67etnla2dzmxpfd43lozfrwwyozc4pr3jdnu3bericxad.onion/","pattern":"[url:value = 'http://gtjoeyd6kus67etnla2dzmxpfd43lozfrwwyozc4pr3jdnu3bericxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc5277d5-914b-f1e3-078a-00009a2f6d50","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6rix6baa5hvfukufxynvnisglz6j3xxemu56zpxpyglbvnkl6ekd2uyd.onion/","pattern":"[url:value = 'http://6rix6baa5hvfukufxynvnisglz6j3xxemu56zpxpyglbvnkl6ekd2uyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d4064e3-269a-a13e-db8b-0000289fc4e9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eiv53oqiermgz7o5bt3ct4aaedme3qx6l7cmk3sedx2m6njt43bo4vid.onion/","pattern":"[url:value = 'http://eiv53oqiermgz7o5bt3ct4aaedme3qx6l7cmk3sedx2m6njt43bo4vid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73b2fefa-4be6-9a5d-a460-0000e375ad48","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://utuc2ul4pdmomok4uozskzumjdh7jk2pjab5suquszybcfkvmfd2lrid.onion/","pattern":"[url:value = 'http://utuc2ul4pdmomok4uozskzumjdh7jk2pjab5suquszybcfkvmfd2lrid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f06b82f3-7215-e11c-90c7-00009021cace","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://has6dlzs5mbxl2xkh4exhvg2k4hx4ijpntkpnbhdi37ecqv7ekxu5vid.onion/","pattern":"[url:value = 'http://has6dlzs5mbxl2xkh4exhvg2k4hx4ijpntkpnbhdi37ecqv7ekxu5vid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb57edc1-310a-0420-8ee8-00007ac4f0d4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7evca3nibwfav5knc2ksid4khqd7ycgdn6u75r6zjuyytb4vmawxdmad.onion/","pattern":"[url:value = 'http://7evca3nibwfav5knc2ksid4khqd7ycgdn6u75r6zjuyytb4vmawxdmad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d0c4d59-90de-6423-1ec3-0000db7a2daf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://epjpr6zxovifiwo2hwcc2ybrqbud4qbk3sc2swqsz3zduoluw5dvnvyd.onion/","pattern":"[url:value = 'http://epjpr6zxovifiwo2hwcc2ybrqbud4qbk3sc2swqsz3zduoluw5dvnvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7ba8e7a-66c7-a141-1063-000023a447a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sbpfz6p7uryiuv75rnhl324nazcwsjmaaf6z4o2kiic2tbiguts6hbad.onion/","pattern":"[url:value = 'http://sbpfz6p7uryiuv75rnhl324nazcwsjmaaf6z4o2kiic2tbiguts6hbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80e5926c-de18-7bb1-793f-000026ac8905","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4cc2rnrc4jycvf5kagldnusszmrjdpytm4smhs6gmwvci2l7wlqytlad.onion/","pattern":"[url:value = 'http://4cc2rnrc4jycvf5kagldnusszmrjdpytm4smhs6gmwvci2l7wlqytlad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce28e42f-837c-77b5-135d-0000c8c0daaf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3b4bsnquxnxqh64xd56ouav2epxqzrbkbm7j767nwq2lnmtpo7atqmqd.onion/","pattern":"[url:value = 'http://3b4bsnquxnxqh64xd56ouav2epxqzrbkbm7j767nwq2lnmtpo7atqmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53625112-b8b4-8e61-6776-0000ebc85e82","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xsny4ojubybbn6pe6zhrrflggu6lbq3ir3ixcpbtxzplwwjqi4dqidqd.onion/","pattern":"[url:value = 'http://xsny4ojubybbn6pe6zhrrflggu6lbq3ir3ixcpbtxzplwwjqi4dqidqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6cebacf-1d65-b3bb-2afb-00000c733db0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://esb67w4m3uhizvoyt7dhcnxj22iv4eq5uiuyysrljn36jf376y4dcyid.onion/","pattern":"[url:value = 'http://esb67w4m3uhizvoyt7dhcnxj22iv4eq5uiuyysrljn36jf376y4dcyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b460690-6032-3a4f-27a3-0000c080be26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://q4pno5sryymcs27txqv7ypmp4lb3z7fyh3mpvk7asqun45wvrq3mprad.onion/","pattern":"[url:value = 'http://q4pno5sryymcs27txqv7ypmp4lb3z7fyh3mpvk7asqun45wvrq3mprad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb63e907-2e28-aa1d-5fb1-0000aa3e2bd7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7q4ha572hakhru54jxonbpnhch3nlhwdw7ughj5j3jhiyyr2lflxojqd.onion/","pattern":"[url:value = 'http://7q4ha572hakhru54jxonbpnhch3nlhwdw7ughj5j3jhiyyr2lflxojqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6c52e57-280d-97f3-e1a2-00007d8c422e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rjztxzrwzbdgas53v23g5sgmtl7nb7qplrzu3x7b4n2dsy5uq54vgyyd.onion/","pattern":"[url:value = 'http://rjztxzrwzbdgas53v23g5sgmtl7nb7qplrzu3x7b4n2dsy5uq54vgyyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6587b5e-0b33-5809-4a7f-00003b2f3f49","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://oaiogo6dhwk7buevuib5awotcu2gotscqq2twthygxsagtnmp2zcbcid.onion/","pattern":"[url:value = 'http://oaiogo6dhwk7buevuib5awotcu2gotscqq2twthygxsagtnmp2zcbcid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50dc29bb-9ab4-0422-cd74-0000f65e551b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://onnaqkbezn3c2c667lp2bj6ycmns557i7lqr2ms7w25ed63745rbreyd.onion/","pattern":"[url:value = 'http://onnaqkbezn3c2c667lp2bj6ycmns557i7lqr2ms7w25ed63745rbreyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97099984-6d92-5153-0069-0000cb157f92","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zkvwuf2mzqs33vuvhk3pxk3jphvps3ldivwa5qljyryj673mbszjrnqd.onion/","pattern":"[url:value = 'http://zkvwuf2mzqs33vuvhk3pxk3jphvps3ldivwa5qljyryj673mbszjrnqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9802f0b-7ecd-59eb-c649-0000078711cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wpsi2cbbm3ckhgizllilxohq3ejpvj2m34grvcmx76eqwtrhzjeo7ead.onion/","pattern":"[url:value = 'http://wpsi2cbbm3ckhgizllilxohq3ejpvj2m34grvcmx76eqwtrhzjeo7ead.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ca0dfab-cc67-15a6-6406-0000f12d8d1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rjwjksouddfq3x2jzieb6k7gpkjv7ukyfwqinterxtbtrsoipk6qedad.onion/","pattern":"[url:value = 'http://rjwjksouddfq3x2jzieb6k7gpkjv7ukyfwqinterxtbtrsoipk6qedad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98c0a986-15a7-6824-6239-0000f56fe714","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pl6muez3z2vulhixcyipmi6n5xaynkew6umjhhv64xg2baomk6pzzayd.onion/","pattern":"[url:value = 'http://pl6muez3z2vulhixcyipmi6n5xaynkew6umjhhv64xg2baomk6pzzayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bee41b9-6da2-d20d-5d3e-000090293141","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://glt2d33vz3snwvqlje6qrw5khsej7auow4nxnvelwh7udq7df6vnblid.onion/","pattern":"[url:value = 'http://glt2d33vz3snwvqlje6qrw5khsej7auow4nxnvelwh7udq7df6vnblid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a1aede7-7b9d-68b6-d31d-00004e69f76a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zyb7j23sfsert574hii342lwnz7qeyw2kb7zom74wjabwhifhpoknaqd.onion/","pattern":"[url:value = 'http://zyb7j23sfsert574hii342lwnz7qeyw2kb7zom74wjabwhifhpoknaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab1e0c1b-c7f3-c311-a5e4-0000b2bf7bfb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3tdyvf3u4xko2xbra3bi4qsj2pedqdkglxkgfofyqip2sljxdbwyymyd.onion/","pattern":"[url:value = 'http://3tdyvf3u4xko2xbra3bi4qsj2pedqdkglxkgfofyqip2sljxdbwyymyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9431553-1cb1-d6fb-ae9c-000042ec23d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://med6cjvoucuksae7f7bdbyql26peuqe2pyurw6zshepumnhl3qyntsyd.onion/","pattern":"[url:value = 'http://med6cjvoucuksae7f7bdbyql26peuqe2pyurw6zshepumnhl3qyntsyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e10dc357-5b68-7c4c-7593-000003e3854a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7fncnamu5ghwrj43qifs3nf7xeif4kgd2olcpt636yz4n5cm5nd7gvyd.onion/","pattern":"[url:value = 'http://7fncnamu5ghwrj43qifs3nf7xeif4kgd2olcpt636yz4n5cm5nd7gvyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c127843e-d806-ec64-8628-0000206665d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qsmu6ufeelmqfzk5odx2rlg23ic46q7eamemi3ho23qads3wkqo6pmid.onion/","pattern":"[url:value = 'http://qsmu6ufeelmqfzk5odx2rlg23ic46q7eamemi3ho23qads3wkqo6pmid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d19fccc-18ca-9a30-2b95-0000b0a12cb6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://olmvtwarcgoqreayhpjhxtl7tozj5fnmyavzj5jphyy4d2qccio4klyd.onion/","pattern":"[url:value = 'http://olmvtwarcgoqreayhpjhxtl7tozj5fnmyavzj5jphyy4d2qccio4klyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9f64b36-a45a-2715-5152-000093c31dc2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pedsqcmmkfi7p2kdrg5f2uz2ko45oeby3zmyccm37pw3xoflngfdedqd.onion/","pattern":"[url:value = 'http://pedsqcmmkfi7p2kdrg5f2uz2ko45oeby3zmyccm37pw3xoflngfdedqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c24c4dac-262d-e6d2-1d30-00001ea9dd9b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7ctoklhp3yp5gxile3s57dusuvwozfav4r4hhhszbr5zg43rv4rgmbyd.onion/","pattern":"[url:value = 'http://7ctoklhp3yp5gxile3s57dusuvwozfav4r4hhhszbr5zg43rv4rgmbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f135e679-4b35-6866-ebf7-0000f1c186c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2zxwt43zxq2d4wrgbxtxstcvv3sl2bq7t2udd6iifkmea2a3d7js3aqd.onion","pattern":"[url:value = 'http://2zxwt43zxq2d4wrgbxtxstcvv3sl2bq7t2udd6iifkmea2a3d7js3aqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d21b52a3-c7ff-3b7e-bc89-00002da0507f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://c2jylvw3ngkppt3ypvjtk7sx6fyli6mddvcrjihn3lyfeqkgbhxdvaid.onion/","pattern":"[url:value = 'http://c2jylvw3ngkppt3ypvjtk7sx6fyli6mddvcrjihn3lyfeqkgbhxdvaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fdf7d06-c93c-bff3-776b-00007c06f1ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xvxa63spw6llq27eag3oesph4dfcyf3e4i3du5s3dbvrsikp4dg7jyid.onion/","pattern":"[url:value = 'http://xvxa63spw6llq27eag3oesph4dfcyf3e4i3du5s3dbvrsikp4dg7jyid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1eddaf8-880b-b85c-36fd-0000eacdd447","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3nnwjjrje6lpisqybb3n2qvplv3fjokwc3qrx764a4lbvgyjmcbbveid.onion/","pattern":"[url:value = 'http://3nnwjjrje6lpisqybb3n2qvplv3fjokwc3qrx764a4lbvgyjmcbbveid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab2601f3-9959-eb87-fe14-000088e23c30","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://f3oc5fzkfhftqajilnvofdhzy4hhwrzq4sv5pc4gkp5rv4ezvz7vd6yd.onion/","pattern":"[url:value = 'http://f3oc5fzkfhftqajilnvofdhzy4hhwrzq4sv5pc4gkp5rv4ezvz7vd6yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef0a1f6e-7cd9-31ec-a024-00009bb044eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zvi7ejdaod3v2obbacrtkao427p4xuigxfy656plngti6vw27st5tqyd.onion/","pattern":"[url:value = 'http://zvi7ejdaod3v2obbacrtkao427p4xuigxfy656plngti6vw27st5tqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e89d4119-ca84-f278-c621-0000805d4c04","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://asvbfh7ahbnxijciovwijfr23yua4pjz3e5ha4y6vzankdqn5b4a2lqd.onion/","pattern":"[url:value = 'http://asvbfh7ahbnxijciovwijfr23yua4pjz3e5ha4y6vzankdqn5b4a2lqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9221d7d2-7746-b9d9-05bd-0000f86be7e4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bo2s5jld3oihh7hrvx4phucfhxedfjf2szsuvk4nylbexz62bxd3mfyd.onion/","pattern":"[url:value = 'http://bo2s5jld3oihh7hrvx4phucfhxedfjf2szsuvk4nylbexz62bxd3mfyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9679db5c-2a06-bbaa-6881-0000dac547a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7qkuhmqkltor7szib66etg4qywk7i2hzjgpkktt25ulytf6rlwi43mad.onion/","pattern":"[url:value = 'http://7qkuhmqkltor7szib66etg4qywk7i2hzjgpkktt25ulytf6rlwi43mad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85019970-f2b1-075c-672b-000077032cbe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6it5uyalzfdm37jenradhm55gocsflhhykgu7uts4me4y3xxmqfbnuqd.onion/","pattern":"[url:value = 'http://6it5uyalzfdm37jenradhm55gocsflhhykgu7uts4me4y3xxmqfbnuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccaa8c7e-c5f6-bfef-315d-00000b2c9d89","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ok3dimj5y3g53dpmhlvhzwujaefzdey5kg6feftvc6coubssglfkilid.onion/","pattern":"[url:value = 'http://ok3dimj5y3g53dpmhlvhzwujaefzdey5kg6feftvc6coubssglfkilid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72df95be-d64d-2886-1455-000021ec27dc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5un4e2c2cf6cfguw7uo2xyo5dnsctnuh3znahrmuibdjbspyu3byhzqd.onion/","pattern":"[url:value = 'http://5un4e2c2cf6cfguw7uo2xyo5dnsctnuh3znahrmuibdjbspyu3byhzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc44184d-fb73-57e0-15c7-00007f9e4611","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://aayeie6my37ka7eefln7nnzabwidh7jj4bzcjykgblpmjomruk3tvjyd.onion/","pattern":"[url:value = 'http://aayeie6my37ka7eefln7nnzabwidh7jj4bzcjykgblpmjomruk3tvjyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--827dc0fc-0892-2182-01a0-0000ade61557","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://youje56g7jlgmqwhxat7ua7ysmmm4vogmrcq7cryod32bmzba37l27yd.onion/","pattern":"[url:value = 'http://youje56g7jlgmqwhxat7ua7ysmmm4vogmrcq7cryod32bmzba37l27yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a2f5225-00c6-e27c-9227-0000e9acc360","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bvzv2g6falu42anoejm2lqc6l7vh5upojbhwgi6dxvxksjuw27s4vkad.onion/","pattern":"[url:value = 'http://bvzv2g6falu42anoejm2lqc6l7vh5upojbhwgi6dxvxksjuw27s4vkad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce151682-5e06-994c-155f-00006782dbb2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dyl5qyy6yb5r74xb433h6ushzg3c2y22ec5h7h66pxarnaoxufjmyxad.onion/","pattern":"[url:value = 'http://dyl5qyy6yb5r74xb433h6ushzg3c2y22ec5h7h66pxarnaoxufjmyxad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--419b50b7-de8f-0771-240a-0000e901bae2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cgfblcrvlj5w7ebescbqftb3yfmc3qyo3n5p6vuvfouoagglyjlhmbyd.onion/","pattern":"[url:value = 'http://cgfblcrvlj5w7ebescbqftb3yfmc3qyo3n5p6vuvfouoagglyjlhmbyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6b124b2-f0f6-e8ee-6011-00007f220daa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zboneu6najwucvrfjac5gc6psuthqoz27x6fpiiuvttulph5aqz4qwid.onion/","pattern":"[url:value = 'http://zboneu6najwucvrfjac5gc6psuthqoz27x6fpiiuvttulph5aqz4qwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f9c4e0c-e49d-a788-f7f3-00006a2f01a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jtred7eoefpgm5ztmh23zclbu5ekzpyjo52iw4d56n6e3bcslcxpjuqd.onion/","pattern":"[url:value = 'http://jtred7eoefpgm5ztmh23zclbu5ekzpyjo52iw4d56n6e3bcslcxpjuqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dce04e2b-7fe0-22e2-23e1-00000e9e6c80","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nhrlosgix7xlkriwvygx52v5jvxn6cb5cpl5gfmhg2dtyvyb7a467iyd.onion/","pattern":"[url:value = 'http://nhrlosgix7xlkriwvygx52v5jvxn6cb5cpl5gfmhg2dtyvyb7a467iyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d65c1a08-92bd-0bca-6e21-00002895f3c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://i4utqt3qnrm2hxhvitunmj4b7777svzbzrc4ewig6j4g6g5zzqahz2qd.onion/","pattern":"[url:value = 'http://i4utqt3qnrm2hxhvitunmj4b7777svzbzrc4ewig6j4g6g5zzqahz2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adccd5b1-2f13-3671-140f-00005e776ee5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://iln5j3cnabk3ftczrwwh2z7rdilnvkc426po3ogqb3y222xwqxizy2yd.onion/","pattern":"[url:value = 'http://iln5j3cnabk3ftczrwwh2z7rdilnvkc426po3ogqb3y222xwqxizy2yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcba4893-138a-e79d-fed4-00001837dc44","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g7p4ildkspr57fflg2f4fvektshe7mmzprkol746vsyqdsshgufwoqyd.onion/","pattern":"[url:value = 'http://g7p4ildkspr57fflg2f4fvektshe7mmzprkol746vsyqdsshgufwoqyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c4fa907-ee47-38f5-6279-0000689f08b6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qkypx555r7e5ukg4bso3iqqagfxhedq3tqq7f3iipbv6smv7hkp53hid.onion/","pattern":"[url:value = 'http://qkypx555r7e5ukg4bso3iqqagfxhedq3tqq7f3iipbv6smv7hkp53hid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cf6a74f-bd63-f85e-3788-00003a28f238","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5xble3ivix7mjdfwd5232g2hegofrcithkwxb3vj7skwstnkose2p2qd.onion/","pattern":"[url:value = 'http://5xble3ivix7mjdfwd5232g2hegofrcithkwxb3vj7skwstnkose2p2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32cd4aa5-fc7f-e010-8062-0000c486c395","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wb52j3p5alcgno3oczubcqflq7v6ilta3pcqneu77l5bujpiib6ixdad.onion/","pattern":"[url:value = 'http://wb52j3p5alcgno3oczubcqflq7v6ilta3pcqneu77l5bujpiib6ixdad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b5d8c2d-2da1-928a-0b3f-0000460f6a38","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7z7aukowd72il3iobtboovofkqdluuva3bz5iwfazf4xwsdqpputukyd.onion/","pattern":"[url:value = 'http://7z7aukowd72il3iobtboovofkqdluuva3bz5iwfazf4xwsdqpputukyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fd815af-64a5-8593-4107-000099efe33e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7nylg5iafpqfbpad6gtfkj22kp74iihr6lxtn3qmpgpasazqeb7cabad.onion/","pattern":"[url:value = 'http://7nylg5iafpqfbpad6gtfkj22kp74iihr6lxtn3qmpgpasazqeb7cabad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b785f4cf-7b45-aba3-e0c3-00008387c772","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wake57gge7jfbrjssm65yac6fewan5nth5hhlcg7lorvmpxsnknf4xqd.onion/","pattern":"[url:value = 'http://wake57gge7jfbrjssm65yac6fewan5nth5hhlcg7lorvmpxsnknf4xqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f94772d-be5d-8284-b574-000053ff280e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ayzkcslvoiiahzrhqtc6zhe44mql5oqmbe6tyxljfhph26lbxtdqqlyd.onion/","pattern":"[url:value = 'http://ayzkcslvoiiahzrhqtc6zhe44mql5oqmbe6tyxljfhph26lbxtdqqlyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27842a67-f896-f341-d040-00003c50133d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kokaplp6lcwfwjkotajkn2ggf4lid5trsgzhg32cbsjopmyfytyhubyd.onion/","pattern":"[url:value = 'http://kokaplp6lcwfwjkotajkn2ggf4lid5trsgzhg32cbsjopmyfytyhubyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d61ed31-2e9e-9438-b902-000000ba164b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7x2vezv3s2vjh5h36hh2iovz53bi2qtlzcflkojedphny2mms2ok5cad.onion/","pattern":"[url:value = 'http://7x2vezv3s2vjh5h36hh2iovz53bi2qtlzcflkojedphny2mms2ok5cad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--028977d2-6509-9ea4-30a2-00008e617047","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://figqod3no4syanbp2b2eqtao7dmxauj6bb2bnkx3gdmgqjlqhe5beaqd.onion/","pattern":"[url:value = 'http://figqod3no4syanbp2b2eqtao7dmxauj6bb2bnkx3gdmgqjlqhe5beaqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0ca8c5d-88cf-0807-3817-00007c950404","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lmkgzahy3yya7bwmkmigx6j32d7u7nqex6hbx5izz7y3n6uwjx3as2qd.onion/","pattern":"[url:value = 'http://lmkgzahy3yya7bwmkmigx6j32d7u7nqex6hbx5izz7y3n6uwjx3as2qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2a96ed8-8cd5-b832-5da8-000023987c81","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ysg5zoxqeabi5xejxbq43lvdrztyu4hnlrakckc72iko4peg4twh6vqd.onion/","pattern":"[url:value = 'http://ysg5zoxqeabi5xejxbq43lvdrztyu4hnlrakckc72iko4peg4twh6vqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b48c2cd3-26fa-6453-9cc7-0000a6866ad6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xoa7whcgymujxkwepyapthy7bhdc2epokgiau3ybuhgamrf3pxi4z4qd.onion/","pattern":"[url:value = 'http://xoa7whcgymujxkwepyapthy7bhdc2epokgiau3ybuhgamrf3pxi4z4qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cf0100c-846c-bdce-1f89-00000a135ceb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p3yzpoltrm3e65rlqtmwefnunyz22wdjuaf4bfumqbey4edaeqq44did.onion/","pattern":"[url:value = 'http://p3yzpoltrm3e65rlqtmwefnunyz22wdjuaf4bfumqbey4edaeqq44did.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9666f67d-efa9-e472-6c5a-00004e683c6d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bl5h2vwa6jepjog4aviyv5garfvz4bc4t5tk6ioyaae4m7zoflb36jid.onion/","pattern":"[url:value = 'http://bl5h2vwa6jepjog4aviyv5garfvz4bc4t5tk6ioyaae4m7zoflb36jid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2091ce14-e3bf-3882-2291-00003d281730","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yv7fbzjdvg4e3fdgxnnq4oepu2wk6kuhhfuc36gzr7szxg7crjhorryd.onion/","pattern":"[url:value = 'http://yv7fbzjdvg4e3fdgxnnq4oepu2wk6kuhhfuc36gzr7szxg7crjhorryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--078c0d3d-73ec-1909-389f-00008965822c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dx3nurcicb2rzydbkam7eibrlrpxnjnfvkj2557wzgvmz7be2hn6ufid.onion/","pattern":"[url:value = 'http://dx3nurcicb2rzydbkam7eibrlrpxnjnfvkj2557wzgvmz7be2hn6ufid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--035afa8e-4de0-b9a0-47d4-00007a30c2fa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://67ni6yaafbculxsbupuzageg2eselgc7bc6gkvc43tt2zhlh7jgmkoad.onion/","pattern":"[url:value = 'http://67ni6yaafbculxsbupuzageg2eselgc7bc6gkvc43tt2zhlh7jgmkoad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e45fb7c-9717-e775-7bb4-0000586359cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xbrljl5nlnt65x7aqne4lbiy2rwgjpro5ng54dy5hfexsnvtawqi4jqd.onion/","pattern":"[url:value = 'http://xbrljl5nlnt65x7aqne4lbiy2rwgjpro5ng54dy5hfexsnvtawqi4jqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eaf1de6-0d14-0b06-b704-0000e01c3b47","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cou6hffzhudgz57olebxcn5wr2zn25w3yrk7j4jci3dtkrxxqs7foxid.onion/","pattern":"[url:value = 'http://cou6hffzhudgz57olebxcn5wr2zn25w3yrk7j4jci3dtkrxxqs7foxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04211178-f114-7a1c-86a7-0000b1244f0c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yczpqk7e7plndnhjjza4jcq3yagd6djdfpnal4sgabna2vkccxr56cad.onion/","pattern":"[url:value = 'http://yczpqk7e7plndnhjjza4jcq3yagd6djdfpnal4sgabna2vkccxr56cad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c125edd-7f82-5742-eba6-0000a6a6e223","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://thv7beevnkocwviamffpzd3tobl67fvcbrd637ok5xzmxlqltmkvtmqd.onion/","pattern":"[url:value = 'http://thv7beevnkocwviamffpzd3tobl67fvcbrd637ok5xzmxlqltmkvtmqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d64f3e83-5176-4dd6-92d0-0000b0a3a7dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6vnrkxk3z5sw3l56n3qrl4rwzq5acdxhupjigc34zofgebnzdfjkkbad.onion/","pattern":"[url:value = 'http://6vnrkxk3z5sw3l56n3qrl4rwzq5acdxhupjigc34zofgebnzdfjkkbad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3afb62e-dab7-b562-3812-0000325399a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qmbvp3z7x55c2p6deewt4irg2i6xdzswgsg6ihtgwd3mf6w22i36s3yd.onion/","pattern":"[url:value = 'http://qmbvp3z7x55c2p6deewt4irg2i6xdzswgsg6ihtgwd3mf6w22i36s3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ff061bb-b4b9-69da-3675-0000fc26fcea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://s4xsrikoxn4wo2k4julmxyxryiiv2nrqke4jz7ybpk73m4cpzadjpxqd.onion","pattern":"[url:value = 'http://s4xsrikoxn4wo2k4julmxyxryiiv2nrqke4jz7ybpk73m4cpzadjpxqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a9293b9-8389-051b-2835-00007a94abba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qosur3hbdiz4jok45wnfwz3gtf7mxbzurpgoqtejlwncoqlhmaousxqd.onion/","pattern":"[url:value = 'http://qosur3hbdiz4jok45wnfwz3gtf7mxbzurpgoqtejlwncoqlhmaousxqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aca6a007-abbc-5d22-3c88-0000608be9b3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fe2pbzsazb4eh76tpn4hqo63erhuusyjlvio5msocqeibz3culyg63ad.onion/","pattern":"[url:value = 'http://fe2pbzsazb4eh76tpn4hqo63erhuusyjlvio5msocqeibz3culyg63ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e93e7621-caf6-f35c-d6e0-000075fdaa4b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3eu5bvf4d432dprtsdu3evlr6pxbbewxncnzjkib2ffp5osuxwzaa3id.onion/","pattern":"[url:value = 'http://3eu5bvf4d432dprtsdu3evlr6pxbbewxncnzjkib2ffp5osuxwzaa3id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37286bca-1c0b-eeda-df53-0000dbf24c99","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4qcwvs4nciukxpxls3lpcozkabqa6l3iaulgbm7lxssnlpv7clnz4lad.onion/","pattern":"[url:value = 'http://4qcwvs4nciukxpxls3lpcozkabqa6l3iaulgbm7lxssnlpv7clnz4lad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a667ad94-1cae-c868-2f03-0000c613637b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://iromfhuademn34fsfdvdrobxdj3tz7mfp2rdj4o2nmfp55fr6xgm3hyd.onion/","pattern":"[url:value = 'http://iromfhuademn34fsfdvdrobxdj3tz7mfp2rdj4o2nmfp55fr6xgm3hyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae47605c-e84f-b29c-09a7-00001c952d40","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qf62tupgogwy34gn5jt2ewpe2bdxpb7idzmrdu4axdznuuezxbtk7aid.onion/","pattern":"[url:value = 'http://qf62tupgogwy34gn5jt2ewpe2bdxpb7idzmrdu4axdznuuezxbtk7aid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eddc0f2-9184-94a5-5879-000071ae9ba9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tqduzttjebt7vz3vla2mwe26bmjty7p7gvs4dhyzc4w6hzrgxfljr3yd.onion/","pattern":"[url:value = 'http://tqduzttjebt7vz3vla2mwe26bmjty7p7gvs4dhyzc4w6hzrgxfljr3yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62774dc4-57d9-6130-5e7f-0000e966ae87","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6rtliyde3asuj5k6jfnjrbogsni3zogbqybs3jpqfc7qc7ukeebzzwyd.onion/","pattern":"[url:value = 'http://6rtliyde3asuj5k6jfnjrbogsni3zogbqybs3jpqfc7qc7ukeebzzwyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b49a6f5d-de5f-6303-5fed-000062adf5cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2wwpi2kstrba4t3i5or3soqgvcc7luzpxntqfd2dya6kdmfdqj3sr3qd.onion/","pattern":"[url:value = 'http://2wwpi2kstrba4t3i5or3soqgvcc7luzpxntqfd2dya6kdmfdqj3sr3qd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8fe364e-be55-5041-b560-00005d6babd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://koh3nn7qf3xty73fewu7kuj7w2trzt5yuoj7babbuhzdknuwhpct2qyd.onion/","pattern":"[url:value = 'http://koh3nn7qf3xty73fewu7kuj7w2trzt5yuoj7babbuhzdknuwhpct2qyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8a48d8d-a563-2e15-fd02-0000420d4c42","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://y7d2iez7vkt7yzpk6cmrxmntqxgrrizqmmi4oxpyv6g2rl4bn4xew3ad.onion/","pattern":"[url:value = 'http://y7d2iez7vkt7yzpk6cmrxmntqxgrrizqmmi4oxpyv6g2rl4bn4xew3ad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9761dc70-8994-64eb-00f4-0000b7bff6b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pcpokxdz5zn3tmzfbqyyfuodm6pkgrysiqcckbahzgyzirx2av44w4yd.onion/","pattern":"[url:value = 'http://pcpokxdz5zn3tmzfbqyyfuodm6pkgrysiqcckbahzgyzirx2av44w4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b0b67c5-7104-e990-2b4e-0000de7c3596","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dou6ktqds2xidxlvwuqgruos2mjnqcbsdoeensjoolmzz2gby6uqe4id.onion/","pattern":"[url:value = 'http://dou6ktqds2xidxlvwuqgruos2mjnqcbsdoeensjoolmzz2gby6uqe4id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8e48428-d041-a216-3fdb-00003aa02970","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://evy3ssetplcrv5rzzzbxia75oroocvrhavc72pfy75e47g4zfz4vfwyd.onion","pattern":"[url:value = 'http://evy3ssetplcrv5rzzzbxia75oroocvrhavc72pfy75e47g4zfz4vfwyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7d4f22a-39b0-6a70-a841-0000669813dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nnkx3zqi3whqyxh4edu5gpydeni3rzzyxoicsvevni25a5jdoc5xceqd.onion","pattern":"[url:value = 'http://nnkx3zqi3whqyxh4edu5gpydeni3rzzyxoicsvevni25a5jdoc5xceqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f1fcf3e-ab49-1b80-afb9-00001be94b2f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zu4jfbwu4on24mvtxm3gojoaw6ltk4wlebtfvly4haykp4tusdcrv5yd.onion","pattern":"[url:value = 'http://zu4jfbwu4on24mvtxm3gojoaw6ltk4wlebtfvly4haykp4tusdcrv5yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c9666ed-f662-85c9-230b-00007f87fc01","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zf3raijx7m6xm72uenqrql5b2qtkbvnxi7fgzqjxfcizp7lylmvzvdid.onion","pattern":"[url:value = 'http://zf3raijx7m6xm72uenqrql5b2qtkbvnxi7fgzqjxfcizp7lylmvzvdid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2fa76a4-3174-09c9-0968-00000e0a75d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zcll3muuhw3uqtgxzdojqv52fuifg5z2knk5w63mljvujs2g2wywluid.onion","pattern":"[url:value = 'http://zcll3muuhw3uqtgxzdojqv52fuifg5z2knk5w63mljvujs2g2wywluid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6daa7a5e-e5a8-8608-3d36-000071879df3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zawzev3zlywn7dy642nokfgmkmupgsrfhhquhhqkgcwml2pk7io6fjyd.onion","pattern":"[url:value = 'http://zawzev3zlywn7dy642nokfgmkmupgsrfhhquhhqkgcwml2pk7io6fjyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a8a383d-a1dc-3108-5dfd-0000c237e5f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zae5d3try3lmnpb6mcx2mbqgp5xawuixm4ktofscv63btekwvcpg6ryd.onion","pattern":"[url:value = 'http://zae5d3try3lmnpb6mcx2mbqgp5xawuixm4ktofscv63btekwvcpg6ryd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78eec5b3-ed85-cdb3-068b-0000c251e9eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yo3f4ytjbuf3j4bx3m6s523e5hue7afxaprlikjuxf57ed7pc5dnpaid.onion","pattern":"[url:value = 'http://yo3f4ytjbuf3j4bx3m6s523e5hue7afxaprlikjuxf57ed7pc5dnpaid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63d1426b-28e1-86cf-ba3c-0000836faec9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ymfmzthvho5q7jituowluckkq45dogsf3ru25ev4nlehaq65hy4w6pid.onion","pattern":"[url:value = 'http://ymfmzthvho5q7jituowluckkq45dogsf3ru25ev4nlehaq65hy4w6pid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a9d1b8f-1b16-dda5-4c55-000039973dea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yh4vjsv3u27zlzosrsjc5aveua3iclhifjmwdr5uujsaqz7hfkkljfid.onion","pattern":"[url:value = 'http://yh4vjsv3u27zlzosrsjc5aveua3iclhifjmwdr5uujsaqz7hfkkljfid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--125d8289-1843-f070-cafe-000006fdb233","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://y7u6xpydaobdwz7puojmze3estmhyx4qpbpihm2qfsfdgoenns6gtcid.onion","pattern":"[url:value = 'http://y7u6xpydaobdwz7puojmze3estmhyx4qpbpihm2qfsfdgoenns6gtcid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8801f6b3-a6a1-74a3-47e3-0000068f73c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xvks2js3rexd7kyzitdpnwzzqt3s5xxqj2dkydep6r563u7bgfgbdead.onion","pattern":"[url:value = 'http://xvks2js3rexd7kyzitdpnwzzqt3s5xxqj2dkydep6r563u7bgfgbdead.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efdf60ce-df44-a393-e155-00001cd65ae9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xqclaoqanufx6z77e3ieun4xvmrsenolxjhhvlk56yfncuke66myfsqd.onion","pattern":"[url:value = 'http://xqclaoqanufx6z77e3ieun4xvmrsenolxjhhvlk56yfncuke66myfsqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea4d11c2-031d-e118-3b00-00003de91957","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wiuco7yxvd6ygklc5kngraftysq7sgtkpcqtstpthj3ihxdarjlojcad.onion","pattern":"[url:value = 'http://wiuco7yxvd6ygklc5kngraftysq7sgtkpcqtstpthj3ihxdarjlojcad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ad4d021-2f8f-c8d0-75a7-0000cd7fbaf1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vzxulehmjar6jmkjiy6qpj5mbgma3nl7o2mncrimjwjl5j3lk5ea35ad.onion","pattern":"[url:value = 'http://vzxulehmjar6jmkjiy6qpj5mbgma3nl7o2mncrimjwjl5j3lk5ea35ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53f299e7-3033-3219-b25b-0000abeb21bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vldmvht6s253et33ce6gcth2vikuvsi7xgkzim5frqiowq6an6tmlaad.onion","pattern":"[url:value = 'http://vldmvht6s253et33ce6gcth2vikuvsi7xgkzim5frqiowq6an6tmlaad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--392428dc-0a1f-ff19-16f2-000011bbc3b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vgkclj5nqv53iy455dlfthg75a5cg6ndkazvizrnxrx7fshdqzw4m2yd.onion","pattern":"[url:value = 'http://vgkclj5nqv53iy455dlfthg75a5cg6ndkazvizrnxrx7fshdqzw4m2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43b5e9d1-8672-22c6-7566-00004c8a154c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uvovouktcgmq55h5i7axt4qrms6iq6znn5cfcrmg7qjseray4dcjxxqd.onion","pattern":"[url:value = 'http://uvovouktcgmq55h5i7axt4qrms6iq6znn5cfcrmg7qjseray4dcjxxqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04351e4a-81d9-c2ad-49e5-00000b89b640","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ucrh53a22g5l3swwtfvvrjjtawrubpedn4s7lws4krbyy7itpvymybad.onion","pattern":"[url:value = 'http://ucrh53a22g5l3swwtfvvrjjtawrubpedn4s7lws4krbyy7itpvymybad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--881d3657-4d72-a5a0-8149-0000779f80bf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://uab4byztmlcfsqb6v7pjoe3pnrvx2uckcuegvjyqui4wzy77jppzd3id.onion","pattern":"[url:value = 'http://uab4byztmlcfsqb6v7pjoe3pnrvx2uckcuegvjyqui4wzy77jppzd3id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--238c9476-c4c4-e768-c16f-00005529d17a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://u3cko3mc66cfvnf5luzkw5n36q34eges5raq2i3viuiewfvnkqoxztid.onion","pattern":"[url:value = 'http://u3cko3mc66cfvnf5luzkw5n36q34eges5raq2i3viuiewfvnkqoxztid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb2ef6f7-e6f4-d4f7-1344-0000dacd6bf4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://u27qc3ar5s2pqaod5ugxwyymaay6zii5lqfeo4nrs6ykysgzznk3kmad.onion","pattern":"[url:value = 'http://u27qc3ar5s2pqaod5ugxwyymaay6zii5lqfeo4nrs6ykysgzznk3kmad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3ba6420-4f66-ea86-4b56-0000e61ef7bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tuw6in37vku6kg3mvnwaxsldhruujpihibpxbq5ne42phqgv4ekuirqd.onion","pattern":"[url:value = 'http://tuw6in37vku6kg3mvnwaxsldhruujpihibpxbq5ne42phqgv4ekuirqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--631412ba-58e6-1d84-69bb-00005e919aa5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://toeaxffzwscqgb7ftetfvldqf2xkqfx4g5kpqejney2ysyirtqdwcvyd.onion","pattern":"[url:value = 'http://toeaxffzwscqgb7ftetfvldqf2xkqfx4g5kpqejney2ysyirtqdwcvyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5181f841-b67c-92e9-d676-0000c3f47a0b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://tfeo2er3vmcal5tltu7vpnegh2cmmjsdyldfhisdco75mysi4ta6dsqd.onion","pattern":"[url:value = 'http://tfeo2er3vmcal5tltu7vpnegh2cmmjsdyldfhisdco75mysi4ta6dsqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--926b4409-5454-63e4-023f-0000b5d24c62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://td4ngpvlle7udkh5svgilgph5v3f63uo3hv3coh7gpdsqozo6it46sad.onion","pattern":"[url:value = 'http://td4ngpvlle7udkh5svgilgph5v3f63uo3hv3coh7gpdsqozo6it46sad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41b988a4-9cbe-4ab6-88da-00006be0a938","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t3zm26nipjrttk5bzbr37crc32kufsixoonf7tmyqviduogoul54vbad.onion","pattern":"[url:value = 'http://t3zm26nipjrttk5bzbr37crc32kufsixoonf7tmyqviduogoul54vbad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f40c4ba2-bddd-4724-738e-000034b116b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://smo3gebcr5mkff7ja5ayi2xdz2xsapdixak4eosj5ah6fgrbluoxrkqd.onion","pattern":"[url:value = 'http://smo3gebcr5mkff7ja5ayi2xdz2xsapdixak4eosj5ah6fgrbluoxrkqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38459788-6915-681f-c9b5-000023e6a66c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sktwn6mi53hbyylkzswtquemuuirsn5qivdz4evhgbobqqzcfbw6pyid.onion","pattern":"[url:value = 'http://sktwn6mi53hbyylkzswtquemuuirsn5qivdz4evhgbobqqzcfbw6pyid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f0d290e-d4cd-b5b9-62e4-0000c41f8bfd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://s7isfnfsrrnogkkvzzmqpqlcehajalaht5nmel7nbxwhvqc52jj2ejid.onion","pattern":"[url:value = 'http://s7isfnfsrrnogkkvzzmqpqlcehajalaht5nmel7nbxwhvqc52jj2ejid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4134dcd1-565e-6d97-d412-00007404644e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://s5hcgpxzeehnkwlpb3xkelvkv6rpi5rszmhfeywncja26bxdzexp6zqd.onion","pattern":"[url:value = 'http://s5hcgpxzeehnkwlpb3xkelvkv6rpi5rszmhfeywncja26bxdzexp6zqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26befcf7-2d9f-1768-e970-0000d02d10e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rzs7rnmp37k6g3wbmym7oi23h2cc6wcf65oxsetun6cp25sna6256xad.onion","pattern":"[url:value = 'http://rzs7rnmp37k6g3wbmym7oi23h2cc6wcf65oxsetun6cp25sna6256xad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5460dbbd-7dc2-d140-2b76-0000168e5535","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rwkwobi6dz6dxzhnjpnau77ejcq3ar4ajjal42pj7usotilyj3bbfpyd.onion","pattern":"[url:value = 'http://rwkwobi6dz6dxzhnjpnau77ejcq3ar4ajjal42pj7usotilyj3bbfpyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e044c251-06a4-2e30-61fa-00001175318c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rq4ahdxs5yjm5s66d7dkgwpwduzj6e5yckhdt2mqmc3utp47ap3fjcyd.onion","pattern":"[url:value = 'http://rq4ahdxs5yjm5s66d7dkgwpwduzj6e5yckhdt2mqmc3utp47ap3fjcyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2e77023-a224-2be3-6a4a-0000df2cb3f8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://r4aub3bfqf4jh2e6whomjt6bs6abzvtlhwuu2us4fhglnhic3rjegoyd.onion","pattern":"[url:value = 'http://r4aub3bfqf4jh2e6whomjt6bs6abzvtlhwuu2us4fhglnhic3rjegoyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0631fa7-3cfa-6cfb-ab8f-000031a03087","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qrrfiv7l5gsrc7q2n6mfxrbaq33vsvum7d6plx4maslkfxk5pmxt6ayd.onion","pattern":"[url:value = 'http://qrrfiv7l5gsrc7q2n6mfxrbaq33vsvum7d6plx4maslkfxk5pmxt6ayd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3ba0843-6db4-44e0-5435-000065c7a66e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qpcdrem3wd7ihi3x2tfgy7tvh2ldck4nezaxotxqc4vrc2ek3hkmejid.onion","pattern":"[url:value = 'http://qpcdrem3wd7ihi3x2tfgy7tvh2ldck4nezaxotxqc4vrc2ek3hkmejid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--544d3ea8-4cef-b5b6-3261-00006ab56f72","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qfhgvlly3qmrp4sbpr54bc6ci2riwuac6aw72enw2xmcb5yo57jzmkad.onion","pattern":"[url:value = 'http://qfhgvlly3qmrp4sbpr54bc6ci2riwuac6aw72enw2xmcb5yo57jzmkad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59d7ff1b-7409-68f7-f256-00006f96b363","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://q72tfgqh6wi237u2nqxuyuiawkyac5p6qav7mo2r67mu3ufl5gbou2ad.onion","pattern":"[url:value = 'http://q72tfgqh6wi237u2nqxuyuiawkyac5p6qav7mo2r67mu3ufl5gbou2ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92d956ca-c310-c7ef-aac2-00007ba0c608","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://puqwe2eijzpw33p65qq4ql37dtza64ug3hpsflgxvok7kipzinzry2qd.onion","pattern":"[url:value = 'http://puqwe2eijzpw33p65qq4ql37dtza64ug3hpsflgxvok7kipzinzry2qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e449548c-f29c-dbc4-0321-0000cd8ec6ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pmpkjv36ca5ykwmjnfnr5cadctt4ldcekaxocbwa57btujhi7mly6kid.onion","pattern":"[url:value = 'http://pmpkjv36ca5ykwmjnfnr5cadctt4ldcekaxocbwa57btujhi7mly6kid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4de0446-2c04-36d0-5584-000085668eaf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p5f7j74vjhcifcxjmg7dswszfsk5z73ftohjj4nlnq7k3qcy4vtxraid.onion","pattern":"[url:value = 'http://p5f7j74vjhcifcxjmg7dswszfsk5z73ftohjj4nlnq7k3qcy4vtxraid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fdd5015-d7eb-ef79-07bb-0000ac42d747","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://p4tn5c42tfkr257a5djzs7iadvuunb7ydowuc6s2ghifbv5buc5pvsad.onion","pattern":"[url:value = 'http://p4tn5c42tfkr257a5djzs7iadvuunb7ydowuc6s2ghifbv5buc5pvsad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10daace5-cc82-df44-fbd1-00003feb9fda","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://oylk6phjrgcjvhv5rjijwrpcqj4ig3f2evbxb6lzofw7cbgxlpetq7ad.onion","pattern":"[url:value = 'http://oylk6phjrgcjvhv5rjijwrpcqj4ig3f2evbxb6lzofw7cbgxlpetq7ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--543020c1-9118-a2eb-ccfe-0000d746ad83","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://o522tg3wwqzypsc5yosrhr7mji5as45p2srrzvwd762h5sparfw3j2id.onion","pattern":"[url:value = 'http://o522tg3wwqzypsc5yosrhr7mji5as45p2srrzvwd762h5sparfw3j2id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99d915f0-f123-10f8-ad87-00008908ba83","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mdixxkgamwij6sy7stxy4fiqwbmfmci2fbjbbndaq2txgaz25zz23xqd.onion","pattern":"[url:value = 'http://mdixxkgamwij6sy7stxy4fiqwbmfmci2fbjbbndaq2txgaz25zz23xqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d19b837-fae2-38f2-20c4-00009d253aa6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m75bpllrckr7gus26rd6clvvcq6my6tb2bmw6crsevft4t4sv4fsbeyd.onion","pattern":"[url:value = 'http://m75bpllrckr7gus26rd6clvvcq6my6tb2bmw6crsevft4t4sv4fsbeyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ef378dc-8c98-850b-5359-0000b3b7d9ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m6hx7svbvoxhkylaey2jfqxxcychksmx7n455aavt4nan6cuztzkiiyd.onion","pattern":"[url:value = 'http://m6hx7svbvoxhkylaey2jfqxxcychksmx7n455aavt4nan6cuztzkiiyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7cdf558-1515-81f9-67b5-00001ac791b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lkwkv2pzl3rpo63pqagijqsdo5t52lqwvuu5n34ito4jjnkyfc66smyd.onion","pattern":"[url:value = 'http://lkwkv2pzl3rpo63pqagijqsdo5t52lqwvuu5n34ito4jjnkyfc66smyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b594b48-2e3e-83bb-612a-00008bc5e603","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ldl45mghc3vscfucdntjc2cax7z3k5fxxxfthvrxhilr4sk2a2dveqid.onion","pattern":"[url:value = 'http://ldl45mghc3vscfucdntjc2cax7z3k5fxxxfthvrxhilr4sk2a2dveqid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42615384-ad89-da3a-417e-0000b969a9e9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l2gsnjel3ongbhzvuftuhkbkx5uoso7fvsfqq6oxt25ph4anxxwnl2qd.onion","pattern":"[url:value = 'http://l2gsnjel3ongbhzvuftuhkbkx5uoso7fvsfqq6oxt25ph4anxxwnl2qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b070a0cb-54e7-66b1-1bf9-0000978ef16a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kxmbveamxzfrnxacprpbldcy3p263kvrjiblaw4p55mzrkaf3si6w4id.onion","pattern":"[url:value = 'http://kxmbveamxzfrnxacprpbldcy3p263kvrjiblaw4p55mzrkaf3si6w4id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5339656b-2b65-a3cb-f871-0000f77b76d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kx77iuzg25qlesz3zm7nvy4i6vxecc5jtksf5gllknescfktvzhyo2yd.onion","pattern":"[url:value = 'http://kx77iuzg25qlesz3zm7nvy4i6vxecc5jtksf5gllknescfktvzhyo2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b27383d8-6869-7e17-a287-0000ae4eca9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kv7nxc6sg625vl4rd4fsy4asero3jqivp7zyhaohsyww2xnk7r7yenyd.onion","pattern":"[url:value = 'http://kv7nxc6sg625vl4rd4fsy4asero3jqivp7zyhaohsyww2xnk7r7yenyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb08b715-1c2e-8dcb-dbc4-00004bc494c3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://knt3cs4tkxqdnrjrzk3n7txyhb6c5szkgjwy74jomyvy5xuli5qcdsid.onion","pattern":"[url:value = 'http://knt3cs4tkxqdnrjrzk3n7txyhb6c5szkgjwy74jomyvy5xuli5qcdsid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8e78efc-dc50-581d-e6a7-0000d3c60dfc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://khmpzqnzpya5o27lyp2vt2vw5cy7rb2mfflrhmikubhetncf2nh7ahad.onion","pattern":"[url:value = 'http://khmpzqnzpya5o27lyp2vt2vw5cy7rb2mfflrhmikubhetncf2nh7ahad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60092c10-b530-b682-7576-0000a8bd35b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jrq44df5h2xysjsajuidspv7zxl7g7v7viujicudptufaozi2i65cnad.onion","pattern":"[url:value = 'http://jrq44df5h2xysjsajuidspv7zxl7g7v7viujicudptufaozi2i65cnad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cdbe763-9a50-8bb4-971f-0000bed95edc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://j7gpjp46swlikocg3v7tlxc2zdrdlg5gft62bnqiqjgv4lzvaeg6h5id.onion","pattern":"[url:value = 'http://j7gpjp46swlikocg3v7tlxc2zdrdlg5gft62bnqiqjgv4lzvaeg6h5id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d49083ac-0cf0-700d-19a5-0000c4b5b9b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://iromfhuademn34fsfdvdrobxdj3tz7mfp2rdj4o2nmfp55fr6xgm3hyd.onion","pattern":"[url:value = 'http://iromfhuademn34fsfdvdrobxdj3tz7mfp2rdj4o2nmfp55fr6xgm3hyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7e62620-6321-d77d-0282-0000468cc7f0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://irn7otydieltebh3ex2rdfpspdxbcyrgp6kqczjtg4xd7ay7dfmbf7id.onion","pattern":"[url:value = 'http://irn7otydieltebh3ex2rdfpspdxbcyrgp6kqczjtg4xd7ay7dfmbf7id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72e42f70-ed69-79b9-1369-000015fc3380","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ijmyrvd3ntbdu22auxpgiiblzxplfw6xqpdztoosfrbqiznymayxfsyd.onion","pattern":"[url:value = 'http://ijmyrvd3ntbdu22auxpgiiblzxplfw6xqpdztoosfrbqiznymayxfsyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b41dd8f6-ef8c-76e5-dc7d-00006fd869b6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ieflygyfoezms2wshjpfyfz4hpyxjcdtxejntysvopd7n7cmmnucbkad.onion","pattern":"[url:value = 'http://ieflygyfoezms2wshjpfyfz4hpyxjcdtxejntysvopd7n7cmmnucbkad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--069b297a-2470-c80f-0b62-00008e8b7d09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://i3jwvuhloergmbeimztm6btpjzshvvcaqj2qrweeehcjhf37tndxtoqd.onion","pattern":"[url:value = 'http://i3jwvuhloergmbeimztm6btpjzshvvcaqj2qrweeehcjhf37tndxtoqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81ce199a-035e-859b-5cda-0000e32e3ea6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hut4icumte4mphbzuk7cycppiubjdzfpilgsdku6vydrn7kg7y5f6oad.onion","pattern":"[url:value = 'http://hut4icumte4mphbzuk7cycppiubjdzfpilgsdku6vydrn7kg7y5f6oad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2950b563-0f42-d20e-0da0-00004c3e3bf7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion","pattern":"[url:value = 'http://he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f396ff36-8acf-e339-1e9c-00005ed8177c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://hdyacvmmr4x2ms5tg4w5vnqzxfnlat4iosbmf7qz5xxoumnqfrcv2wqd.onion","pattern":"[url:value = 'http://hdyacvmmr4x2ms5tg4w5vnqzxfnlat4iosbmf7qz5xxoumnqfrcv2wqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e8b8636-1ec8-ad00-603b-0000c323b9e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gjv7s67txrkdxftyfyt2xpcqkp76bmy7eqlumhmile6z6z2y23jkpkad.onion","pattern":"[url:value = 'http://gjv7s67txrkdxftyfyt2xpcqkp76bmy7eqlumhmile6z6z2y23jkpkad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43010c2d-56f7-bbe2-529f-00001f51efc4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gevvr5kripac4p52ixiq3ufnkr4qasn64r5d7fsyu3kk2zmuyarbvdad.onion","pattern":"[url:value = 'http://gevvr5kripac4p52ixiq3ufnkr4qasn64r5d7fsyu3kk2zmuyarbvdad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d511b309-5850-ec8b-40c9-00005effa37d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ga6pe777wjfk6xuhkepqtfldiqjx253an7dofzmyrlwzgqipqgtwwtyd.onion","pattern":"[url:value = 'http://ga6pe777wjfk6xuhkepqtfldiqjx253an7dofzmyrlwzgqipqgtwwtyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a112c0d-907b-3290-75f2-0000af2f9d3b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g5a2thsvpabyjp6prphsque7nyaauul4rryr2nulytakggkecls23bad.onion","pattern":"[url:value = 'http://g5a2thsvpabyjp6prphsque7nyaauul4rryr2nulytakggkecls23bad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--363de2f3-10b6-f949-4d87-000077d4556e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fbehz3443h644jrcu3djvexhplhmnijilkq54puzrxuvloc42oykgiad.onion","pattern":"[url:value = 'http://fbehz3443h644jrcu3djvexhplhmnijilkq54puzrxuvloc42oykgiad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57652f4d-4f25-2969-00c3-0000a3f0f6d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fafuye3k6sfv4t4nkr2vje5s523q6hfego5cwlze6gdntvxgnjebqnid.onion","pattern":"[url:value = 'http://fafuye3k6sfv4t4nkr2vje5s523q6hfego5cwlze6gdntvxgnjebqnid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15857593-8de8-e500-dfe3-0000c4b9b90e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eyeeabnztw7jphcloghjraqihvon5pgo3gegsgypkg3cxn6jhg4wq5yd.onion","pattern":"[url:value = 'http://eyeeabnztw7jphcloghjraqihvon5pgo3gegsgypkg3cxn6jhg4wq5yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57f5f66a-d7e2-808b-2866-00003e074ba7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://elcurwunjxjhx24aud6p47htzrrkxvbispdacsatsumlunagoylbgwad.onion","pattern":"[url:value = 'http://elcurwunjxjhx24aud6p47htzrrkxvbispdacsatsumlunagoylbgwad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49852d17-1633-96ba-08ce-000050e7dd52","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://e2ejecjvrpik5bjbvdczu7bjww4epxzsyz3nl7f52oe5pi43ddcsixid.onion","pattern":"[url:value = 'http://e2ejecjvrpik5bjbvdczu7bjww4epxzsyz3nl7f52oe5pi43ddcsixid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f1fbd3e-dc62-741f-6816-000006e0502b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dx2g4nm4ouhpqd6c6ttkzbnsliw3empzrwej3ilbwo6zz4g5rcgeazid.onion","pattern":"[url:value = 'http://dx2g4nm4ouhpqd6c6ttkzbnsliw3empzrwej3ilbwo6zz4g5rcgeazid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25527e0f-ea8b-c91a-f89d-0000cbf36616","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dr2tr76ftudjccp4zc7fks5lhk3pg3rifl3rcc36bgm46sfivkq2sfqd.onion","pattern":"[url:value = 'http://dr2tr76ftudjccp4zc7fks5lhk3pg3rifl3rcc36bgm46sfivkq2sfqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13cd5147-faac-d7a4-17c2-0000c7d60ce0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://doh3rlqtvg24yu4r4w7bk5twm7w6nm7wqsr3d3roc7jisrdqf5catnad.onion","pattern":"[url:value = 'http://doh3rlqtvg24yu4r4w7bk5twm7w6nm7wqsr3d3roc7jisrdqf5catnad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cfbb45f-bcb7-e1fc-04e5-000039506c37","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dgxxqqhvob4cvriyy2rdiwgyvuqewwsq4tbq7rnk5ulqh6zvroutvpyd.onion","pattern":"[url:value = 'http://dgxxqqhvob4cvriyy2rdiwgyvuqewwsq4tbq7rnk5ulqh6zvroutvpyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--013732db-9a66-e893-cca9-000020676e00","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dcoezwwwxij2trzd3oqhtyjg3lgvgzmyzrj2pcs3rdfh4tl5267dwpyd.onion","pattern":"[url:value = 'http://dcoezwwwxij2trzd3oqhtyjg3lgvgzmyzrj2pcs3rdfh4tl5267dwpyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1dac9f9-f23d-4f3e-0da2-0000325d5a8d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://d2abffaqhce6cbnlrdcsb3iafxhr5iqmezpfoxkpx3zf5j7tngqdskid.onion","pattern":"[url:value = 'http://d2abffaqhce6cbnlrdcsb3iafxhr5iqmezpfoxkpx3zf5j7tngqdskid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8324e303-60ec-e418-ac04-0000bf60bf8a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://civmwfeogouzf27jldj2buu3ihmpooupjhfbdgdth6maptrntim6oiid.onion","pattern":"[url:value = 'http://civmwfeogouzf27jldj2buu3ihmpooupjhfbdgdth6maptrntim6oiid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eafb7b29-bfea-9804-f827-0000254eb382","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://chygou6fs4nu2r56ncfd3crjb62s6sysulg7y7ds2tbdoa4d3wcwrdyd.onion","pattern":"[url:value = 'http://chygou6fs4nu2r56ncfd3crjb62s6sysulg7y7ds2tbdoa4d3wcwrdyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c7e1d13-993b-fc04-8d1a-0000a2c768ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cfj4bsnfi4ktpfoei7uqggz5sb443fhvvbkxbmu3dhfriomg2txxgxid.onion","pattern":"[url:value = 'http://cfj4bsnfi4ktpfoei7uqggz5sb443fhvvbkxbmu3dhfriomg2txxgxid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49cb73c3-8803-8dc0-57d9-00006f3b5cf3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cffb3fd2sofyiemffnzy7jjbuq7la3nftexl26574q3xkw5ycqf2r3id.onion","pattern":"[url:value = 'http://cffb3fd2sofyiemffnzy7jjbuq7la3nftexl26574q3xkw5ycqf2r3id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09e9b0aa-0991-da6a-827b-00001d8a6975","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://c5ic3pm46hytw4r47z6t6yxsffndo52lcitf5sgauwyrqmsjfb4etdqd.onion","pattern":"[url:value = 'http://c5ic3pm46hytw4r47z6t6yxsffndo52lcitf5sgauwyrqmsjfb4etdqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e6178a0-024f-d098-a74f-0000f05dbad0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bvn5r7dzfdn2k2wcv7ifwtvi37zsm5kxv776nqw5lh7hwr4gd7msyhyd.onion","pattern":"[url:value = 'http://bvn5r7dzfdn2k2wcv7ifwtvi37zsm5kxv776nqw5lh7hwr4gd7msyhyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36228236-5122-9393-999c-000008456797","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bq67odzyhxshp3vcvdvau4xosn54rmudy3dzqlmm2hkd3m4b2qackcad.onion","pattern":"[url:value = 'http://bq67odzyhxshp3vcvdvau4xosn54rmudy3dzqlmm2hkd3m4b2qackcad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--647bfea6-f240-8236-9b1f-0000646b009f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://boq6yg6a523cqjbsu7nwjscakdpnjlyytapnodmmimh63kq7r3l3hmyd.onion","pattern":"[url:value = 'http://boq6yg6a523cqjbsu7nwjscakdpnjlyytapnodmmimh63kq7r3l3hmyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf42026b-c730-1e98-7f59-00001a1023ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bmebpteoa53k76zoiafykh4axr4kzbx7jn2djvdrdde4r57bckkfxsyd.onion","pattern":"[url:value = 'http://bmebpteoa53k76zoiafykh4axr4kzbx7jn2djvdrdde4r57bckkfxsyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5a32e8d-7814-b5f9-a474-0000594336c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bjiztkvfzboiiggfnf3pctsyllq6fy6rmllxbq4rk7uyd3w4eh2snpad.onion","pattern":"[url:value = 'http://bjiztkvfzboiiggfnf3pctsyllq6fy6rmllxbq4rk7uyd3w4eh2snpad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41056d64-05e9-1d86-eaad-00001b91c776","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://arzaonkha4jubxjgg47dkjjz42ol72wmwvjmtz47a33box2gupk2v4ad.onion","pattern":"[url:value = 'http://arzaonkha4jubxjgg47dkjjz42ol72wmwvjmtz47a33box2gupk2v4ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3024d3f7-c3a7-35a2-4988-0000d2eb52c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://amo6c37dbe2bkgpopymaqms4vusn7kafqxy7pgqk2etengd76xk5w3ad.onion","pattern":"[url:value = 'http://amo6c37dbe2bkgpopymaqms4vusn7kafqxy7pgqk2etengd76xk5w3ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a401ef3c-a532-b268-08b8-000077e6864b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ajdtbop62plz3s2uw3rjtegilw4lfmixl7h4p6oset5rq5jihwtehtad.onion","pattern":"[url:value = 'http://ajdtbop62plz3s2uw3rjtegilw4lfmixl7h4p6oset5rq5jihwtehtad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c14cd785-1675-583e-af41-0000a29bc267","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://afl6q5mjgzgm765wfneiojktyppxbhkclhghfgcfpvr2nmadczqs4sqd.onion","pattern":"[url:value = 'http://afl6q5mjgzgm765wfneiojktyppxbhkclhghfgcfpvr2nmadczqs4sqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c64738f0-3924-3742-3f32-0000be955e70","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://acvhxy4cc52a7iv7ugc4eq6dq6nus2s5xduew7s2wkaw6nhftasyq2yd.onion","pattern":"[url:value = 'http://acvhxy4cc52a7iv7ugc4eq6dq6nus2s5xduew7s2wkaw6nhftasyq2yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35cef5c8-f6c1-8d2a-b480-00007edd782c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://a5ciw2q5jijci5wj63s47zpul7bq3n36ng2qncta24yc6bsmkhoeg2ad.onion","pattern":"[url:value = 'http://a5ciw2q5jijci5wj63s47zpul7bq3n36ng2qncta24yc6bsmkhoeg2ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a6f4339-d57e-c2d1-e231-0000d995fba4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7pwwm7j5w5gjgs7nibha6dqknqliiwqvimkkja7zdgmozx2ikjtfigad.onion","pattern":"[url:value = 'http://7pwwm7j5w5gjgs7nibha6dqknqliiwqvimkkja7zdgmozx2ikjtfigad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8d9e31d-70ed-2b7c-6903-00006ad4bf0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://752ezjq6t4pwdtrwviimap3wlzqm2qzd6hh2rwffzq3d2urw3o7xa6qd.onion","pattern":"[url:value = 'http://752ezjq6t4pwdtrwviimap3wlzqm2qzd6hh2rwffzq3d2urw3o7xa6qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09c48ada-9d64-7991-f46d-0000290d8329","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://73tzbwujmnmz35k74eclnhlkwmnjrlmfeut3udxwnfsc53kg2kvdpead.onion","pattern":"[url:value = 'http://73tzbwujmnmz35k74eclnhlkwmnjrlmfeut3udxwnfsc53kg2kvdpead.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd0fa709-140b-9e4d-51d6-00008a5e4923","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6lbwfgybggslvhkbsfqo427sqnfhutb65wmhvj5qlko32farj6w45qid.onion","pattern":"[url:value = 'http://6lbwfgybggslvhkbsfqo427sqnfhutb65wmhvj5qlko32farj6w45qid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6df3fd4-491a-c66f-7027-000030443d8d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5rosrz5d53usc6p7s7qjvvcqv4bbedvpjsv3dzls7kuend2i65s7peqd.onion","pattern":"[url:value = 'http://5rosrz5d53usc6p7s7qjvvcqv4bbedvpjsv3dzls7kuend2i65s7peqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8630f9d-5bb1-fa1a-2e53-0000529e42c8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5igait2ocdf7kfktyemdgdl6cot43ryecr5ycqid6drydhpuzibu54qd.onion","pattern":"[url:value = 'http://5igait2ocdf7kfktyemdgdl6cot43ryecr5ycqid6drydhpuzibu54qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a2296a1-0ac4-ee9e-4a6f-0000deb71ebb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5hhrba7et452bt3ttwqewumlua5t3vyyr27iomrv2o3ae6of3l7hghad.onion","pattern":"[url:value = 'http://5hhrba7et452bt3ttwqewumlua5t3vyyr27iomrv2o3ae6of3l7hghad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c861b3a-0ba7-347c-3224-00007067c87b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5ety7tpkim5me6eszuwcje7bmy25pbtrjtue7zkqqgziljwqy3rrikqd.onion","pattern":"[url:value = 'http://5ety7tpkim5me6eszuwcje7bmy25pbtrjtue7zkqqgziljwqy3rrikqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81c65dd9-71b7-e1a0-174c-00000b3c0f0c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://5e2q3uzczl3bur23dxfxxu5unlukuqrlseesmxc7v7dmo4qgbr3kaxqd.onion","pattern":"[url:value = 'http://5e2q3uzczl3bur23dxfxxu5unlukuqrlseesmxc7v7dmo4qgbr3kaxqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb375701-4805-91e6-fac1-0000b8f341fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4qmsi7vcdrrutxapxbc7eofjjzfsvam3fehgmk6xyivwcroqkqjij5qd.onion","pattern":"[url:value = 'http://4qmsi7vcdrrutxapxbc7eofjjzfsvam3fehgmk6xyivwcroqkqjij5qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e75862b7-2ca2-94e8-c599-0000061c7d3f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4mncnm5bl3jfotcgrn7zv2uznfzs2oo4sahwrlqvwcd265x6jdudkcid.onion","pattern":"[url:value = 'http://4mncnm5bl3jfotcgrn7zv2uznfzs2oo4sahwrlqvwcd265x6jdudkcid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6eeae1b6-cd7a-4696-24a5-0000321f0ea9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4kfzqzfci7uqpgngrosuukgj2dr745cyqgenbaojycdykgxipabnyqyd.onion","pattern":"[url:value = 'http://4kfzqzfci7uqpgngrosuukgj2dr745cyqgenbaojycdykgxipabnyqyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d31912b1-0313-7e30-60cc-00002c750949","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://425yxsnocj47lwgueymn7y4y4vrphccooa3diabzoqdl6cslxriqxrqd.onion","pattern":"[url:value = 'http://425yxsnocj47lwgueymn7y4y4vrphccooa3diabzoqdl6cslxriqxrqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10fee713-732c-48fd-0067-0000a12ce2a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3xa42kwkeiwzhjybddfeifad7vn2kvsslybquledvib5xsfkylwtwyid.onion","pattern":"[url:value = 'http://3xa42kwkeiwzhjybddfeifad7vn2kvsslybquledvib5xsfkylwtwyid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a8ddffd-7dc5-8bf8-72ad-0000dcc3832a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3s5pzwlqllrzz4xlluholmqgueje7lutlugbdnwa3ehbedrxaq5wjbad.onion","pattern":"[url:value = 'http://3s5pzwlqllrzz4xlluholmqgueje7lutlugbdnwa3ehbedrxaq5wjbad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cec70f90-94ba-19b4-0517-00008bfdb64c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3oz6naflgy7gbtc4psqumk4dd7meq37tjxw7qxhytuiysyq3632xgsqd.onion","pattern":"[url:value = 'http://3oz6naflgy7gbtc4psqumk4dd7meq37tjxw7qxhytuiysyq3632xgsqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a219b74-4731-293a-8584-00007952c6c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3md3it5uxkebudflmlratms66jvwkrdphzoo4nzsvwh63niqpz42aeyd.onion","pattern":"[url:value = 'http://3md3it5uxkebudflmlratms66jvwkrdphzoo4nzsvwh63niqpz42aeyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d452bbc-0e20-8bda-5e07-000048f40ae1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3kqfll43jsj7boglorh5xntudnynlk6howi6ks543cctlrnid4dzwdad.onion","pattern":"[url:value = 'http://3kqfll43jsj7boglorh5xntudnynlk6howi6ks543cctlrnid4dzwdad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2aca4767-2857-7ce0-97f3-00007d676a4d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3id2g6u3dwvg7nsarfkgsdf3odp5hb7owvnoqbipbisekudptetuxtad.onion","pattern":"[url:value = 'http://3id2g6u3dwvg7nsarfkgsdf3odp5hb7owvnoqbipbisekudptetuxtad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--729ddab3-9567-0851-7332-0000c607c7f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3g7cqn66j3uwes7jah744u6fzuzymvnlubn67624jwvswoollqkjtzqd.onion","pattern":"[url:value = 'http://3g7cqn66j3uwes7jah744u6fzuzymvnlubn67624jwvswoollqkjtzqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25bb52d1-a984-36ed-bb47-0000ac034f5e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3fgntkytua2jb7rarvuchns6ka7tfh3uc6ypub3ffepjq3jekb3eypyd.onion","pattern":"[url:value = 'http://3fgntkytua2jb7rarvuchns6ka7tfh3uc6ypub3ffepjq3jekb3eypyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--640ac77a-b615-9e05-15c2-0000c97e00db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3bkgnqvrdlzib4t62oyo22eqljdrjaxtwcsvgwystog6yiyx7j7b7nad.onion","pattern":"[url:value = 'http://3bkgnqvrdlzib4t62oyo22eqljdrjaxtwcsvgwystog6yiyx7j7b7nad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d3b63b-eb2e-b5f2-d2ca-0000710dc54d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2udgodqyt6jn7s7cb7n66kaisg7i6gxo5n64tnvlk7dee4d4rguojbid.onion","pattern":"[url:value = 'http://2udgodqyt6jn7s7cb7n66kaisg7i6gxo5n64tnvlk7dee4d4rguojbid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ae6c766-be0c-cd89-9fec-000075fef4b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2plv344u23ebuayurqcfbjbnxpqzqknja3ca7ulbnnwtgb6tpmqqsvid.onion","pattern":"[url:value = 'http://2plv344u23ebuayurqcfbjbnxpqzqknja3ca7ulbnnwtgb6tpmqqsvid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5033feb0-b701-d9bc-5da3-000004c716cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://24y6h7fwi2fvlv2kuzudyiumjqz4rgqcml2wr7te6ugcgt6qatqe64yd.onion","pattern":"[url:value = 'http://24y6h7fwi2fvlv2kuzudyiumjqz4rgqcml2wr7te6ugcgt6qatqe64yd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71a14e6a-4bdb-3353-a686-00007e1dfadc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xnsbsjciylsg23zfmrv6ocuyh7ha5zexeouchlr3zsi5suda4arpeyqd.onion/","pattern":"[url:value = 'http://xnsbsjciylsg23zfmrv6ocuyh7ha5zexeouchlr3zsi5suda4arpeyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c985ba40-737a-f207-ed3b-00000714f93a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion/","pattern":"[url:value = 'http://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f741f1b-30e0-f4c6-c1a4-00007e37b2fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://d75itpgjjfe2ys2qivqplbvmw3yyx7o5e4ppt2esit2lluhngulz4hqd.onion/","pattern":"[url:value = 'http://d75itpgjjfe2ys2qivqplbvmw3yyx7o5e4ppt2esit2lluhngulz4hqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d72621c-7c9e-9353-127a-0000088a06a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onion/","pattern":"[url:value = 'http://vqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b537f74-9c4b-150f-2d1f-0000fd4be00e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/api/blog/all/0/6","pattern":"[url:value = 'http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/api/blog/all/0/6']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd5a949e-e287-7724-a74d-00009d68271d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion","pattern":"[url:value = 'http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5cd4a2b-12f8-8daf-7485-00002f2df5d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cadosecurity.com/resources-for-dfir-professionals-responding-to-whispergate-malware/","pattern":"[url:value = 'https://www.cadosecurity.com/resources-for-dfir-professionals-responding-to-whispergate-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d59ab191-1524-ef32-80e2-0000e5a3721f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5a3825e-1381-1daa-5fd8-0000d43e4e4a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ragnarok","pattern":"[url:value = 'https://www.ransomlook.io/group/ragnarok']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c699b0a-8818-8d28-7f01-00005f3a4a39","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-targets-citrix-adc-disables-windows-defender/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-targets-citrix-adc-disables-windows-defender/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20b233e4-7cff-3281-a437-00008b998a62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-releases-master-decryptor-after-shutdown/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-releases-master-decryptor-after-shutdown/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd1b78b8-7cd1-e46d-8757-000052b8d0c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/05/21/asnarok2/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/05/21/asnarok2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e425941-3c59-f354-5597-0000768564a6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/k-vitali/Malware-Misc-RE/blob/master/2020-01-26-ragnarok-cfg-vk.notes.raw","pattern":"[url:value = 'https://github.com/k-vitali/Malware-Misc-RE/blob/master/2020-01-26-ragnarok-cfg-vk.notes.raw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbfe8851-1eff-2844-dbb1-00003057cc8a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sababasecurity.com/cheese-shortage-in-dutch-supermarkets-after-a-ransomware-attack","pattern":"[url:value = 'https://www.sababasecurity.com/cheese-shortage-in-dutch-supermarkets-after-a-ransomware-attack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c287a706-eb40-ac65-4b41-000062610573","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cpomagazine.com/cyber-security/ragnarok-ransomware-gang-closes-up-shop-leaves-master-decryptor-key-behind","pattern":"[url:value = 'https://www.cpomagazine.com/cyber-security/ragnarok-ransomware-gang-closes-up-shop-leaves-master-decryptor-key-behind']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e8f6834-576e-4adf-b17e-0000073777f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://techcrunch.com/2021/08/30/ragnarok-ransomware-gang-shuts-down-and-releases-its-decryption-key","pattern":"[url:value = 'https://techcrunch.com/2021/08/30/ragnarok-ransomware-gang-shuts-down-and-releases-its-decryption-key']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a45a6b0b-565c-3974-ac1f-0000f594a06d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://borncity.com/win/2021/03/27/tu-darmstadt-opfer-der-ragnarok-ransomware/","pattern":"[url:value = 'https://borncity.com/win/2021/03/27/tu-darmstadt-opfer-der-ragnarok-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8219a350-e250-f458-0308-0000798b2c76","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnaro","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnaro']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb3ce440-b226-c914-764e-0000919182ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://files.avast.com/files/decryptor/avast_decryptor_mafiaware666.exe","pattern":"[url:value = 'https://files.avast.com/files/decryptor/avast_decryptor_mafiaware666.exe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3a16378-fbe9-0ccb-0bba-00004195d7ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decoded.avast.io/threatresearch/decrypted-mafiaware666-ransomware/","pattern":"[url:value = 'https://decoded.avast.io/threatresearch/decrypted-mafiaware666-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f160336-41dc-30a4-85fb-00000b693a61","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1380610583603638277","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1380610583603638277']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dcff4c6-5202-97d1-2cac-00001a5f54f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/kangxiaopao/status/1342027328063295488?lang=en","pattern":"[url:value = 'https://twitter.com/kangxiaopao/status/1342027328063295488?lang=en']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09f6dbb0-995a-a72a-4601-0000073af04a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2020/12/jcrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2020/12/jcrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84a6f97f-e8af-fdbc-43f0-000096c566b6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: titancrypt.txt","pattern":"[domain-name:value = 'titancrypt.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8746567a-1a39-7dc4-ca26-0000e0460023","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: watching.txt","pattern":"[domain-name:value = 'watching.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f6a1568-084b-633f-ee55-00008c849d74","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: crypted.txt","pattern":"[domain-name:value = 'crypted.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2feb6797-366c-ea38-1376-0000beb75449","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ncovid.txt","pattern":"[domain-name:value = 'ncovid.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09a09eff-c50e-ef5f-afc1-00006fe10e3c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: omero.txt","pattern":"[domain-name:value = 'omero.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--002acd51-957a-560e-d62c-0000be71a669","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: daddycrypt.txt","pattern":"[domain-name:value = 'daddycrypt.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73cf572f-050e-3d2a-ab9d-0000a3f9926a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: jcrypt.txt","pattern":"[domain-name:value = 'jcrypt.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1579bb4-3c42-45e0-2da6-0000519b8455","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://1.bp.blogspot.com/-OF8CopM3MUw/X-XLjUmRkYI/AAAAAAAAXpY/1mLe136SuT8DuruWJfwIVY5WnVs5B1gcgCLcBGAsYHQ/s943/txt-note.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-OF8CopM3MUw/X-XLjUmRkYI/AAAAAAAAXpY/1mLe136SuT8DuruWJfwIVY5WnVs5B1gcgCLcBGAsYHQ/s943/txt-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aca5a85-7f09-be9f-03af-0000933664ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: this.email.address","pattern":"[domain-name:value = 'this.email.address']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21663bfc-2a3e-58d3-baad-0000d0cbe46e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malware-guide.com/blog/remove-amjixius-ransomware-restore-encrypted-files","pattern":"[url:value = 'https://malware-guide.com/blog/remove-amjixius-ransomware-restore-encrypted-files']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82c6f87e-0f80-ba53-6f9f-0000047b0c46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: Http://www.coindesk.com/information/how-can-i-buy-bitcoins/\\n\\nAttention","pattern":"[url:value = 'Http://www.coindesk.com/information/how-can-i-buy-bitcoins/\\\\n\\\\nAttention']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a400b15-5af0-b63f-15a6-00007bb3bc14","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://theravenfile.com/2025/04/10/hellokitty-resurfaced/","pattern":"[url:value = 'https://theravenfile.com/2025/04/10/hellokitty-resurfaced/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a875dd57-caf8-4ffc-a27b-0000897c43d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fivehands-ransomware-uses-new-malware-to-steal-data-before-encrypting/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fivehands-ransomware-uses-new-malware-to-steal-data-before-encrypting/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abf80dc9-ef3b-5383-e68b-00006cc0eca9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/fivehands-ransomware-replaces-hellokitty/","pattern":"[url:value = 'https://www.sentinelone.com/labs/fivehands-ransomware-replaces-hellokitty/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--314d8947-b1de-d620-95c0-0000638fc0f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/e/fivehands-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/e/fivehands-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d75993f3-dce1-eb30-7c00-00000b2fb879","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/fivehands","pattern":"[url:value = 'https://www.ransomlook.io/group/fivehands']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6a352a0-f4a7-0009-cecd-0000ea5cd58c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/hellokitty","pattern":"[url:value = 'https://www.ransomlook.io/group/hellokitty']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91682181-cca8-9287-2a6b-0000db77c801","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.speartip.com/resources/fbi-hellokitty-ransomware-adds-ddos-to-extortion-arsenal/","pattern":"[url:value = 'https://www.speartip.com/resources/fbi-hellokitty-ransomware-adds-ddos-to-extortion-arsenal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fccde56-bffd-416b-4911-0000112e71a9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2021/211029.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2021/211029.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--573f0d0e-7079-6da6-c47b-0000fd203b83","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/","pattern":"[url:value = 'https://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7343c904-3f22-fcc4-084a-00000692912c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/new-ransomware-variant-uses-golang-packer/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/new-ransomware-variant-uses-golang-packer/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cefaaa8d-8f5d-155e-5650-0000141b82d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/uscert/ncas/alerts/aa22-249a","pattern":"[url:value = 'https://www.cisa.gov/uscert/ncas/alerts/aa22-249a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60ca7eae-e87a-53d1-514b-0000ed9d4a72","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cadosecurity.com/post/punk-kitty-ransom-analysing-hellokitty-ransomware-attacks","pattern":"[url:value = 'https://www.cadosecurity.com/post/punk-kitty-ransom-analysing-hellokitty-ransomware-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef8f9696-8839-583e-5a82-000057f4322e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hellokitty-ransomware-is-targeting-vulnerable-sonicwall-devices/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hellokitty-ransomware-is-targeting-vulnerable-sonicwall-devices/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a12947e-fd4e-486e-7d65-00004c8d3ec8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/fwosar/status/1359167108727332868","pattern":"[url:value = 'https://twitter.com/fwosar/status/1359167108727332868']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fd10ed5-7a8b-d9dc-895b-000010637dc6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/proferosec-osm/static-unpacker-and-decoder-for-hello-kitty-packer-91a3e8844cb7","pattern":"[url:value = 'https://medium.com/proferosec-osm/static-unpacker-and-decoder-for-hello-kitty-packer-91a3e8844cb7']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc8b9cf8-fe0d-efac-2b4d-0000e83ff8a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.sentinelone.com/hellokitty-ransomware-lacks-stealth-but-still-strikes-home/","pattern":"[url:value = 'https://labs.sentinelone.com/hellokitty-ransomware-lacks-stealth-but-still-strikes-home/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e233de1-1186-8f27-2ae8-000094d9c66b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2020/11/hellokitty-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2020/11/hellokitty-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8501157-ea23-941c-f705-0000a5370f97","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-spotlight/2021/03/hellokitty-when-cyberpunk-met-cy-purr-crime/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-spotlight/2021/03/hellokitty-when-cyberpunk-met-cy-purr-crime/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69ebbcea-f6fe-8b0d-33b9-00002fabcaf5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.govinfosecurity.com/vice-society-ransomware-gang-disrupted-spar-stores-a-18225","pattern":"[url:value = 'https://www.govinfosecurity.com/vice-society-ransomware-gang-disrupted-spar-stores-a-18225']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--513013f4-1032-12c0-7c42-0000018defcd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/linux-version-of-hellokitty-ransomware-targets-vmware-esxi-servers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/linux-version-of-hellokitty-ransomware-targets-vmware-esxi-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2876c28-ca54-f3f5-eddb-000078bc601c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://soolidsnake.github.io/2021/07/17/hellokitty_linux.html","pattern":"[url:value = 'https://soolidsnake.github.io/2021/07/17/hellokitty_linux.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a08f32c-cae6-226d-f72d-0000f46bc03c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.sekoia.io/vice-society-a-discreet-but-steady-double-extortion-ransomware-group","pattern":"[url:value = 'https://blog.sekoia.io/vice-society-a-discreet-but-steady-double-extortion-ransomware-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2ce8a85-8999-598e-069b-0000ae380361","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gunyhng6pabzcurl7ipx2pbmjxpvqnu6mxf2h3vdeenam34inj4ndryd.onion/","pattern":"[url:value = 'http://gunyhng6pabzcurl7ipx2pbmjxpvqnu6mxf2h3vdeenam34inj4ndryd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0d02918-2d0d-664c-8b41-000024d6fa99","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/sifrecikis","pattern":"[url:value = 'https://www.ransomlook.io/group/sifrecikis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be481f9a-c4ab-b8c5-02fc-0000b1afbf0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sifrecikx7s62cjv.onion/","pattern":"[url:value = 'http://sifrecikx7s62cjv.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2387ac34-30b2-6d1e-9995-0000a67aeda7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/pay2key","pattern":"[url:value = 'https://www.ransomlook.io/group/pay2key']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--190fe0fe-5f56-3bc0-f056-000085edf510","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/intels-habana-labs-hacked-by-pay2key-ransomware-data-stolen/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/intels-habana-labs-hacked-by-pay2key-ransomware-data-stolen/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0dcc848-bd37-21ce-4b88-000006b95a8f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/TrendMicroRSRCH/status/1389422784808378370","pattern":"[url:value = 'https://twitter.com/TrendMicroRSRCH/status/1389422784808378370']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60ef7634-ba29-f94f-4a26-00009ec4291b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://keybase.io/pay2key","pattern":"[url:value = 'https://keybase.io/pay2key']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efb9ada2-e045-c8f2-64ff-0000879e05c3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.twitter.com/p2ktwtacc","pattern":"[url:value = 'https://www.twitter.com/p2ktwtacc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4055648-a64c-a215-4bff-00001674976f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://research.checkpoint.com/2020/ransomware-alert-pay2key","pattern":"[url:value = 'https://research.checkpoint.com/2020/ransomware-alert-pay2key']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2d1a88f-1f9c-a058-c5c0-00008915cd12","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pay2keys7rgdzrhgzxyd7egpxc2pusdrkofmqfnwclts2rnjsrva.b32.i2p/?i=3d1e4594aeb351854fcc800da08214a059ed16","pattern":"[url:value = 'http://pay2keys7rgdzrhgzxyd7egpxc2pusdrkofmqfnwclts2rnjsrva.b32.i2p/?i=3d1e4594aeb351854fcc800da08214a059ed16']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6060b0ca-53df-a5cb-09d8-0000c13999b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/loki","pattern":"[url:value = 'https://www.ransomlook.io/group/loki']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72332caa-7dd7-49d6-47ef-0000a67897d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/makop","pattern":"[url:value = 'https://www.ransomlook.io/group/makop']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e64a4449-0322-52bb-7d4a-00008921d188","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/conti","pattern":"[url:value = 'https://www.ransomlook.io/group/conti']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60c122a0-f89b-8e7e-d8d3-000066dfaca8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://yoroi.company/research/conti-ransomware-source-code-a-well-designed-cots-ransomware/","pattern":"[url:value = 'https://yoroi.company/research/conti-ransomware-source-code-a-well-designed-cots-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f1d664e-7e10-91a6-a811-0000ded34583","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/conti-ransomware-attacks-persist-updated-version-despite-leaks","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/conti-ransomware-attacks-persist-updated-version-despite-leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b8f0400-b628-bbbd-583f-0000ed1d1e60","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=uORuVVQzZ0A","pattern":"[url:value = 'https://www.youtube.com/watch?v=uORuVVQzZ0A']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52b52b74-3292-f870-b8a0-00006af53f1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=hmaWy9QIC7c","pattern":"[url:value = 'https://www.youtube.com/watch?v=hmaWy9QIC7c']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0df92d56-a52b-5b89-325a-0000780c07f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-2","pattern":"[url:value = 'https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94f07cec-5002-3476-7065-00006ab9a818","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-1","pattern":"[url:value = 'https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6e55c37-f431-740c-080a-0000133cb2c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks","pattern":"[url:value = 'https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06781f4e-cebc-fe38-305c-00001df612f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trmlabs.com/post/analysis-corroborates-suspected-ties-between-conti-and-ryuk-ransomware-groups-and-wizard-spider","pattern":"[url:value = 'https://www.trmlabs.com/post/analysis-corroborates-suspected-ties-between-conti-and-ryuk-ransomware-groups-and-wizard-spider']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfa98964-83fd-3d55-ade3-0000fee31ec3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-conti","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-conti']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cda6c9d-f2b1-1aa3-ca33-0000aef371f0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e0be42a-3974-f42f-8dfd-00006c6c69f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf","pattern":"[url:value = 'https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ae62e56-d7ae-e681-61b9-0000de2959f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/the-sound-of-malware.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/the-sound-of-malware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54a254b3-42c1-6a98-69b9-0000d5615f27","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.threatstop.com/blog/conti-ransomware-source-code-leaked","pattern":"[url:value = 'https://www.threatstop.com/blog/conti-ransomware-source-code-leaked']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5a99b88-6838-73cc-5793-000026ef47ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.silentpush.com/blog/consequences-the-conti-leaks-and-future-problems","pattern":"[url:value = 'https://www.silentpush.com/blog/consequences-the-conti-leaks-and-future-problems']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4985aa29-d347-70d3-aa01-00000ad01b44","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-two/","pattern":"[url:value = 'https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-two/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88211878-aa15-778f-a290-000060e6f4c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-one","pattern":"[url:value = 'https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-one']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b11b780-fd5b-11c5-9005-0000d47746c8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships","pattern":"[url:value = 'https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3edf303d-7ebf-a01b-1a9e-000011efcae5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.redhotcyber.com/post/il-ransomware-conti-si-schiera-a-favore-della-russia","pattern":"[url:value = 'https://www.redhotcyber.com/post/il-ransomware-conti-si-schiera-a-favore-della-russia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81574cbe-dfe8-1531-801b-00009275526b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.prodaft.com/m/reports/Conti_TLPWHITE_v1.6_WVcSEtc.pdf","pattern":"[url:value = 'https://www.prodaft.com/m/reports/Conti_TLPWHITE_v1.6_WVcSEtc.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd6a9d65-681a-4451-2133-0000d3e23089","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.prevailion.com/what-wicked-webs-we-unweave/","pattern":"[url:value = 'https://www.prevailion.com/what-wicked-webs-we-unweave/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0781b101-062a-1e30-fb5e-000092d503d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf","pattern":"[url:value = 'https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4680326c-2e81-4b34-f1fb-0000b573a0fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mbsd.jp/research/20210413/conti-ransomware/","pattern":"[url:value = 'https://www.mbsd.jp/research/20210413/conti-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4a22fa2-0765-3313-53b5-0000044e36fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mbsd.jp/2022/03/08/assets/images/MBSD_Summary_of_ContiLeaks_Rev3.pdf","pattern":"[url:value = 'https://www.mbsd.jp/2022/03/08/assets/images/MBSD_Summary_of_ContiLeaks_Rev3.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a12ebaae-32b2-5824-6354-0000e56c7e98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2021/210521.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2021/210521.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc79afa1-e510-1da1-5702-00002c8a1b8b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf","pattern":"[url:value = 'https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f51c6fee-de26-2d37-8114-0000a16e93d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire","pattern":"[url:value = 'https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8b10d43-b919-7a80-c209-00008f628ba8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elliptic.co/blog/conti-ransomware-nets-at-least-25.5-million-in-four-months","pattern":"[url:value = 'https://www.elliptic.co/blog/conti-ransomware-nets-at-least-25.5-million-in-four-months']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c430f29f-bd6b-921a-a33b-0000026a0934","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.eldiario.es/tecnologia/capos-cibercrimen-avisan-contratacaran-si-hackea-rusia_1_8795458.html","pattern":"[url:value = 'https://www.eldiario.es/tecnologia/capos-cibercrimen-avisan-contratacaran-si-hackea-rusia_1_8795458.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70e4bf6b-b2dd-c883-30b8-000074cef509","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.dragos.com/blog/industry-news/suspected-conti-ransomware-activity-in-the-auto-manufacturing-sector/","pattern":"[url:value = 'https://www.dragos.com/blog/industry-news/suspected-conti-ransomware-activity-in-the-auto-manufacturing-sector/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40f904ff-1e42-cf28-da02-0000eae3febf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.darktrace.com/en/blog/the-double-extortion-business-conti-ransomware-gang-finds-new-avenues-of-negotiation/","pattern":"[url:value = 'https://www.darktrace.com/en/blog/the-double-extortion-business-conti-ransomware-gang-finds-new-avenues-of-negotiation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4125f167-9faf-bfa5-c87d-0000ff4d9cf1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cynet.com/attack-techniques-hands-on/shelob-moonlight-spinning-a-larger-web/","pattern":"[url:value = 'https://www.cynet.com/attack-techniques-hands-on/shelob-moonlight-spinning-a-larger-web/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0b06d2a-6c2a-7f8f-0764-0000da9e205e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyberscoop.com/ransomware-gang-conti-bounced-back/","pattern":"[url:value = 'https://www.cyberscoop.com/ransomware-gang-conti-bounced-back/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbf9fa9a-93d6-cce1-e218-00002ec03bbc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/threat-analysis-report-from-shatak-emails-to-the-conti-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/threat-analysis-report-from-shatak-emails-to-the-conti-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51e4f0d5-ccbe-e2ec-6751-0000ccef75f8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyberark.com/resources/threat-research-blog/conti-group-leaked","pattern":"[url:value = 'https://www.cyberark.com/resources/threat-research-blog/conti-group-leaked']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4eb2526c-63b3-0be3-c5f4-000018599ad2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.connectwise.com/resources/conti-profile","pattern":"[url:value = 'https://www.connectwise.com/resources/conti-profile']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ac29cf8-34c7-f344-a377-0000e73f0126","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.clearskysec.com/wp-content/uploads/2021/02/Conti-Ransomware.pdf","pattern":"[url:value = 'https://www.clearskysec.com/wp-content/uploads/2021/02/Conti-Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f16d2fd-ad0c-4e67-3bb1-00000eb0b76e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b57979a-3b06-86d4-a312-0000cffda029","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/taiwanese-apple-and-tesla-contractor-hit-by-conti-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/taiwanese-apple-and-tesla-contractor-hit-by-conti-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7ff9f07-c566-2c60-5b82-00002ae22ac4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ryuk-successor-conti-ransomware-releases-data-leak-site/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ryuk-successor-conti-ransomware-releases-data-leak-site/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--000c403d-63e4-700f-c3be-0000210a3043","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bc54c8e-cb24-52f9-f568-0000a81f4589","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae4002ca-ddb1-764d-b1f2-00002ca47584","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hhs-conti-ransomware-encrypted-80-percent-of-irelands-hse-it-systems/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hhs-conti-ransomware-encrypted-80-percent-of-irelands-hse-it-systems/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d4b701c-5454-8dc6-c0f7-00002f7bfec9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0a9f7b3-7ec4-b6c5-9f6e-0000c7996901","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/conti-ransomwares-internal-chats-leaked-after-siding-with-russia/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/conti-ransomwares-internal-chats-leaked-after-siding-with-russia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36c4eb97-193d-7732-28d4-00002da9c763","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/conti-ransomware-source-code-leaked-by-ukrainian-researcher/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/conti-ransomware-source-code-leaked-by-ukrainian-researcher/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a574c75-6f88-0b33-7f75-00000f8f2bd1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/conti-ransomware-gang-takes-over-trickbot-malware-operation/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/conti-ransomware-gang-takes-over-trickbot-malware-operation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fdb69d2-4629-9f62-154f-0000df457f0d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/cisa-updates-conti-ransomware-alert-with-nearly-100-domain-names/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/cisa-updates-conti-ransomware-alert-with-nearly-100-domain-names/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0a91990-03c2-c01b-7ed9-00003d6f4ffa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/angry-conti-ransomware-affiliate-leaks-gangs-attack-playbook/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/angry-conti-ransomware-affiliate-leaks-gangs-attack-playbook/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bccb8f82-60da-0fe2-fd2d-0000a66a1540","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bankinfosecurity.com/cybercrime-moves-conti-ransomware-absorbs-trickbot-malware-a-18573","pattern":"[url:value = 'https://www.bankinfosecurity.com/cybercrime-moves-conti-ransomware-absorbs-trickbot-malware-a-18573']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a2ce114-44e4-e0fc-93a3-00009ae4e066","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/ransomware-advisory-log4shell-exploitation-for-initial-access-lateral-movement","pattern":"[url:value = 'https://www.advintel.io/post/ransomware-advisory-log4shell-exploitation-for-initial-access-lateral-movement']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00aed514-06b9-876e-e42e-00002278f1b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/hydra-with-three-heads-blackbyte-the-future-of-ransomware-subsidiary-groups","pattern":"[url:value = 'https://www.advintel.io/post/hydra-with-three-heads-blackbyte-the-future-of-ransomware-subsidiary-groups']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d90d0167-2a01-d75a-0b50-0000de44d52e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape","pattern":"[url:value = 'https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62f85bc3-34bf-6b3d-22fc-00008db69364","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love","pattern":"[url:value = 'https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4afcef5d-3a68-3057-500d-0000fdffa913","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/24-hours-from-log4shell-to-local-admin-deep-dive-into-conti-gang-attack-on-fortune-500-dfir","pattern":"[url:value = 'https://www.advintel.io/post/24-hours-from-log4shell-to-local-admin-deep-dive-into-conti-gang-attack-on-fortune-500-dfir']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb8d9aee-2855-9997-13b4-00004fad25f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent","pattern":"[url:value = 'https://www.advanced-intel.com/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1519dc96-c60f-48cd-6afc-0000440ea32a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations","pattern":"[url:value = 'https://www.advanced-intel.com/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb15ea03-15dd-6034-573c-00003f7c04b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://us-cert.cisa.gov/ncas/alerts/aa21-265a","pattern":"[url:value = 'https://us-cert.cisa.gov/ncas/alerts/aa21-265a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33e35987-59f9-27cb-92f8-000042761d47","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/conti-ransomware-gang/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/conti-ransomware-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caf85efb-f69a-810d-a318-0000dab9d3a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eaa349b4-563b-ec3c-1f6f-000058451596","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/TheDFIRReport/status/1498642512935800833","pattern":"[url:value = 'https://twitter.com/TheDFIRReport/status/1498642512935800833']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a20575ca-19c9-7643-1fcc-00004a6c2fa6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/AltShiftPrtScn/status/1423188974298861571","pattern":"[url:value = 'https://twitter.com/AltShiftPrtScn/status/1423188974298861571']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff0af107-659a-8f91-8b3f-00001c4b6a36","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/AltShiftPrtScn/status/1417849181012647938","pattern":"[url:value = 'https://twitter.com/AltShiftPrtScn/status/1417849181012647938']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36337622-7750-b422-6d54-0000090a6870","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/AltShiftPrtScn/status/1350755169965924352","pattern":"[url:value = 'https://twitter.com/AltShiftPrtScn/status/1350755169965924352']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b74e6ccb-741a-69c9-abe5-000031a07484","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/conti-ransomware-v-3-including-decryptor-leaked/179006/","pattern":"[url:value = 'https://threatpost.com/conti-ransomware-v-3-including-decryptor-leaked/179006/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b2b5498-7cc1-5d9a-e1bb-0000751dcd9d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/conti-ransomware-decryptor-trickbot-source-code-leaked/178727/","pattern":"[url:value = 'https://threatpost.com/conti-ransomware-decryptor-trickbot-source-code-leaked/178727/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cacda527-827e-d28b-982a-0000ffd1e3a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/affiliate-leaks-conti-ransomware-playbook/168442/","pattern":"[url:value = 'https://threatpost.com/affiliate-leaks-conti-ransomware-playbook/168442/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04def207-4ea5-fbb6-57e1-0000b6d82fc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/disgruntled-ransomware-affiliate-leaks-the-conti-gangs-technical-manuals/","pattern":"[url:value = 'https://therecord.media/disgruntled-ransomware-affiliate-leaks-the-conti-gangs-technical-manuals/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e481e0b0-24e1-b5b3-1c4a-0000f5e9fb00","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/conti-leaks-the-panama-papers-of-ransomware/","pattern":"[url:value = 'https://therecord.media/conti-leaks-the-panama-papers-of-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b673188-1a2e-e652-c0fa-00000edbfc94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thehackernews.com/2022/05/malware-analysis-trickbot.html","pattern":"[url:value = 'https://thehackernews.com/2022/05/malware-analysis-trickbot.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7746503-9579-fa3c-07a3-0000b9d2d187","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/","pattern":"[url:value = 'https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cc7ea76-623b-ab66-8fe2-0000059b1d35","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/","pattern":"[url:value = 'https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c37294b6-f7fb-03aa-2b56-00009e8398c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/","pattern":"[url:value = 'https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--978565e1-a15f-22e4-4fc2-0000d90e17e3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/","pattern":"[url:value = 'https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e2dc185-29e8-a87d-420d-000084b626c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2021/05/12/conti-ransomware/","pattern":"[url:value = 'https://thedfirreport.com/2021/05/12/conti-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2521861-89ca-dc28-96b3-0000ba1d4cea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f83f891-7e98-e792-8ce2-0000a0732e19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b25fc11-a3b7-b484-25eb-00001a9ff604","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://share.vx-underground.org/Conti/","pattern":"[url:value = 'https://share.vx-underground.org/Conti/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e044570a-ab20-a3bc-9c7a-00007daa8e82","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force_Final_Report.pdf","pattern":"[url:value = 'https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force_Final_Report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d905e57-57b9-69c8-2096-000049b29e68","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityaffairs.co/wordpress/128190/cyber-crime/conti-ransomware-takes-over-trickbot.html","pattern":"[url:value = 'https://securityaffairs.co/wordpress/128190/cyber-crime/conti-ransomware-takes-over-trickbot.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9010ffdc-adb3-557c-bf7d-0000fe76647c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/luna-black-basta-ransomware/106950","pattern":"[url:value = 'https://securelist.com/luna-black-basta-ransomware/106950']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5795ed6-b009-dc55-f55f-00007093b5bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf","pattern":"[url:value = 'https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16f2c62b-a005-b2d3-0eac-00000e7d0f41","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://research.nccgroup.com/2022/04/29/adventures-in-the-land-of-bumblebee-a-new-malicious-loader/","pattern":"[url:value = 'https://research.nccgroup.com/2022/04/29/adventures-in-the-land-of-bumblebee-a-new-malicious-loader/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3815ede6-481f-fc09-184f-0000df1480ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://research.nccgroup.com/2022/03/31/conti-nuation-methods-and-techniques-observed-in-operations-post-the-leaks/","pattern":"[url:value = 'https://research.nccgroup.com/2022/03/31/conti-nuation-methods-and-techniques-observed-in-operations-post-the-leaks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c973639-f27f-c5f3-21c7-000038bb0c4f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://research.checkpoint.com/2022/leaks-of-conti-ransomware-group-paint-picture-of-a-surprisingly-normal-tech-start-up-sort-of/","pattern":"[url:value = 'https://research.checkpoint.com/2022/leaks-of-conti-ransomware-group-paint-picture-of-a-surprisingly-normal-tech-start-up-sort-of/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9ed673a-05e7-4e9f-8e1c-0000298d4684","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/?cmp=30728","pattern":"[url:value = 'https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/?cmp=30728']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b0eb7bc-8e2b-408e-a6d2-0000740e57a9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2022/02/22/cyberthreats-during-russian-ukrainian-tensions-what-can-we-learn-from-history-to-be-prepared/","pattern":"[url:value = 'https://news.sophos.com/en-us/2022/02/22/cyberthreats-during-russian-ukrainian-tensions-what-can-we-learn-from-history-to-be-prepared/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--923db7cd-f705-c1f1-e4eb-00009eed3441","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42188608-ba41-b7d5-e3fa-000084d0b3cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/02/16/what-to-expect-when-youve-been-hit-with-conti-ransomware/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/02/16/what-to-expect-when-youve-been-hit-with-conti-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9d93270-db29-fb3c-0e1e-0000b2f81306","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-evasive-by-nature/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/02/16/conti-ransomware-evasive-by-nature/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a02ce09-5981-32c6-4230-000040d0e5c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96c340ae-bd80-d675-5001-0000d584e95d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://nakedsecurity.sophos.com/2021/08/06/conti-ransomware-affiliate-goes-rogue-leaks-company-data/","pattern":"[url:value = 'https://nakedsecurity.sophos.com/2021/08/06/conti-ransomware-affiliate-goes-rogue-leaks-company-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--474e8e8f-c7f3-db71-a9f9-00002a7bc006","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/cycraft/the-road-to-ransomware-resilience-c1ca37036efd","pattern":"[url:value = 'https://medium.com/cycraft/the-road-to-ransomware-resilience-c1ca37036efd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--639c37b2-b9c6-a366-ebe0-00005b1210e8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/@whickey000/how-i-cracked-conti-ransomware-groups-leaked-source-code-zip-file-e15d54663a8","pattern":"[url:value = 'https://medium.com/@whickey000/how-i-cracked-conti-ransomware-groups-leaked-source-code-zip-file-e15d54663a8']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3118d7ec-4434-9d96-a525-0000899ba7d5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/@arnozobec/analyzing-conti-leaks-without-speaking-russian-only-methodology-f5aecc594d1b","pattern":"[url:value = 'https://medium.com/@arnozobec/analyzing-conti-leaks-without-speaking-russian-only-methodology-f5aecc594d1b']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17fe9a78-22d1-e242-acb4-00007f3fc1da","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://marcoramilli.com/2021/11/07/conti-ransomware-cheat-sheet/","pattern":"[url:value = 'https://marcoramilli.com/2021/11/07/conti-ransomware-cheat-sheet/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c1a58a9-eb49-2f69-0a67-0000addf0d1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lifars.com/wp-content/uploads/2021/10/ContiRansomware_Whitepaper.pdf","pattern":"[url:value = 'https://lifars.com/wp-content/uploads/2021/10/ContiRansomware_Whitepaper.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--954c9bb6-626a-4fb5-172f-0000d87a99f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/","pattern":"[url:value = 'https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6b3033f-feef-9a01-dad1-0000a2045640","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2021/10/conti-ransom-gang-starts-selling-access-to-victims/","pattern":"[url:value = 'https://krebsonsecurity.com/2021/10/conti-ransom-gang-starts-selling-access-to-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36a95ea7-a363-9d19-ab62-0000a37365eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/shipping-companies-ransomware-credentials","pattern":"[url:value = 'https://intel471.com/blog/shipping-companies-ransomware-credentials']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f77349af-073b-ab86-89f0-0000cee58bce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/conti-vs-monti-a-reinvention-or-just-a-simple-rebranding","pattern":"[url:value = 'https://intel471.com/blog/conti-vs-monti-a-reinvention-or-just-a-simple-rebranding']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11f77447-a2f4-b951-cb39-0000e92905b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/conti-leaks-cybercrime-fire-team","pattern":"[url:value = 'https://intel471.com/blog/conti-leaks-cybercrime-fire-team']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79d9bd5b-dd9c-13f7-9841-00003afb3e03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/conti-emotet-ransomware-conti-leaks","pattern":"[url:value = 'https://intel471.com/blog/conti-emotet-ransomware-conti-leaks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--043f790e-1648-e8d2-9851-0000b6738722","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/whichbuffer/Conti-Ransomware-IOC","pattern":"[url:value = 'https://github.com/whichbuffer/Conti-Ransomware-IOC']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ec9ed9d-ca9b-b8da-5f53-000008d59986","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/cdong1012/ContiUnpacker","pattern":"[url:value = 'https://github.com/cdong1012/ContiUnpacker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28007fa5-5dbb-3d86-3321-00008362bf34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/TheParmak/conti-leaks-englished","pattern":"[url:value = 'https://github.com/TheParmak/conti-leaks-englished']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e139058a-1852-8c10-4b2c-00003aa6a754","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/","pattern":"[url:value = 'https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a187b70d-9a12-bf53-a0de-000024f6f8a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cyware.com/news/ransomware-becomes-deadlier-conti-makes-the-most-money-39e17bae/","pattern":"[url:value = 'https://cyware.com/news/ransomware-becomes-deadlier-conti-makes-the-most-money-39e17bae/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8a503e6-7cb7-36ef-8b3b-0000d488edf0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-soc-powershell-proxyshell-conti-ttps-oh-my","pattern":"[url:value = 'https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-soc-powershell-proxyshell-conti-ttps-oh-my']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c04fe5a-6e4b-b260-1bc8-0000180fe6de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://content.secureworks.com/-/media/Files/US/Reports/Monthly%20Threat%20Intelligence/Secureworks_ECO1_ThreatIntelligenceExecutiveReport2022Vol2.ashx","pattern":"[url:value = 'https://content.secureworks.com/-/media/Files/US/Reports/Monthly%20Threat%20Intelligence/Secureworks_ECO1_ThreatIntelligenceExecutiveReport2022Vol2.ashx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc9c5085-6064-4812-b1dd-0000508a1e42","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cocomelonc.github.io/tutorial/2022/04/02/malware-injection-18.html","pattern":"[url:value = 'https://cocomelonc.github.io/tutorial/2022/04/02/malware-injection-18.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb05078f-60a3-3cd8-3b9e-000021347b90","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cocomelonc.github.io/investigation/2022/04/11/malw-inv-conti-2.html","pattern":"[url:value = 'https://cocomelonc.github.io/investigation/2022/04/11/malw-inv-conti-2.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2086d555-f38e-aee7-63b4-00006695be9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cocomelonc.github.io/investigation/2022/03/27/malw-inv-conti-1.html","pattern":"[url:value = 'https://cocomelonc.github.io/investigation/2022/03/27/malw-inv-conti-1.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39935a99-d85b-c2c1-5bd6-00002fe6b1c8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cluster25.io/2022/03/02/contis-source-code-deep-dive-into/","pattern":"[url:value = 'https://cluster25.io/2022/03/02/contis-source-code-deep-dive-into/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b60f4d79-9a50-0aa8-7093-00007a3e3a1e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.vmware.com/security/2022/09/threat-report-illuminating-volume-shadow-deletion.html","pattern":"[url:value = 'https://blogs.vmware.com/security/2022/09/threat-report-illuminating-volume-shadow-deletion.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8cd0464-c8d7-3218-f210-00003a115db3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2022/09/the-curious-case-of-monti-ransomware-a-real-world-doppelganger","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/09/the-curious-case-of-monti-ransomware-a-real-world-doppelganger']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--812e5ab1-2beb-f3d4-a759-0000ac686919","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/2022/05/conti-and-hive-ransomware-operations.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2022/05/conti-and-hive-ransomware-operations.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b0b7066-081b-2eaf-7a12-000000c15239","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/2021/09/Conti-leak-translation.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2021/09/Conti-leak-translation.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--118ff87b-94fc-9642-df75-00000db0370a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.reversinglabs.com/blog/conversinglabs-ep-2-conti-pivots-as-ransomware-as-a-service-struggles","pattern":"[url:value = 'https://blog.reversinglabs.com/blog/conversinglabs-ep-2-conti-pivots-as-ransomware-as-a-service-struggles']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08ebfd43-6b25-b347-e0c9-00001060d23f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.qualys.com/vulnerabilities-threat-research/2021/11/18/conti-ransomware","pattern":"[url:value = 'https://blog.qualys.com/vulnerabilities-threat-research/2021/11/18/conti-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c96bf9e-07fe-4372-945a-000079ca546e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html","pattern":"[url:value = 'https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e41603d-e5e8-3b18-0f82-0000bce329b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/","pattern":"[url:value = 'https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d064b31-f69c-8190-1f4a-00002b31f9df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://assets.sentinelone.com/ransomware-enterprise/conti-ransomware-unpacked","pattern":"[url:value = 'https://assets.sentinelone.com/ransomware-enterprise/conti-ransomware-unpacked']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46577a52-3838-d1be-f798-0000bb91ea1d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://areteir.com/wp-content/uploads/2020/08/Arete_Insight_Is-Conti-the-new-Ryuk_August2020.pdf","pattern":"[url:value = 'https://areteir.com/wp-content/uploads/2020/08/Arete_Insight_Is-Conti-the-new-Ryuk_August2020.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b579368f-9eef-b215-91c5-0000beda414b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://arcticwolf.com/resources/blog/karakurt-web","pattern":"[url:value = 'https://arcticwolf.com/resources/blog/karakurt-web']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c45cee79-7112-6f3e-b90a-00000d76d508","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed","pattern":"[url:value = 'https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ec66b43-a122-be16-f2ee-000072a4a390","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74","pattern":"[url:value = 'https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e90b0483-6806-50a2-8130-0000e4bbfc12","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/","pattern":"[url:value = 'http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d831f08-edfd-73b5-9560-0000438ec86f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=cYx7sQRbjGA","pattern":"[url:value = 'https://www.youtube.com/watch?v=cYx7sQRbjGA']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ece17b44-4160-d1c9-b7a5-00009823128d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-group-targets-esxi-hypervisors-with-its-linux-variant.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-group-targets-esxi-hypervisors-with-its-linux-variant.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df4ce4da-89c9-9e4e-ffd1-00003110cec4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again","pattern":"[url:value = 'https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa9163d8-d4be-ba68-794f-0000be34ba3a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/blog/gold-ulrick-continues-conti-operations-despite-public-disclosures","pattern":"[url:value = 'https://www.secureworks.com/blog/gold-ulrick-continues-conti-operations-despite-public-disclosures']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37d7a76f-b852-1562-c4af-00004e0ca4dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.esentire.com/blog/analysis-of-leaked-conti-intrusion-procedures-by-esentires-threat-response-unit-tru","pattern":"[url:value = 'https://www.esentire.com/blog/analysis-of-leaked-conti-intrusion-procedures-by-esentires-threat-response-unit-tru']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0913736c-5d7c-d8da-8cf7-000035171c08","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022","pattern":"[url:value = 'https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d59db533-abce-e35c-a1c3-0000c557abb6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike","pattern":"[url:value = 'https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef2e1264-3143-893a-430f-00001f8a5ba1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/conti-ransomware-gang","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/conti-ransomware-gang']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--780dddf8-9bf1-8f1e-4f6a-00000586a051","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/affiliate-leaks-conti-ransomware-playbook/168442","pattern":"[url:value = 'https://threatpost.com/affiliate-leaks-conti-ransomware-playbook/168442']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7031010c-1407-3e28-2cef-0000b5a98dc1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-virtual-machines","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-virtual-machines']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0be7b123-08e9-ab7c-066c-00000dcd553e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf?1651576098","pattern":"[url:value = 'https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf?1651576098']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03be9634-8735-74c8-eb71-0000dcd6bbf6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyber.gov.au/acsc/view-all-content/advisories/2021-010-acsc-ransomware-profile-conti","pattern":"[url:value = 'https://www.cyber.gov.au/acsc/view-all-content/advisories/2021-010-acsc-ransomware-profile-conti']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f71739c-9523-1f0b-72c5-0000236f6fca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://contirecovery.top","pattern":"[url:value = 'https://contirecovery.top']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f742ae2-1b8d-5132-7fb8-000066133842","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://contirecovery.best","pattern":"[url:value = 'https://contirecovery.best']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31530fe4-8500-bc7d-b151-00002f672162","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion","pattern":"[url:value = 'http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de85a7ba-db2d-1317-d6f0-0000402b6337","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/","pattern":"[url:value = 'http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--632d1a32-b7b8-c4c9-d468-0000266bd29d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/","pattern":"[url:value = 'http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82af351b-cc66-bf57-5546-0000005d7572","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion/","pattern":"[url:value = 'http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b255580-8836-55ee-b01e-0000998b2333","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://howtofix.guide/ransom-mountlocket/","pattern":"[url:value = 'https://howtofix.guide/ransom-mountlocket/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a26ee1c3-d0a5-008d-ab68-00008af0e3e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.vmware.com/security/2020/12/phorpiex-powered-bitransomware-targets-apac-universities.html","pattern":"[url:value = 'https://blogs.vmware.com/security/2020/12/phorpiex-powered-bitransomware-targets-apac-universities.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d1abf18-ae02-bdfe-2635-0000787cfc56","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/bitransomware","pattern":"[url:value = 'https://www.ransomlook.io/group/bitransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52ae9bac-ae5e-97f1-86da-000087cf3cc6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion/","pattern":"[url:value = 'http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9dd4f2d-3260-e409-69d5-00004b606d67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/exorcist","pattern":"[url:value = 'https://www.ransomlook.io/group/exorcist']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e5ef0c0-09e4-0de8-6602-0000fdb64efe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/@velasco.l.n/exorcist-ransomware-from-triaging-to-deep-dive-5b7da4263d81","pattern":"[url:value = 'https://medium.com/@velasco.l.n/exorcist-ransomware-from-triaging-to-deep-dive-5b7da4263d81']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ce0ec1c-8ca0-9701-84e6-0000b38b41be","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/zeppelin","pattern":"[url:value = 'https://www.ransomlook.io/group/zeppelin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f1b3393-327c-02b5-db49-0000752def84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/zeoticus","pattern":"[url:value = 'https://www.ransomlook.io/group/zeoticus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ca1b4b2-d376-515f-7134-000013d4971e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/vegalocker","pattern":"[url:value = 'https://www.ransomlook.io/group/vegalocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6c87a7d-b6f2-34eb-3472-0000e83065e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/thundercrypt","pattern":"[url:value = 'https://www.ransomlook.io/group/thundercrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e8bd5d7-54e4-9dd5-1e0f-0000fa950df7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/thor","pattern":"[url:value = 'https://www.ransomlook.io/group/thor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fceb70c-601c-b5a3-54be-00002a346b3d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://g6gwcbiylnvrzj6txsypi72weymzdg6oov2qycu36ggfx3narejcqcid.onion/HNDPXubuzAllW18lBXjT6HU3QnyCtlClvWD8dfcnU6ZUa","pattern":"[url:value = 'http://g6gwcbiylnvrzj6txsypi72weymzdg6oov2qycu36ggfx3narejcqcid.onion/HNDPXubuzAllW18lBXjT6HU3QnyCtlClvWD8dfcnU6ZUa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c885e03-18ef-be78-6b5b-0000316b8023","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/sphinx","pattern":"[url:value = 'https://www.ransomlook.io/group/sphinx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dde6fb31-0564-a4ee-d32d-00006ffeb5ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://decrypt5bub45vpr.onion","pattern":"[url:value = 'http://decrypt5bub45vpr.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0abc4947-306d-8e68-be84-000062cfd50a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/spectre","pattern":"[url:value = 'https://www.ransomlook.io/group/spectre']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02b76660-fb96-f765-fc08-0000da036482","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/snatch","pattern":"[url:value = 'https://www.ransomlook.io/group/snatch']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bb5e75e-7a7d-0887-e45c-000038606437","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/financial-motivation-drives-golang-malware-adoption/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/financial-motivation-drives-golang-malware-adoption/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3afbe3d1-b83e-6a3c-ab01-000027019128","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/snatch-ransomware-reboots-to-windows-safe-mode-to-bypass-av-tools/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/snatch-ransomware-reboots-to-windows-safe-mode-to-bypass-av-tools/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0af5a8f1-7a19-0316-0c63-0000eb796c31","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/VK_Intel/status/1191414501297528832","pattern":"[url:value = 'https://twitter.com/VK_Intel/status/1191414501297528832']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca64ec65-40fd-3e96-b760-0000027e550e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf","pattern":"[url:value = 'https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8100d5fe-19f8-404d-e6ca-0000b7632aaf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2020/06/21/snatch-ransomware/","pattern":"[url:value = 'https://thedfirreport.com/2020/06/21/snatch-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ee3bebf-cb09-c1ac-1b91-00007931cc59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/a-brief-history-of-ta505","pattern":"[url:value = 'https://intel471.com/blog/a-brief-history-of-ta505']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3860ad35-0e3b-d32b-d8bb-000080cdc111","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/albertzsigovits/malware-notes/blob/master/Snatch.md","pattern":"[url:value = 'https://github.com/albertzsigovits/malware-notes/blob/master/Snatch.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cbe6b79-f052-c496-0ca9-000005863a0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/","pattern":"[url:value = 'https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64534b2f-faee-27a7-771c-00002688d297","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://t.me/snatch_news","pattern":"[url:value = 'https://t.me/snatch_news']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70b75518-f059-4850-7dac-0000748a3828","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mydatassuperhero.com/","pattern":"[url:value = 'http://mydatassuperhero.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1dbe2a3-ac68-eebd-5002-000052013c54","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://snatch24uldhpwrm.onion/","pattern":"[url:value = 'http://snatch24uldhpwrm.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f0e458c-bbf0-2c25-a171-000076ef3162","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://snatchwezarcr27t.onion/","pattern":"[url:value = 'http://snatchwezarcr27t.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--437ec26d-d040-b590-e940-0000fa08f469","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://snatch6brk4nfczg.onion/","pattern":"[url:value = 'http://snatch6brk4nfczg.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5e4a36e-4695-4ce7-b74e-000094726a1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://snatchh5ssxiorrn.onion/","pattern":"[url:value = 'http://snatchh5ssxiorrn.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca2c8a68-fc02-a2d0-335d-00004106c3de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://snatch2q72f2wjff.onion/","pattern":"[url:value = 'http://snatch2q72f2wjff.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da05f9b6-bff8-4be8-2dfe-000080b169ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://snatch6rpvi7yy4t.onion/","pattern":"[url:value = 'http://snatch6rpvi7yy4t.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6194837-3b21-7c38-2d2c-00008999dbd0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://snatchnews.top/","pattern":"[url:value = 'https://snatchnews.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0fbca8b-3680-3f31-35a3-0000026ca57f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://snatchteam.cc","pattern":"[url:value = 'https://snatchteam.cc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--877d88ee-7ac2-2333-a27f-00008ae4a741","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://snatch.press/","pattern":"[url:value = 'https://snatch.press/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfabac6f-a58b-f1cf-e667-0000f7633d1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: SEND.ID.TO","pattern":"[domain-name:value = 'SEND.ID.TO']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c05db8a0-0cdf-1e7f-6001-000014c811f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/prolock","pattern":"[url:value = 'https://www.ransomlook.io/group/prolock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28caa6db-8cad-7cd5-0774-0000f646af96","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/fbi-prolock-ransomware-gains-access-to-victim-networks-via-qakbot-infections/","pattern":"[url:value = 'https://www.zdnet.com/article/fbi-prolock-ransomware-gains-access-to-victim-networks-via-qakbot-infections/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62611cbe-3519-aa1f-d9fe-0000e7749a45","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.it-klinika.rs/blog/paznja-novi-opasni-ransomware-pwndlocker-i-u-srbiji","pattern":"[url:value = 'https://www.it-klinika.rs/blog/paznja-novi-opasni-ransomware-pwndlocker-i-u-srbiji']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2573bb8-cceb-2c20-0275-0000f686c1cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intrinsec.com/egregor-prolock/","pattern":"[url:value = 'https://www.intrinsec.com/egregor-prolock/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--358a8e69-cdff-eaa8-0ff3-00001b1d6acf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hornetsecurity.com/en/threat-research/qakbot-reducing-its-on-disk-artifacts/","pattern":"[url:value = 'https://www.hornetsecurity.com/en/threat-research/qakbot-reducing-its-on-disk-artifacts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eabc41c7-dcca-72e4-52db-00004b234462","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hornetsecurity.com/en/security-information/qakbot-malspam-leading-to-prolock/","pattern":"[url:value = 'https://www.hornetsecurity.com/en/security-information/qakbot-malspam-leading-to-prolock/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfe8794c-d8aa-6813-aeb2-0000ddda9930","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.group-ib.com/blog/prolock_evolution","pattern":"[url:value = 'https://www.group-ib.com/blog/prolock_evolution']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02ff8f94-3782-986e-36c6-00009f753e89","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.group-ib.com/blog/prolock","pattern":"[url:value = 'https://www.group-ib.com/blog/prolock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--476768c2-001f-279d-28da-000018af1293","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert-pa.it/notizie/pwndlocker-si-rinnova-in-prolock-ransomware/","pattern":"[url:value = 'https://www.cert-pa.it/notizie/pwndlocker-si-rinnova-in-prolock-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88665fff-d103-116a-585d-0000d31cf43d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99fb36bd-e366-d7b8-7fb5-00009a839295","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-pwndlocker-ransomware-targeting-us-cities-enterprises/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-pwndlocker-ransomware-targeting-us-cities-enterprises/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0246c2aa-58c0-8beb-6dfb-000046eacc73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://soolidsnake.github.io/2020/05/11/Prolock_ransomware.html","pattern":"[url:value = 'https://soolidsnake.github.io/2020/05/11/Prolock_ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d323af57-fec5-6bae-8ea3-0000167dac1c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://raw.githubusercontent.com/fboldewin/When-ransomware-hits-an-ATM-giant---The-Diebold-Nixdorf-case-dissected/main/When%20ransomware%20hits%20an%20ATM%20giant%20-%20The%20Diebold%20Nixdorf%20case%20dissected%20-%20Group-IB%20CyberCrimeCon2020.pdf","pattern":"[url:value = 'https://raw.githubusercontent.com/fboldewin/When-ransomware-hits-an-ATM-giant---The-Diebold-Nixdorf-case-dissected/main/When%20ransomware%20hits%20an%20ATM%20giant%20-%20The%20Diebold%20Nixdorf%20case%20dissected%20-%20Group-IB%20CyberCrimeCon2020.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d153558c-88ef-aeb1-20b1-000029f70ec4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://norfolkinfosec.com/tinypos-and-prolocker-an-odd-relationship/","pattern":"[url:value = 'https://norfolkinfosec.com/tinypos-and-prolocker-an-odd-relationship/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6d4677d-b371-00ef-6674-0000035d55e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/07/27/prolock-ransomware-gives-you-the-first-8-kilobytes-of-decryption-for-free/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/07/27/prolock-ransomware-gives-you-the-first-8-kilobytes-of-decryption-for-free/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99ebc426-7cf5-d9b0-858b-000050f856df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2019/10/pwndlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2019/10/pwndlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c26b0cb5-9e3b-fd62-1eb4-000041368e4b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/nefilim","pattern":"[url:value = 'https://www.ransomlook.io/group/nefilim']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--404171c2-ffbd-66b9-8e37-000051a23e71","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/nefilim-ransomware-threatens-to-expose-stolen-data","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/nefilim-ransomware-threatens-to-expose-stolen-data']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--996b431d-5bc4-5531-fadc-0000e1bcd102","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/f/nefilim-modern-ransomware-attack-story.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/f/nefilim-modern-ransomware-attack-story.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b34202a-ef8c-67f6-657c-0000759c56b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/b/nefilim-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/b/nefilim-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17e20767-c7d4-e8e6-3856-0000b8ab8d8f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.picussecurity.com/resource/blog/how-to-beat-nefilim-ransomware-attacks","pattern":"[url:value = 'https://www.picussecurity.com/resource/blog/how-to-beat-nefilim-ransomware-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b711acb2-3d66-e475-f0d9-00005aaebc70","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf","pattern":"[url:value = 'https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a882e506-47ee-e050-0d25-0000d044dc11","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.govt.nz/it-specialists/advisories/active-ransomware-campaign-leveraging-remote-access-technologies/","pattern":"[url:value = 'https://www.cert.govt.nz/it-specialists/advisories/active-ransomware-campaign-leveraging-remote-access-technologies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b466b879-b4ab-e426-c857-0000279bf618","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb961db2-739e-ca3f-d5f0-0000d4ac3506","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/home-appliance-giant-whirlpool-hit-in-nefilim-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/home-appliance-giant-whirlpool-hit-in-nefilim-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb0e5781-906b-e326-f305-000006c3d266","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f67be3d-fb06-1433-7c3c-00007155443f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/how-cybercriminals-create-turbulence-for-the-transportation-industry","pattern":"[url:value = 'https://intel471.com/blog/how-cybercriminals-create-turbulence-for-the-transportation-industry']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d32b330-a1ee-3334-7b66-0000d7220c98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2020/03/nefilim-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2020/03/nefilim-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14632fce-61ff-28d8-f407-0000a9e0f67f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://documents.trendmicro.com/assets/white_papers/wp-modern-ransomwares-double-extortion-tactics.pdf","pattern":"[url:value = 'https://documents.trendmicro.com/assets/white_papers/wp-modern-ransomwares-double-extortion-tactics.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47e8ab19-8182-5d4c-07dc-000004a3d27e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.qualys.com/vulnerabilities-research/2021/05/12/nefilim-ransomware","pattern":"[url:value = 'https://blog.qualys.com/vulnerabilities-research/2021/05/12/nefilim-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73aa4b30-2081-6d28-1bf1-0000f5937c75","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_nz/research/21/f/nefilim-modern-ransomware-attack-story.html","pattern":"[url:value = 'https://www.trendmicro.com/en_nz/research/21/f/nefilim-modern-ransomware-attack-story.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6fdf2a2-f36a-d4ef-d58a-0000cb0cc1e8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/a-deep-dive-into-nefilim-a-double-extortion-ransomware-group","pattern":"[url:value = 'https://www.zdnet.com/article/a-deep-dive-into-nefilim-a-double-extortion-ransomware-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--104bfd87-ce10-4e24-ffe5-0000448bd2cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Mr.Locker","pattern":"[domain-name:value = 'Mr.Locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0145435b-a7e0-d156-36d9-0000497d2d27","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/uscert/sites/default/files/publications/AA22-181A_stopransomware_medusalocker.pdf","pattern":"[url:value = 'https://www.cisa.gov/uscert/sites/default/files/publications/AA22-181A_stopransomware_medusalocker.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d8c760f-fb0a-df9a-ee33-0000624113f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/uscert/ncas/alerts/aa22-181a","pattern":"[url:value = 'https://www.cisa.gov/uscert/ncas/alerts/aa22-181a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9446bb4b-6a53-2af9-3688-0000e144ca6c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: data.html.marlock","pattern":"[domain-name:value = 'data.html.marlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21d77035-3efb-7453-09e0-0000e15e5c75","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion","pattern":"[url:value = 'http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3536d74-9421-6ac5-1520-000085bf9045","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion/","pattern":"[url:value = 'http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c809849-8bf2-347f-1dfe-000077d8ded1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: jpz.nz","pattern":"[domain-name:value = 'jpz.nz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4345dc6-b595-ded3-527d-00006d1f5c22","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: IT.Books","pattern":"[domain-name:value = 'IT.Books']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76a3b134-539b-ae20-5669-00006515653f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/inpivx","pattern":"[url:value = 'https://www.ransomlook.io/group/inpivx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2695dd7-95db-b561-b185-000047cb9c2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/hades","pattern":"[url:value = 'https://www.ransomlook.io/group/hades']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74aaa447-0070-ffbb-d379-00007dcbed84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/blog/hades-ransomware-operators-use-distinctive-tactics-and-infrastructure","pattern":"[url:value = 'https://www.secureworks.com/blog/hades-ransomware-operators-use-distinctive-tactics-and-infrastructure']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2657dfd4-dbb6-e861-1fd9-00008d59c5e3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/evil-corp-switches-to-hades-ransomware-to-evade-sanctions/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/evil-corp-switches-to-hades-ransomware-to-evade-sanctions/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b531335-adfc-38d5-e42f-0000455b2332","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.accenture.com/us-en/blogs/security/ransomware-hades","pattern":"[url:value = 'https://www.accenture.com/us-en/blogs/security/ransomware-hades']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcd54e87-d387-183b-e921-0000884f0cc7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.accenture.com/us-en/blogs/cyber-defense/unknown-threat-group-using-hades-ransomware","pattern":"[url:value = 'https://www.accenture.com/us-en/blogs/cyber-defense/unknown-threat-group-using-hades-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44907130-e504-a59a-d30b-000016367b89","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/inversecos/status/1381477874046169089?s=20","pattern":"[url:value = 'https://twitter.com/inversecos/status/1381477874046169089?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b42b322-b132-5866-66a0-000098850afc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.truesec.com/2021/05/05/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies/","pattern":"[url:value = 'https://blog.truesec.com/2021/05/05/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e34b0566-2f5a-1b60-0c60-000024559e82","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://awakesecurity.com/blog/incident-response-hades-ransomware-gang-or-hafnium/","pattern":"[url:value = 'https://awakesecurity.com/blog/incident-response-hades-ransomware-gang-or-hafnium/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6de7987d-67ad-4d10-988d-00002fa9c909","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://m6s6axasulxjkhzh.onion/","pattern":"[url:value = 'http://m6s6axasulxjkhzh.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e40c536d-1b52-b164-8d0a-00002c595f85","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/evolution","pattern":"[url:value = 'https://www.ransomlook.io/group/evolution']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdb6ef5f-a124-c73c-3641-00006872d504","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/removal-guides/16697-deathransom-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/16697-deathransom-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7af317fa-2eb2-34d0-a4e4-00006d1294e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/deathransom-ransomware-now-encrypting-victims-data/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/deathransom-ransomware-now-encrypting-victims-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4eae9429-357b-3ea0-a129-0000e7a9f97e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/a/deathransom-now-fully-operational-with-file-encryption-capabilities.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/a/deathransom-now-fully-operational-with-file-encryption-capabilities.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94679f69-58d0-9d37-f4ca-0000967fd7bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/deathransom","pattern":"[url:value = 'https://www.ransomlook.io/group/deathransom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e28fb9f7-7686-c9a9-11ac-00000cfdab59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/datakeeper","pattern":"[url:value = 'https://www.ransomlook.io/group/datakeeper']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8e1bb80-a3ea-2099-9488-0000c57ffb1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dc4nwiijwiffwztwzj5fngmcoppedrxg4jqj2tq67ontbini6qmlguid.onion/","pattern":"[url:value = 'http://dc4nwiijwiffwztwzj5fngmcoppedrxg4jqj2tq67ontbini6qmlguid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b45452c9-6186-145a-7a03-00008e8342ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/blackout","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/blackout']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b060d270-936b-f3da-3442-00005e3beb8b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/blackout","pattern":"[url:value = 'https://www.ransomlook.io/group/blackout']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cac1379-6c4a-511c-cce5-000011d9b82c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://idep6vd7ywl7uruhsutqjdnjawe33hct35523rrmf73kb46xrhfb5sid.onion/","pattern":"[url:value = 'http://idep6vd7ywl7uruhsutqjdnjawe33hct35523rrmf73kb46xrhfb5sid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d41e6b7d-c855-552a-4898-0000d4593176","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rqqn25k3hgmfkh7ykjbmakjgidwweomr7cbpy6pfecpxs57r5iwzwtyd.onion","pattern":"[url:value = 'http://rqqn25k3hgmfkh7ykjbmakjgidwweomr7cbpy6pfecpxs57r5iwzwtyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--452bbf31-6cb1-3b90-5c5f-00001e3e817b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2cyxmof76rxeqze5snxxooqmhzjtcploqswxoxmenfayphumdhrtrzqd.onion","pattern":"[url:value = 'http://2cyxmof76rxeqze5snxxooqmhzjtcploqswxoxmenfayphumdhrtrzqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--636cd9a2-46eb-4f7e-9c22-00003a749fe6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eleav2eq3ioyiuevbyvqaz3vruwvpislphszo4cm7n56itbpnupxngyd.onion","pattern":"[url:value = 'http://eleav2eq3ioyiuevbyvqaz3vruwvpislphszo4cm7n56itbpnupxngyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37a2bfb4-a211-e6f2-3e72-00006da463e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mu6se7h7qfwuqclr4cc6zy7qevod6gyk37aq5vwnayrtbx3qqycx2fyd.onion","pattern":"[url:value = 'http://mu6se7h7qfwuqclr4cc6zy7qevod6gyk37aq5vwnayrtbx3qqycx2fyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d14d0cb1-0854-0d5d-7ae2-00009432a379","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://urey23jtg6z7xx3tiybmc4sgcim7dawiz2abl6crpup2lfobf7yb5wyd.onion","pattern":"[url:value = 'http://urey23jtg6z7xx3tiybmc4sgcim7dawiz2abl6crpup2lfobf7yb5wyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d4650ea-39ef-5b64-cafe-00007507a934","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ao5oo2luy6avdfomyw7hcegmfl4let2g5bzjqjzch6b5rpdshmuvccad.onion","pattern":"[url:value = 'http://ao5oo2luy6avdfomyw7hcegmfl4let2g5bzjqjzch6b5rpdshmuvccad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5641cc2-a7b8-f15a-6a68-0000caf5ff59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://urey23jtg6z7xx3tiybmc4sgcim7dawiz2abl6crpup2lfobf7yb5wyd.onion/","pattern":"[url:value = 'http://urey23jtg6z7xx3tiybmc4sgcim7dawiz2abl6crpup2lfobf7yb5wyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5e807fe-1a53-3c32-25d4-0000aabce74c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mu6se7h7qfwuqclr4cc6zy7qevod6gyk37aq5vwnayrtbx3qqycx2fyd.onion/","pattern":"[url:value = 'http://mu6se7h7qfwuqclr4cc6zy7qevod6gyk37aq5vwnayrtbx3qqycx2fyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57b3c13e-de41-a45d-6588-00005a0a895a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rqqn25k3hgmfkh7ykjbmakjgidwweomr7cbpy6pfecpxs57r5iwzwtyd.onion/","pattern":"[url:value = 'http://rqqn25k3hgmfkh7ykjbmakjgidwweomr7cbpy6pfecpxs57r5iwzwtyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2848f951-317d-e314-2eea-000024719257","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2cyxmof76rxeqze5snxxooqmhzjtcploqswxoxmenfayphumdhrtrzqd.onion/","pattern":"[url:value = 'http://2cyxmof76rxeqze5snxxooqmhzjtcploqswxoxmenfayphumdhrtrzqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41687cc9-4165-e781-d58b-0000aaeb37b0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://eleav2eq3ioyiuevbyvqaz3vruwvpislphszo4cm7n56itbpnupxngyd.onion/","pattern":"[url:value = 'http://eleav2eq3ioyiuevbyvqaz3vruwvpislphszo4cm7n56itbpnupxngyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f87e1320-54fc-1aa7-3b9b-00001a691e1f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://4qyjonpyksc52bc3fsgfgedssqgo4a6vlfsjknqnkncbyl4layqkqjid.onion/","pattern":"[url:value = 'http://4qyjonpyksc52bc3fsgfgedssqgo4a6vlfsjknqnkncbyl4layqkqjid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f74e9b7-9210-257e-3a8d-0000ecb35094","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/antefrigus","pattern":"[url:value = 'https://www.ransomlook.io/group/antefrigus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f738c274-7e95-d97d-6380-000076408887","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://yboa7nidpv5jdtumgfm4fmmvju3ccxlleut2xvzgn5uqlbjd5n7p3kid.onion/","pattern":"[url:value = 'http://yboa7nidpv5jdtumgfm4fmmvju3ccxlleut2xvzgn5uqlbjd5n7p3kid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f103a33-ef53-4310-3343-0000ea45d0f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.emsisoft.com/en/ransomware-decryption/amnesia2/","pattern":"[url:value = 'https://www.emsisoft.com/en/ransomware-decryption/amnesia2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1fd7e0a-f38c-d98e-fcb2-00008b511a40","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sonicwall.com/blog/amnesia-ransomware-continues-high-payment-trend-july-21-2017","pattern":"[url:value = 'https://www.sonicwall.com/blog/amnesia-ransomware-continues-high-payment-trend-july-21-2017']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6db7d786-ef19-e7db-65d1-00008ab25706","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://elastio.com/detectable-ransomware/amnesia-2/","pattern":"[url:value = 'https://elastio.com/detectable-ransomware/amnesia-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74124bd3-297d-9e63-2845-00009b8d2935","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://elastio.com/amnesia/","pattern":"[url:value = 'https://elastio.com/amnesia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc1aa22e-cdb2-98fa-8e36-0000a7f609e9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/amnesia","pattern":"[url:value = 'https://www.ransomlook.io/group/amnesia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d52df94-683b-33e5-690a-00008da9bcc7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/sekhmet","pattern":"[url:value = 'https://www.ransomlook.io/group/sekhmet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a4c09f7-1506-bdf7-2492-0000ea559633","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/detections/ransom-sekhmet/","pattern":"[url:value = 'https://blog.malwarebytes.com/detections/ransom-sekhmet/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c840de8a-db3f-9462-2bbb-000071b37231","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/as-maze-ransomware-group-retires-clients-turn-to-sekhmet-ransomware-spin-off-egregor/","pattern":"[url:value = 'https://www.zdnet.com/article/as-maze-ransomware-group-retires-clients-turn-to-sekhmet-ransomware-spin-off-egregor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bda3fe2-5716-e1aa-5524-000060c8500d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/wp-content/uploads/2020/11/Sekhmet_ransom_note.png","pattern":"[url:value = 'https://blog.malwarebytes.com/wp-content/uploads/2020/11/Sekhmet_ransom_note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0f06c9b-dc5f-edac-8214-000071c5c4a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rlmuybcg5h5gaatr.onion/","pattern":"[url:value = 'http://rlmuybcg5h5gaatr.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b8dcb45-1d31-fc38-8291-00003920fbb6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sekhmetleaks.top/","pattern":"[url:value = 'http://sekhmetleaks.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56bd3165-ae28-7ddf-5cec-0000e4f8d591","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Ransom.Sekhmet","pattern":"[domain-name:value = 'Ransom.Sekhmet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e8796c6-50f7-a709-f484-00003593947d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ragnarlocker","pattern":"[url:value = 'https://www.ransomlook.io/group/ragnarlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8af201c3-9d6b-8761-6be2-00002d37cf4c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/capcom-quietly-discloses-cyberattack-impacting-email-file-servers/","pattern":"[url:value = 'https://www.zdnet.com/article/capcom-quietly-discloses-cyberattack-impacting-email-file-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--841fddb2-4dbc-de54-26ff-00008b32d9f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.waterisac.org/system/files/articles/FLASH-MU-000140-MW.pdf","pattern":"[url:value = 'https://www.waterisac.org/system/files/articles/FLASH-MU-000140-MW.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa0abfa9-186c-7065-c918-0000a1577882","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.theregister.com/2022/03/09/fbi_says_ragnar_locker_ransomware/","pattern":"[url:value = 'https://www.theregister.com/2022/03/09/fbi_says_ragnar_locker_ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf505102-2727-31a5-5b72-00003f39ac9e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ragnarlocker-ransomware-threatens-to-release-confidential-information","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ragnarlocker-ransomware-threatens-to-release-confidential-information']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e65350a-213d-0b47-a7fd-000066089757","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2022/220307.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2022/220307.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--067a6ccf-7f4a-1b01-98dc-0000171d285c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.capcom.co.jp/ir/english/news/pdf/e210413.pdf","pattern":"[url:value = 'https://www.capcom.co.jp/ir/english/news/pdf/e210413.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21b61f58-151e-25ae-4dde-0000798122a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ragnarlocker-ransomware-hits-edp-energy-giant-asks-for-10m/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ragnarlocker-ransomware-hits-edp-energy-giant-asks-for-10m/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2b419c8-2fda-75db-c873-00003cc65c69","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/japanese-game-dev-capcom-hit-by-cyberattack-business-impacted/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/japanese-game-dev-capcom-hit-by-cyberattack-business-impacted/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--730e50e9-bcd7-8e39-4f4e-00000f46dea1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fbi-ransomware-gang-breached-52-us-critical-infrastructure-orgs/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fbi-ransomware-gang-breached-52-us-critical-infrastructure-orgs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--265c522c-30c7-f224-c3c8-00002f71d805","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/capcom-hit-by-ragnar-locker-ransomware-1tb-allegedly-stolen/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/capcom-hit-by-ragnar-locker-ransomware-1tb-allegedly-stolen/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecc721f5-2f5f-a7cc-ed16-0000cee6b689","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.acronis.com/en-sg/articles/ragnar-locker/","pattern":"[url:value = 'https://www.acronis.com/en-sg/articles/ragnar-locker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cc0f7e8-b07c-600f-0399-0000931e7140","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/AltShiftPrtScn/status/1403707430765273095","pattern":"[url:value = 'https://twitter.com/AltShiftPrtScn/status/1403707430765273095']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab6ae86a-5a05-11d2-b614-00008af6fa51","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://seguranca-informatica.pt/ragnar-locker-malware-analysis/","pattern":"[url:value = 'https://seguranca-informatica.pt/ragnar-locker-malware-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c5f28dc-5d44-7714-466c-0000d66c6b39","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/02/03/mtr-casebook-uncovering-a-backdoor-implant-in-a-solarwinds-orion-server/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/02/03/mtr-casebook-uncovering-a-backdoor-implant-in-a-solarwinds-orion-server/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d0ca2c4-1683-9cdc-aacd-0000f757e93f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/","pattern":"[url:value = 'https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5679bfa1-2ea7-a641-c617-000066480940","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2020/02/ragnarlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2020/02/ragnarlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--386d734e-dcf6-fe8a-09a7-0000b963d28c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cyware.com/news/ragnar-locker-breached-52-organizations-and-counting-fbi-warns-0588d220/","pattern":"[url:value = 'https://cyware.com/news/ragnar-locker-breached-52-organizations-and-counting-fbi-warns-0588d220/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0a10b8e-0f45-f436-3011-00005df83941","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.reversing.xyz/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html","pattern":"[url:value = 'https://blog.reversing.xyz/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12deffb8-c59c-37fb-4b29-0000cd74e8b5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.reversing.xyz/docs/posts/unpacking_ragnarlocker_via_emulation/","pattern":"[url:value = 'https://blog.reversing.xyz/docs/posts/unpacking_ragnarlocker_via_emulation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--427e6477-b812-e37b-61af-000013e4c9a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2022/01/20/deep-dive-into-ragnar-locker-ransomware-gang/","pattern":"[url:value = 'https://blog.cyble.com/2022/01/20/deep-dive-into-ragnar-locker-ransomware-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6450d1ee-7b27-ec8d-09c1-0000a4421dca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html","pattern":"[url:value = 'https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a896b2c-2c0e-f258-34b9-0000d74c73d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.blazeinfosec.com/dissecting-ragnar-locker-the-case-of-edp/","pattern":"[url:value = 'https://blog.blazeinfosec.com/dissecting-ragnar-locker-the-case-of-edp/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7af93fc1-b010-b6f0-9a1e-0000f8a4d927","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://reversing.fun/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html","pattern":"[url:value = 'http://reversing.fun/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--833c7ebd-cb0d-14fb-07da-0000a7230091","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://reversing.fun/posts/2021/04/15/unpacking_ragnarlocker_via_emulation.html","pattern":"[url:value = 'http://reversing.fun/posts/2021/04/15/unpacking_ragnarlocker_via_emulation.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb1a3646-057e-29cd-b696-0000f41fdc38","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/analysis-and-protections-for-ragnarlocker-ransomware.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/analysis-and-protections-for-ragnarlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf39a371-f72c-5fbf-0d9b-00007b6a2054","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1475568201673105409","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1475568201673105409']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e03f5c1a-595f-1283-9d3f-000045af5c8d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-leak-data-if-victim-contacts-fbi-police","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-leak-data-if-victim-contacts-fbi-police']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c518120b-6e81-75fb-3f03-000093bb420f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--469f7989-0cfc-d4e1-f1dc-000084df298d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybersecurity-insiders.com/ransomware-attack-makes-cwt-pay-4-5-million-in-bitcoins-to-hackers/","pattern":"[url:value = 'https://www.cybersecurity-insiders.com/ransomware-attack-makes-cwt-pay-4-5-million-in-bitcoins-to-hackers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98e2457b-b961-aa78-814f-00006fd8fa93","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-targets-msp-enterprise-support-tools/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-targets-msp-enterprise-support-tools/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1493e16-3028-b4b7-fcb4-0000a21878f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onion/","pattern":"[url:value = 'http://ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bf68854-7c27-3790-9ff2-000038478683","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://7twfgaqyik3xfuu4.onion","pattern":"[url:value = 'http://7twfgaqyik3xfuu4.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ac90b36-0615-f3a6-7484-0000d5dc7f19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xxbsnxdqmthgpydddmuvg7yzy6pdfnlnlepxa5my4mjiqjsee6yidhyd.onion","pattern":"[url:value = 'http://xxbsnxdqmthgpydddmuvg7yzy6pdfnlnlepxa5my4mjiqjsee6yidhyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78e10434-cb4d-66ac-6284-000064751f70","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://wxbpssv4hiwlcgt4cxam3cznu4feqgf5pqfibbku3x6dwvtcakdkyeid.onion","pattern":"[url:value = 'http://wxbpssv4hiwlcgt4cxam3cznu4feqgf5pqfibbku3x6dwvtcakdkyeid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43d5f786-a318-d7e2-40b7-0000bc8a73fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://t2w5byhtkqkaw6m543i6ax3mamfdy7jkkqsduzzfwhfcep4shqqsd5id.onion","pattern":"[url:value = 'http://t2w5byhtkqkaw6m543i6ax3mamfdy7jkkqsduzzfwhfcep4shqqsd5id.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--920245f9-a6da-9621-7601-00002d63d70f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://goh2zbohdiblk23scvtae7delci5cioy73la2lnrduxutxksl7xiscqd.onion","pattern":"[url:value = 'http://goh2zbohdiblk23scvtae7delci5cioy73la2lnrduxutxksl7xiscqd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46e3fb91-67e5-8a7e-ac8a-0000c6ec1c9b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2dxxyil6kur3qpht2tkklupdgacrcbfun6qf5jmk3hafmt6n6ockbzid.onion","pattern":"[url:value = 'http://2dxxyil6kur3qpht2tkklupdgacrcbfun6qf5jmk3hafmt6n6ockbzid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32de7369-1091-2484-e180-0000d60960d5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/tycoon","pattern":"[url:value = 'https://www.ransomlook.io/group/tycoon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6c97558-7f7b-2aa7-9634-00002629cde7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://usf.app.box.com/s/83xh0t5w99klrsoisorir7kgs14o972s","pattern":"[url:value = 'https://usf.app.box.com/s/83xh0t5w99klrsoisorir7kgs14o972s']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--932c05d7-241e-7b44-05d4-0000331ffe2e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cyberflorida.org/threat-advisory/tycoon-ransomware/","pattern":"[url:value = 'https://cyberflorida.org/threat-advisory/tycoon-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c403105a-7a24-66c5-1c79-00004696ade7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/covidlock-android-ransomware-walkthrough-and-unlocking-routine","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/covidlock-android-ransomware-walkthrough-and-unlocking-routine']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--641ef398-fca7-8492-7e8c-0000c2e8239f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/sites/default/files/images/blogs/covid/covid_pastebin_5.png","pattern":"[url:value = 'https://www.zscaler.com/sites/default/files/images/blogs/covid/covid_pastebin_5.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b264965b-16ac-4066-dd2e-0000f95b0c90","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/sites/default/files/images/blogs/covid/covid_lock_screen_edited_4.png","pattern":"[url:value = 'https://www.zscaler.com/sites/default/files/images/blogs/covid/covid_lock_screen_edited_4.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f128a088-22be-964c-275f-000080e21b74","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ransomexx","pattern":"[url:value = 'https://www.ransomlook.io/group/ransomexx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1051fa5f-37d0-3c29-04ec-000061a94466","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1064191-5540-3781-105c-000008a64ce9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/a/expanding-range-and-improving-speed-a-ransomexx-approach.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/a/expanding-range-and-improving-speed-a-ransomexx-approach.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a57f6d19-f2de-03ec-491a-0000f768a4b3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0db532b8-9d83-d5a6-ec74-00006940f979","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93d1a71b-2706-2ca9-d372-0000f497c1c0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d732f698-2df2-5966-31f6-00008d47bb8a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ea32faa-a8d1-9477-7081-00007d5a5729","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/proferosec-osm/ransomexx-fixing-corrupted-ransom-8e379bcaf701","pattern":"[url:value = 'https://medium.com/proferosec-osm/ransomexx-fixing-corrupted-ransom-8e379bcaf701']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db3f5fe6-1fa1-9d95-ed75-0000d25c85c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ctir.gov.br/arquivos/alertas/2020/alerta_2020_03_ataques_de_ransomware.pdf","pattern":"[url:value = 'https://www.ctir.gov.br/arquivos/alertas/2020/alerta_2020_03_ataques_de_ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a1d8bb0-f1e4-1735-5609-00008a5996ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ecuadors-state-run-cnt-telco-hit-by-ransomexx-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ecuadors-state-run-cnt-telco-hit-by-ransomexx-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b21755f-469e-06bf-3207-00008db7b145","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://gustavopalazolo.medium.com/ransomexx-an%C3%A1lise-do-ransomware-utilizado-no-ataque-ao-stj-918001ec8195","pattern":"[url:value = 'https://gustavopalazolo.medium.com/ransomexx-an%C3%A1lise-do-ransomware-utilizado-no-ataque-ao-stj-918001ec8195']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab79864e-b53e-9d51-70f5-0000ca72139a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.infosecurity-magazine.com/news/aerospace-giant-embraer-hit","pattern":"[url:value = 'https://www.infosecurity-magazine.com/news/aerospace-giant-embraer-hit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a6e151f-95bd-de16-7aed-00007eb30b92","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf9f5990-0fb6-7dd2-a1ed-000002ac9559","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/computer-hardware-giant-gigabyte-hit-by-ransomexx-ransomware","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/computer-hardware-giant-gigabyte-hit-by-ransomexx-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2582a695-4161-fab2-c194-0000f445c6f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/","pattern":"[url:value = 'https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc645c58-3e34-94a4-373f-0000ca088d03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--614f612e-a16d-e1a2-14aa-00005c2028c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/brazils-court-system-under-massive-ransomexx-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/brazils-court-system-under-massive-ransomexx-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27d0bc44-f518-147b-77e6-00004d4653f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8533237-4a31-c086-365b-0000ca40e26c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/Bleeping/Ransom.exx","pattern":"[url:value = 'https://github.com/Bleeping/Ransom.exx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09e274f1-b189-0018-37f3-0000452763e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2020/06/ransomexx-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2020/06/ransomexx-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d881df8-a4cf-d8a5-0e41-000053ae0055","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomexx","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomexx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94157be2-73ad-4f65-8481-0000ff060522","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://1.bp.blogspot.com/-RIwIgb6n0n4/X8-l2HIf88I/AAAAAAAAXRI/oyET6d1XSnwJXDIaJlwItyTFLcp4tz5mQCLcBGAsYHQ/s882/note-8-12-20.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-RIwIgb6n0n4/X8-l2HIf88I/AAAAAAAAXRI/oyET6d1XSnwJXDIaJlwItyTFLcp4tz5mQCLcBGAsYHQ/s882/note-8-12-20.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56429211-d60c-7857-ec4a-00003237449b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://1.bp.blogspot.com/-A0tAbQoei_Y/X1UxQkema_I/AAAAAAAAVV8/QuJY6v3n6943ZFax3ztDt9FXwkpAKMPPACLcBGAsYHQ/s1600/note2-9-20.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-A0tAbQoei_Y/X1UxQkema_I/AAAAAAAAVV8/QuJY6v3n6943ZFax3ztDt9FXwkpAKMPPACLcBGAsYHQ/s1600/note2-9-20.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d61cb9cd-f972-f981-232b-00004c0709d5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://1.bp.blogspot.com/-hbdqo4g6OaE/XvpFV4qbjrI/AAAAAAAAT1I/RtASzBEd_VEZIhDCCCdaxrN0iGCnnocFwCLcBGAsYHQ/s1600/note-original.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-hbdqo4g6OaE/XvpFV4qbjrI/AAAAAAAAT1I/RtASzBEd_VEZIhDCCCdaxrN0iGCnnocFwCLcBGAsYHQ/s1600/note-original.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1a7c81a-e212-a15f-c474-0000ae5608a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rbx2hfyej6sogivjtw2z2xkcqwgtiy653ap5jylggsrj6glbmfr7axqd.onion/","pattern":"[url:value = 'http://rbx2hfyej6sogivjtw2z2xkcqwgtiy653ap5jylggsrj6glbmfr7axqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33884c01-5a15-6792-71a3-00004a1b24b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://jbdg4buq6jd7ed3rd6cynqtq5abttuekjnxqrqyvk4xam5i7ld33jvqd.onion/","pattern":"[url:value = 'http://jbdg4buq6jd7ed3rd6cynqtq5abttuekjnxqrqyvk4xam5i7ld33jvqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2de2f2d-870a-68b1-4faa-0000b7945711","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://zubllg7o774lgc4rdxmfcfpjewfkqa7ml7gxwl5fetogc7hbkvaprhid.onion/","pattern":"[url:value = 'http://zubllg7o774lgc4rdxmfcfpjewfkqa7ml7gxwl5fetogc7hbkvaprhid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0aa381e3-92a9-a077-419c-000032957005","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/darkside","pattern":"[url:value = 'https://www.ransomlook.io/group/darkside']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7c5415a-abdc-08da-4860-00009731a654","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0db24509-80ca-6fdb-7046-000053c617cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.nytimes.com/2021/05/29/world/europe/ransomware-russia-darkside.html","pattern":"[url:value = 'https://www.nytimes.com/2021/05/29/world/europe/ransomware-russia-darkside.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8fe919d-0052-656d-dae4-000033e20af5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkside-ransomware-victims-sold-short/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkside-ransomware-victims-sold-short/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dd71907-5a1f-e5ea-c3a5-0000728ebd39","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside","pattern":"[url:value = 'https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bcb90f9-5fcc-eac3-1612-000033949cc8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.guidepointsecurity.com/from-zloader-to-darkside-a-ransomware-story/","pattern":"[url:value = 'https://www.guidepointsecurity.com/from-zloader-to-darkside-a-ransomware-story/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79e78291-f397-6eb3-32b9-00003f7c1a02","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pylos.co/2021/05/13/mind-the-air-gap/","pattern":"[url:value = 'https://pylos.co/2021/05/13/mind-the-air-gap/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--993b9417-ad6a-2f62-91e2-0000493956f8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://otx.alienvault.com/pulse/60d0afbc395c24edefb33bb9","pattern":"[url:value = 'https://otx.alienvault.com/pulse/60d0afbc395c24edefb33bb9']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e66c47bd-1537-7461-deeb-0000c2ccdcba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/","pattern":"[url:value = 'https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f50c5830-c68c-f621-b31c-0000abc93bbc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cybersecurity.att.com/blogs/labs-research/darkside-raas-in-linux-version","pattern":"[url:value = 'https://cybersecurity.att.com/blogs/labs-research/darkside-raas-in-linux-version']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18428e7d-6c0e-a22b-7a9c-0000958d2bcc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://abcnews.go.com/Politics/biden-speak-colonial-pipeline-attack-americans-face-gasoline/story?id=77666212","pattern":"[url:value = 'https://abcnews.go.com/Politics/biden-speak-colonial-pipeline-attack-americans-face-gasoline/story?id=77666212']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc11cef6-a028-b628-902e-00007af69002","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.varonis.com/blog/darkside-ransomware","pattern":"[url:value = 'https://www.varonis.com/blog/darkside-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b39da14-67dc-85b5-2a5f-0000cb8beb14","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.qualys.com/vulnerabilities-threat-research/2021/06/09/darkside-ransomware","pattern":"[url:value = 'https://blog.qualys.com/vulnerabilities-threat-research/2021/06/09/darkside-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78dda800-8be9-f16a-48e8-00006acadd5e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/blackmatter","pattern":"[url:value = 'https://www.ransomlook.io/group/blackmatter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afcefe93-5bb9-7d31-87c7-0000fdc0602c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://zetter.substack.com/p/anatomy-of-one-of-the-first-darkside","pattern":"[url:value = 'https://zetter.substack.com/p/anatomy-of-one-of-the-first-darkside']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58f20399-ea08-d2a2-67fd-00007e2a067a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://zawadidone.nl/darkside-ransomware-analysis/","pattern":"[url:value = 'https://zawadidone.nl/darkside-ransomware-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d403fc16-7ba6-3cb0-0690-0000cddd65b3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://zawadidone.nl/2020/10/05/darkside-ransomware-analysis.html","pattern":"[url:value = 'https://zawadidone.nl/2020/10/05/darkside-ransomware-analysis.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f41bc9e7-8f34-0a99-8aed-0000c8862694","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.wsj.com/articles/colonial-pipeline-ceo-tells-why-he-paid-hackers-a-4-4-million-ransom-11621435636","pattern":"[url:value = 'https://www.wsj.com/articles/colonial-pipeline-ceo-tells-why-he-paid-hackers-a-4-4-million-ransom-11621435636']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2df19433-a52b-8d75-da05-00000dcc93de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.varonis.com/blog/darkside-ransomware/","pattern":"[url:value = 'https://www.varonis.com/blog/darkside-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--557747dd-871f-d436-904a-0000007edec5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/e/what-we-know-about-darkside-ransomware-and-the-us-pipeline-attac.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/e/what-we-know-about-darkside-ransomware-and-the-us-pipeline-attac.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cb9f4eb-6344-9791-2e46-000093ac55e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.technologyreview.com/2021/05/24/1025195/colonial-pipeline-ransomware-bitdefender/","pattern":"[url:value = 'https://www.technologyreview.com/2021/05/24/1025195/colonial-pipeline-ransomware-bitdefender/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d78f72d3-8c45-559b-557c-00001bb74bd5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--feddcc99-640d-666d-7769-00009999f004","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66d17453-17ad-193b-1839-0000200b8b91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/blog/meet-darkside-and-their-ransomware-sentinelone-customers-protected/","pattern":"[url:value = 'https://www.sentinelone.com/blog/meet-darkside-and-their-ransomware-sentinelone-customers-protected/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be979cbd-996a-921d-a8c7-00008a6feba2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secjuice.com/blue-team-detection-darkside-ransomware/","pattern":"[url:value = 'https://www.secjuice.com/blue-team-detection-darkside-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--195cf6d7-2812-1465-8e42-00005c8b3de6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.reuters.com/technology/colonial-pipeline-halts-all-pipeline-operations-after-cybersecurity-attack-2021-05-08/","pattern":"[url:value = 'https://www.reuters.com/technology/colonial-pipeline-halts-all-pipeline-operations-after-cybersecurity-attack-2021-05-08/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5641f302-33fd-b846-ce8a-0000c9b852ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.repubblica.it/economia/finanza/2021/04/28/news/un_sospetto_attacco_telematico_blocca_le_filiali_della_bcc_di_roma-298485827/","pattern":"[url:value = 'https://www.repubblica.it/economia/finanza/2021/04/28/news/un_sospetto_attacco_telematico_blocca_le_filiali_della_bcc_di_roma-298485827/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5df83af7-0b06-8140-c562-0000d23284f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.nozominetworks.com/blog/how-to-analyze-malware-for-technical-writing/","pattern":"[url:value = 'https://www.nozominetworks.com/blog/how-to-analyze-malware-for-technical-writing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72cf13ff-cd0a-3d3d-2bd9-000020daef82","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.nozominetworks.com/blog/colonial-pipeline-ransomware-attack-revealing-how-darkside-works/","pattern":"[url:value = 'https://www.nozominetworks.com/blog/colonial-pipeline-ransomware-attack-revealing-how-darkside-works/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f9f96ae-ac9c-8b40-4a43-0000603b96f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.metabaseq.com/recursos/inside-darkside-the-ransomware-that-attacked-colonial-pipeline#","pattern":"[url:value = 'https://www.metabaseq.com/recursos/inside-darkside-the-ransomware-that-attacked-colonial-pipeline#']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fae03cb-8d00-9861-07bc-000073cfe16c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/are-virtual-machines-the-new-gold-for-cyber-criminals/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/are-virtual-machines-the-new-gold-for-cyber-criminals/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cc27b1e-7777-8ea2-2632-00005b6fc8f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mandiant.com/resources/burrowing-your-way-into-vpns","pattern":"[url:value = 'https://www.mandiant.com/resources/burrowing-your-way-into-vpns']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dfed1af-cfdc-91d1-5828-0000e474748b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/","pattern":"[url:value = 'https://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82fd9554-e4d2-f397-01d6-000050f933be","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime","pattern":"[url:value = 'https://www.intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ad9bf11-d72a-ed84-38b1-000075c054e4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intel471.com/blog/darkside-ransomware-colonial-pipeline-attack","pattern":"[url:value = 'https://www.intel471.com/blog/darkside-ransomware-colonial-pipeline-attack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4033f28-ef70-f38f-3b61-000003ff29a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2021/211101.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2021/211101.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bd34a0f-222e-b5a9-d974-0000ea662629","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3709710d-04e4-1dc1-8269-0000b35626d9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elliptic.co/blog/elliptic-follows-bitcoin-ransoms-paid-by-darkside-ransomware-victims","pattern":"[url:value = 'https://www.elliptic.co/blog/elliptic-follows-bitcoin-ransoms-paid-by-darkside-ransomware-victims']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4633ea0-8b0c-c33f-4054-0000b8703385","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elliptic.co/blog/darkside-ransomware-has-netted-over-90-million-in-bitcoin","pattern":"[url:value = 'https://www.elliptic.co/blog/darkside-ransomware-has-netted-over-90-million-in-bitcoin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ad8473-fc58-029b-9a28-00005549118a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.dragos.com/blog/industry-news/recommendations-following-the-colonial-pipeline-cyber-attack/","pattern":"[url:value = 'https://www.dragos.com/blog/industry-news/recommendations-following-the-colonial-pipeline-cyber-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc6eee5c-ba5c-0234-9e23-0000fb2700fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.deepinstinct.com/2021/06/04/the-ransomware-conundrum-a-look-into-darkside/","pattern":"[url:value = 'https://www.deepinstinct.com/2021/06/04/the-ransomware-conundrum-a-look-into-darkside/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a54af066-33e5-a30a-821f-00003a99bbaa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.databreachtoday.com/blogs/darkside-ransomware-gang-launches-affiliate-program-p-2968","pattern":"[url:value = 'https://www.databreachtoday.com/blogs/darkside-ransomware-gang-launches-affiliate-program-p-2968']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c9467fa-dcc0-6f6c-d076-000091fb19f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.databreaches.net/a-chat-with-darkside/","pattern":"[url:value = 'https://www.databreaches.net/a-chat-with-darkside/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ce0a7f2-3357-0ca5-e8d4-0000037a2a6a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/cybereason-vs-darkside-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/cybereason-vs-darkside-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfe14a9a-ca99-5e95-3302-0000d9690d56","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/how-ransomware-adversaries-reacted-to-the-darkside-pipeline-attack/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/how-ransomware-adversaries-reacted-to-the-darkside-pipeline-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1e60b7f-e518-3d66-74b0-00000146f4f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/falcon-protects-from-darkside-ransomware/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/falcon-protects-from-darkside-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--880cfb78-045d-1b2c-37c3-0000506a0893","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom","pattern":"[url:value = 'https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9b7347b-46ee-fbae-ede7-000042fd171e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/us-chemical-distributor-shares-info-on-darkside-ransomware-data-theft/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/us-chemical-distributor-shares-info-on-darkside-ransomware-data-theft/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb92fc16-c41c-6187-39ec-00004ad5c60e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--384e1272-3dd4-55a4-2090-00004a93e5ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--212a3da3-2f9c-cbb3-08f4-00009e1b27de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/darkside-ransomware-gang-returns-as-new-blackmatter-operation/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/darkside-ransomware-gang-returns-as-new-blackmatter-operation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a685f201-0171-de74-f90d-00004eecdbaf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/darkside-affiliates-claim-gangs-bitcoins-in-deposit-on-hacker-forum/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/darkside-affiliates-claim-gangs-bitcoins-in-deposit-on-hacker-forum/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--274f0127-c0f0-136f-4ad8-0000360c78ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/chemical-distributor-pays-44-million-to-darkside-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/chemical-distributor-pays-44-million-to-darkside-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4add268f-e9eb-5e0b-8a18-000025a33414","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/from-dawn-to-silent-night-darkside-ransomware-initial-attack-vector-evolution","pattern":"[url:value = 'https://www.advanced-intel.com/post/from-dawn-to-silent-night-darkside-ransomware-initial-attack-vector-evolution']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2053c914-22c8-d139-eac1-00000703226b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.acronis.com/en-us/articles/darkside-ransomware/","pattern":"[url:value = 'https://www.acronis.com/en-us/articles/darkside-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd586df0-5eb1-ed17-a606-0000f451fa9f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://us-cert.cisa.gov/ncas/analysis-reports/ar21-189a","pattern":"[url:value = 'https://us-cert.cisa.gov/ncas/analysis-reports/ar21-189a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb074202-93ef-c68e-f555-0000abd9295f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://us-cert.cisa.gov/ncas/alerts/aa21-131a","pattern":"[url:value = 'https://us-cert.cisa.gov/ncas/alerts/aa21-131a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b22fd880-54ef-50ca-5647-0000f7732cd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/sysopfb/status/1422280887274639375","pattern":"[url:value = 'https://twitter.com/sysopfb/status/1422280887274639375']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6428862-d4c9-a1c5-bb76-0000d4ad68e9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/ValthekOn/status/1422385890467491841?s=20","pattern":"[url:value = 'https://twitter.com/ValthekOn/status/1422385890467491841?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffe5de8e-5000-4931-f562-0000d0068dbd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JAMESWT_MHT/status/1388301138437578757","pattern":"[url:value = 'https://twitter.com/JAMESWT_MHT/status/1388301138437578757']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc9f7c68-a39e-9f98-a7e8-0000518867e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/guess-fashion-data-loss-ransomware/167754/","pattern":"[url:value = 'https://threatpost.com/guess-fashion-data-loss-ransomware/167754/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c17517d-dfda-1496-76cf-0000882c5723","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/ransomware-gang-wants-to-short-the-stock-price-of-their-victims/","pattern":"[url:value = 'https://therecord.media/ransomware-gang-wants-to-short-the-stock-price-of-their-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7991083-aa84-28db-f09e-0000d414d901","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/popular-hacking-forum-bans-ransomware-ads/","pattern":"[url:value = 'https://therecord.media/popular-hacking-forum-bans-ransomware-ads/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f061653e-cc1e-fb46-e7df-0000f8bc43e8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec.broadcom.com/hubfs/Attacks-Against-Critical_Infrastructrure.pdf","pattern":"[url:value = 'https://symantec.broadcom.com/hubfs/Attacks-Against-Critical_Infrastructrure.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e9ee0c4-f2b2-96df-cf3e-00002b193683","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://socprime.com/blog/affiliates-vs-hunters-fighting-the-darkside/","pattern":"[url:value = 'https://socprime.com/blog/affiliates-vs-hunters-fighting-the-darkside/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaca9ed2-a809-cfdc-b79c-0000ee082860","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityscorecard.com/blog/new-evidence-supports-assessment-that-darkside-likely-responsible-for-colonial-pipeline-ransomware-attack-others-targeted","pattern":"[url:value = 'https://securityscorecard.com/blog/new-evidence-supports-assessment-that-darkside-likely-responsible-for-colonial-pipeline-ransomware-attack-others-targeted']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eeb75700-2190-b91d-6ea6-00005489a8fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityintelligence.com/posts/darkside-oil-pipeline-ransomware-attack/","pattern":"[url:value = 'https://securityintelligence.com/posts/darkside-oil-pipeline-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3731680f-1266-68da-0a87-000003d0e331","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/05/11/a-defenders-view-inside-a-darkside-ransomware-attack/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/05/11/a-defenders-view-inside-a-darkside-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6c6d28d-dd4a-09a2-8a47-0000dc920dc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/w1-jun-en-story-of-the-week-ransomware-on-the-darkweb-af491d33868b","pattern":"[url:value = 'https://medium.com/s2wlab/w1-jun-en-story-of-the-week-ransomware-on-the-darkweb-af491d33868b']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35a0f042-d184-3b62-43db-000045025e60","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.bitdefender.com/2021/01/darkside-ransomware-decryption-tool/","pattern":"[url:value = 'https://labs.bitdefender.com/2021/01/darkside-ransomware-decryption-tool/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6950475-a9f4-ec9b-d818-000042454d7c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/","pattern":"[url:value = 'https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3221ad9e-e9a6-85a7-cb9e-0000543b029c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2021/07/blackmatter-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2021/07/blackmatter-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2871f933-deba-94f0-63d6-000030270511","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2020/08/darkside-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2020/08/darkside-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8d804ca-eff3-8ea2-5cf2-0000842ac962","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/sisoma2/malware_analysis/tree/master/blackmatter","pattern":"[url:value = 'https://github.com/sisoma2/malware_analysis/tree/master/blackmatter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f0954e4-0de3-b629-fe68-0000fd961da9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/Haxrein/Malware-Analysis-Reports/blob/main/darkside_ransomware_technical_analysis_report.pdf","pattern":"[url:value = 'https://github.com/Haxrein/Malware-Analysis-Reports/blob/main/darkside_ransomware_technical_analysis_report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7d7a41e-4311-ddfd-814c-00003012f5f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ghoulsec.medium.com/mal-series-13-darkside-ransomware-c13d893c36a6","pattern":"[url:value = 'https://ghoulsec.medium.com/mal-series-13-darkside-ransomware-c13d893c36a6']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1df05319-43b0-8767-b0c1-0000cbaa21c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cybergeeks.tech/a-step-by-step-analysis-of-a-new-version-of-darkside-ransomware/","pattern":"[url:value = 'https://cybergeeks.tech/a-step-by-step-analysis-of-a-new-version-of-darkside-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4c59e7f-b2f6-3d2b-b1f1-0000af17fbdc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://community.riskiq.com/article/fdf74f23","pattern":"[url:value = 'https://community.riskiq.com/article/fdf74f23']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10e44cd9-0230-02c1-5813-00008d856d69","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/","pattern":"[url:value = 'https://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7f98997-ed7a-c7d1-ff04-0000220a82c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://brandefense.io/darkside-ransomware-analysis-report/","pattern":"[url:value = 'https://brandefense.io/darkside-ransomware-analysis-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e427e5f-0bcd-ac35-c459-0000baf858e9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blueteamblog.com/darkside-ransomware-operations-preventions-and-detections","pattern":"[url:value = 'https://blueteamblog.com/darkside-ransomware-operations-preventions-and-detections']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3b7c41c-97ff-637c-a50b-00001bd92b0c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.keysight.com/blogs/tech/nwvs.entry.html/2021/05/18/darkside_ransomware-QfsV.html","pattern":"[url:value = 'https://blogs.keysight.com/blogs/tech/nwvs.entry.html/2021/05/18/darkside_ransomware-QfsV.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d99686a1-8703-b3f0-734c-000058797b9c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.gigamon.com/2021/05/17/tracking-darkside-and-ransomware-the-network-view/","pattern":"[url:value = 'https://blog.gigamon.com/2021/05/17/tracking-darkside-and-ransomware-the-network-view/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5087fb56-74ca-0f40-80af-000018d33909","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2021/08/05/blackmatter-under-the-lens-an-emerging-ransomware-group-looking-for-affiliates/","pattern":"[url:value = 'https://blog.cyble.com/2021/08/05/blackmatter-under-the-lens-an-emerging-ransomware-group-looking-for-affiliates/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7a51965-e04e-dd1f-d1f2-000087d6b2ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.360totalsecurity.com/en/darksides-targeted-ransomware-analysis-report-for-critical-u-s-infrastructure-2/","pattern":"[url:value = 'https://blog.360totalsecurity.com/en/darksides-targeted-ransomware-analysis-report-for-critical-u-s-infrastructure-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de666163-a59d-8476-c2b1-000066d0ae82","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://asec.ahnlab.com/en/34549/","pattern":"[url:value = 'https://asec.ahnlab.com/en/34549/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4e56e77-b0d7-3834-4b17-00008ed66b11","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ti.dbappsecurity.com.cn/blog/index.php/2021/05/10/darkside/","pattern":"[url:value = 'http://ti.dbappsecurity.com.cn/blog/index.php/2021/05/10/darkside/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a86aed03-f03b-e8b2-a085-0000b087feb8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/","pattern":"[url:value = 'http://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e92e71bc-e726-d0b6-67e5-0000d2c0074b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.varonis.com/blog/blackmatter-ransomware/","pattern":"[url:value = 'https://www.varonis.com/blog/blackmatter-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5bd36fb-80d1-4f50-210b-0000712b877e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.theregister.com/2022/03/22/talos-ransomware-blackcat/","pattern":"[url:value = 'https://www.theregister.com/2022/03/22/talos-ransomware-blackcat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8951763e-6731-9fec-d235-0000bf8a32af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tesorion.nl/en/posts/analysis-of-the-blackmatter-ransomware/","pattern":"[url:value = 'https://www.tesorion.nl/en/posts/analysis-of-the-blackmatter-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75f99979-d339-8001-47a4-0000cbb46def","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.nozominetworks.com/blog/blackmatter-ransomware-technical-analysis-and-tools-from-nozomi-networks-labs/","pattern":"[url:value = 'https://www.nozominetworks.com/blog/blackmatter-ransomware-technical-analysis-and-tools-from-nozomi-networks-labs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdd475e5-7f4e-7c29-20f6-000088a9cc66","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.netskope.com/blog/netskope-threat-coverage-blackmatter","pattern":"[url:value = 'https://www.netskope.com/blog/netskope-threat-coverage-blackmatter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a52189a7-e283-9bc2-123e-00008e693db2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b6b2756-4a6f-d624-e2f7-00009ce21d02","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/enterprise/blackmatter-ransomware-analysis-the-dark-side-returns/","pattern":"[url:value = 'https://www.mcafee.com/blogs/enterprise/blackmatter-ransomware-analysis-the-dark-side-returns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c64f2ca-d03c-fdaa-ce52-0000041b702a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mandiant.com/resources/cryptography-blackmatter-ransomware","pattern":"[url:value = 'https://www.mandiant.com/resources/cryptography-blackmatter-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--048cfc8b-b6c6-427a-0ba2-00004511d071","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ciphertechsolutions.com/rapidly-evolving-blackmatter-ransomware-tactics/","pattern":"[url:value = 'https://www.ciphertechsolutions.com/rapidly-evolving-blackmatter-ransomware-tactics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1bf27b9-27dd-c0de-7c52-0000bfe29c88","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/blackmatter-ransomware-says-its-shutting-down-due-to-pressure-from-local-authorities/","pattern":"[url:value = 'https://therecord.media/blackmatter-ransomware-says-its-shutting-down-due-to-pressure-from-local-authorities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cf448db-7d8a-945c-fbbe-0000f7da6c1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-ransomware-ttps","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-ransomware-ttps']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa65ae61-368d-75fc-eec2-0000b03fe0a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b49ebac8-4f41-61f1-31a3-000062577a93","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://services.google.com/fh/files/misc/gcat_threathorizons_full_nov2021.pdf","pattern":"[url:value = 'https://services.google.com/fh/files/misc/gcat_threathorizons_full_nov2021.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c9de5ae-a3a9-4ce1-0b17-00008a27dda8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://raw.githubusercontent.com/antonioCoco/infosec-talks/main/InsomniHack_2022_Ransomware_Encryption_Internals.pdf","pattern":"[url:value = 'https://raw.githubusercontent.com/antonioCoco/infosec-talks/main/InsomniHack_2022_Ransomware_Encryption_Internals.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79d4b428-bc51-3f44-774f-0000c33f2ffe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wblog/blackcat-new-rust-based-ransomware-borrowing-blackmatters-configuration-31c8d330a809","pattern":"[url:value = 'https://medium.com/s2wblog/blackcat-new-rust-based-ransomware-borrowing-blackmatters-configuration-31c8d330a809']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f6e5b55-5acd-07b8-8d19-00006d44617a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/the-ideal-ransomware-victim-what-attackers-are-looking-for/","pattern":"[url:value = 'https://ke-la.com/the-ideal-ransomware-victim-what-attackers-are-looking-for/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f184b6c8-b1a9-ab93-fca8-00003380cca0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf","pattern":"[url:value = 'https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98173343-e3da-604f-4abf-0000f1129658","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://go.recordedfuture.com/hubfs/reports/MTP-2021-0804.pdf","pattern":"[url:value = 'https://go.recordedfuture.com/hubfs/reports/MTP-2021-0804.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d73217f-9fd7-2c2f-2acb-0000ee485f9b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://chuongdong.com/reverse%20engineering/2021/09/05/BlackMatterRansomware/","pattern":"[url:value = 'https://chuongdong.com/reverse%20engineering/2021/09/05/BlackMatterRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc561d36-b2fa-6151-c859-0000a9f4449d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf","pattern":"[url:value = 'https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--feb4f2b1-afee-1f64-c252-0000da6c25dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.minerva-labs.com/blackmatter","pattern":"[url:value = 'https://blog.minerva-labs.com/blackmatter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c69f62c9-7661-1c04-d67b-00005d736f57","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.digital-investigations.info/2021-08-05-understanding-blackmatters-api-hashing.html","pattern":"[url:value = 'https://blog.digital-investigations.info/2021-08-05-understanding-blackmatters-api-hashing.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd1048e2-b78a-cd37-a934-00007b0794d4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://assets.virustotal.com/reports/2021trends.pdf","pattern":"[url:value = 'https://assets.virustotal.com/reports/2021trends.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f82c8e04-76d1-131e-13a4-000064a734ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=NIiEcOryLpI","pattern":"[url:value = 'https://www.youtube.com/watch?v=NIiEcOryLpI']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1859e9e-dfa3-2ea3-1cec-000071eb00de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/","pattern":"[url:value = 'https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57b07ae6-2fe1-ca6a-b3c0-000047a8cb1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hhs.gov/sites/default/files/demystifying-blackmatter.pdf","pattern":"[url:value = 'https://www.hhs.gov/sites/default/files/demystifying-blackmatter.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee84aeeb-5676-7c0d-1cd3-00008b90ac5f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group","pattern":"[url:value = 'https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1316460-8c79-42fb-99c8-0000ecee20f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1522908-b2fe-78e6-2fb2-00003b46bb84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/linux-version-of-blackmatter-ransomware-targets-vmware-esxi-servers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/linux-version-of-blackmatter-ransomware-targets-vmware-esxi-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b33f4b12-884c-864b-4774-00004e3f89f0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a425683a-b5e0-c846-6cd7-00003baa10a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://us-cert.cisa.gov/ncas/alerts/aa21-291a","pattern":"[url:value = 'https://us-cert.cisa.gov/ncas/alerts/aa21-291a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74a206b1-a0f2-0e50-2097-00005e68b4bf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/VK_Intel/status/1423188690126266370","pattern":"[url:value = 'https://twitter.com/VK_Intel/status/1423188690126266370']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--250d21b1-4da1-ab4e-63ef-0000c2c4b8f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GelosSnake/status/1451465959894667275","pattern":"[url:value = 'https://twitter.com/GelosSnake/status/1451465959894667275']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aebd48e5-a6d5-24ae-bfff-0000d62f5d77","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/","pattern":"[url:value = 'https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8fe7a02-33d9-30fa-9268-00007827df1f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html","pattern":"[url:value = 'https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a793a8da-1c57-fb07-bb15-00007bb001f0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06228704-8844-6eae-60bb-000052dda21c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2","pattern":"[url:value = 'https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--220609d9-405e-2884-2586-00004e8f554f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d","pattern":"[url:value = 'https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80ae8f93-e7f5-9053-9586-0000865649ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751","pattern":"[url:value = 'https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f761b5d-86b1-8726-1c00-00008042e791","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service","pattern":"[url:value = 'https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaee5394-54cb-0662-09e7-0000d84894c0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.group-ib.com/blackmatter2","pattern":"[url:value = 'https://blog.group-ib.com/blackmatter2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c05e7366-d385-a7e6-5bf1-000030eda43a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.group-ib.com/blackmatter#","pattern":"[url:value = 'https://blog.group-ib.com/blackmatter#']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f578fad-4778-6b21-9d7e-00006cc2cb61","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://venturebeat.com/2021/08/23/sophoslabs-research-shows-blackmatter-ransomware-is-closely-acquainted-with-darkside","pattern":"[url:value = 'https://venturebeat.com/2021/08/23/sophoslabs-research-shows-blackmatter-ransomware-is-closely-acquainted-with-darkside']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--471fd7c3-7cf5-bce7-f063-000024ee33dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tripwire.com/state-of-security/featured/blackmatter-pose-new-ransomware-threat","pattern":"[url:value = 'https://www.tripwire.com/state-of-security/featured/blackmatter-pose-new-ransomware-threat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22ac5ae9-85e3-20af-5c82-0000cd71f4be","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://darksidedxcftmqa.onion.foundation/","pattern":"[url:value = 'https://darksidedxcftmqa.onion.foundation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--117cbd31-c4c1-73f3-2b54-0000d90727fa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.wired.com/story/ransomware-gone-corporate-darkside-where-will-it-end/","pattern":"[url:value = 'https://www.wired.com/story/ransomware-gone-corporate-darkside-where-will-it-end/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6e5c74b-e72b-ff10-bd32-0000dc627027","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.digitalshadows.com/blog-and-research/darkside-the-new-ransomware-group-behind-highly-targeted-attacks/","pattern":"[url:value = 'https://www.digitalshadows.com/blog-and-research/darkside-the-new-ransomware-group-behind-highly-targeted-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7999592a-b103-f884-d7b6-000023064b1c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://darksidedxcftmqa.onion/","pattern":"[url:value = 'http://darksidedxcftmqa.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf1e6f5e-a78b-6262-c976-00008a3e0ca0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/","pattern":"[url:value = 'http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d611498-e93c-3210-d513-0000136d2ae0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion","pattern":"[url:value = 'http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecec90ba-be67-a13a-f1aa-0000e4421acd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/","pattern":"[url:value = 'http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--205c9dd2-d979-d2fc-2ac8-0000dc494d58","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://chuongdong.com//reverse%20engineering/2021/01/03/BabukRansomware/","pattern":"[url:value = 'http://chuongdong.com//reverse%20engineering/2021/01/03/BabukRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56e6bc77-0738-3c0e-61c4-0000a4d19dd4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-spotlight/2020/07/threat-spotlight-wastedlocker-customized-ransomware/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-spotlight/2020/07/threat-spotlight-wastedlocker-customized-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4505a429-5ae2-eb62-45b6-000079ebb5e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.cisco.com/security/talos/wastedlocker-goes-big-game-hunting-in-2020","pattern":"[url:value = 'https://blogs.cisco.com/security/talos/wastedlocker-goes-big-game-hunting-in-2020']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c78af847-49b2-bb82-f96e-000050abdfa7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/wp-content/uploads/2020/06/ransomnote.png","pattern":"[url:value = 'https://blog.malwarebytes.com/wp-content/uploads/2020/06/ransomnote.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f873fccb-98bb-eac2-4f22-00001889b2c0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/lockbit","pattern":"[url:value = 'https://www.ransomlook.io/group/lockbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5632fe51-c555-d82e-ce10-0000dbe09ccc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://yoroi.company/research/hunting-the-lockbit-gangs-exfiltration-infrastructures/","pattern":"[url:value = 'https://yoroi.company/research/hunting-the-lockbit-gangs-exfiltration-infrastructures/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed4e4f32-aa36-30f7-dd4a-0000351c4be0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/","pattern":"[url:value = 'https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e2dad75-6a86-591a-89a9-0000f83a719a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=C733AyPzkoc","pattern":"[url:value = 'https://www.youtube.com/watch?v=C733AyPzkoc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b630abd-378d-ccc9-11f7-000017a4f0de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-by-the-numbers/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-by-the-numbers/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--625eb996-de6d-9a03-e2f2-0000b43ce88c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--893fe987-f7bf-45a1-98a6-000029d62dba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5770c7db-ce61-c520-83d9-0000a114af9d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/h/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/h/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9966ccf5-9b18-c080-4b5e-000084e7a823","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_no/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html","pattern":"[url:value = 'https://www.trendmicro.com/en_no/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--053ab6aa-59bc-4e09-4254-0000540a4d91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload/iocs-thwarting-loaders-socgholish-blister.txt","pattern":"[url:value = 'https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload/iocs-thwarting-loaders-socgholish-blister.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5f4702f-7af9-f7d4-feb8-000052880b45","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/","pattern":"[url:value = 'https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2101a9cb-8fc0-8383-5b98-0000614e0b18","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques/","pattern":"[url:value = 'https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dfb0786-403c-1235-7b83-000074e09fa2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/","pattern":"[url:value = 'https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c15de42d-0948-04ed-2006-0000eb2b8b7d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.prodaft.com/m/reports/LockBit_Case_Report___TLPWHITE.pdf","pattern":"[url:value = 'https://www.prodaft.com/m/reports/LockBit_Case_Report___TLPWHITE.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd4f5e6e-96a7-987b-7908-000074648f92","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.netskope.com/blog/netskope-threat-coverage-lockbit","pattern":"[url:value = 'https://www.netskope.com/blog/netskope-threat-coverage-lockbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3770d054-8175-284a-c05e-00004efe77d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--421b06be-0e69-534f-05ed-0000e789f89c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mbsd.jp/2021/10/27/assets/images/MBSD_WhitePaper_A-deep-dive-analysis-of-LockBit2.0_Ransomware.pdf","pattern":"[url:value = 'https://www.mbsd.jp/2021/10/27/assets/images/MBSD_WhitePaper_A-deep-dive-analysis-of-LockBit2.0_Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46b4dd78-af76-9573-a321-0000560eb0c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.lemagit.fr/actualites/252516821/Ransomware-LockBit-30-commence-a-etre-utilise-dans-des-cyberattaques","pattern":"[url:value = 'https://www.lemagit.fr/actualites/252516821/Ransomware-LockBit-30-commence-a-etre-utilise-dans-des-cyberattaques']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5099a132-4032-8ec8-e9a1-0000ed56d248","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intrinsec.com/alphv-ransomware-gang-analysis","pattern":"[url:value = 'https://www.intrinsec.com/alphv-ransomware-gang-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8148227d-0424-4164-65b5-000077ea31ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.glimps.fr/lockbit3-0/","pattern":"[url:value = 'https://www.glimps.fr/lockbit3-0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--967c987d-635b-a306-487f-00004874833e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.dr.dk/nyheder/viden/teknologi/frygtede-skulle-lukke-alle-vindmoeller-nu-aabner-vestas-op-om-hacking-angreb","pattern":"[url:value = 'https://www.dr.dk/nyheder/viden/teknologi/frygtede-skulle-lukke-alle-vindmoeller-nu-aabner-vestas-op-om-hacking-angreb']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--068e8e14-d60f-a7ef-3ad7-0000405955e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom","pattern":"[url:value = 'https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7863e810-6deb-c24f-0ded-0000aa4cafa0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool","pattern":"[url:value = 'https://www.cybereason.com/blog/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0685132-59cd-d25e-2c57-00003350f19f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/rising-threat-from-lockbit-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/rising-threat-from-lockbit-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1022738-3d6b-898e-ecda-0000eac5222e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crypsisgroup.com/insights/ransomwares-new-trend-exfiltration-and-extortion","pattern":"[url:value = 'https://www.crypsisgroup.com/insights/ransomwares-new-trend-exfiltration-and-extortion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbc72acf-3630-cd89-20e3-000004ee0f13","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/how-crowdstrike-prevents-volume-shadow-tampering-by-lockbit-ransomware/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/how-crowdstrike-prevents-volume-shadow-tampering-by-lockbit-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b4b2d77-d3a3-175a-c13e-000064ecf9d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.coveware.com/blog/2022/1/26/ransomware-as-a-service-innovation-curve","pattern":"[url:value = 'https://www.coveware.com/blog/2022/1/26/ransomware-as-a-service-innovation-curve']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11e0f8de-53d1-3c81-fd4b-00000f0ed448","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.connectwise.com/resources/lockbit-profile","pattern":"[url:value = 'https://www.connectwise.com/resources/lockbit-profile']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddb51a8f-f64c-b8f3-a524-00001539a416","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/uk-rail-network-merseyrail-likely-hit-by-lockbit-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/uk-rail-network-merseyrail-likely-hit-by-lockbit-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2bafaee-1e0b-a1f1-96f9-000092edeb53","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-attack-hits-italys-lazio-region-affects-covid-19-site/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-attack-hits-italys-lazio-region-affects-covid-19-site/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1089c99-4fde-4195-a221-0000d59b8b24","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab032a54-1719-8a4b-7208-000069a15efb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26435ea7-5d2c-c645-298c-0000e3ac6e9d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85700cd3-5745-c676-f377-00008709f072","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-claims-attack-on-bridgestone-americas/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-claims-attack-on-bridgestone-americas/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64b3bbc9-f7cf-a870-93b7-00003f517d40","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/energy-group-erg-reports-minor-disruptions-after-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/energy-group-erg-reports-minor-disruptions-after-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6c3fa64-f890-6d8f-9364-00005796bc89","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b993bf14-a15f-f3ac-ed29-0000e5023e32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/from-russia-with-lockbit-ransomware-inside-look-preventive-solutions","pattern":"[url:value = 'https://www.advanced-intel.com/post/from-russia-with-lockbit-ransomware-inside-look-preventive-solutions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f6f93c7-02f5-5db8-98d1-0000e7f76064","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/emerging-ransomware-groups/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/emerging-ransomware-groups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--080fd806-bbb6-7d5e-b88e-000029a56b92","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-blackmatter-lockbit-thor","pattern":"[url:value = 'https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-blackmatter-lockbit-thor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52b5a13b-429e-5ef1-ba9e-0000d05f8526","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/MsftSecIntel/status/1522690116979855360","pattern":"[url:value = 'https://twitter.com/MsftSecIntel/status/1522690116979855360']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2f150cd-54e0-1d26-20d6-00001d00df81","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/missed-opportunity-bug-in-lockbit-ransomware-allowed-free-decryptions/","pattern":"[url:value = 'https://therecord.media/missed-opportunity-bug-in-lockbit-ransomware-allowed-free-decryptions/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f9b29a8-33e4-dfdb-f020-000000869cce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/conti-ransomware-gang-chats-leaked-by-pro-ukraine-member/","pattern":"[url:value = 'https://therecord.media/conti-ransomware-gang-chats-leaked-by-pro-ukraine-member/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bee1f2db-68d0-0bed-63da-0000842dce10","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/australian-cybersecurity-agency-warns-of-spike-in-lockbit-ransomware-attacks/","pattern":"[url:value = 'https://therecord.media/australian-cybersecurity-agency-warns-of-spike-in-lockbit-ransomware-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a5e761e-b875-b05c-8b49-0000177869dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-2-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254421","pattern":"[url:value = 'https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-2-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254421']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa14722d-fe28-732f-4936-0000c3305fee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-1-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254354","pattern":"[url:value = 'https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-1-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254354']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4f1833d-0e1d-596f-03f0-000002d13acb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/481/original/010421_LockBit_Interview.pdf","pattern":"[url:value = 'https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/481/original/010421_LockBit_Interview.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12ed0ca3-3086-aa58-a98b-00005d46774c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--294e60c7-d637-4798-3cf0-0000940fc272","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://skyblue.team/posts/hive-recovery-from-lockbit-2.0/","pattern":"[url:value = 'https://skyblue.team/posts/hive-recovery-from-lockbit-2.0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0d9fa0d-d2d3-91a6-e65e-0000edf2b56a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://seguranca-informatica.pt/malware-analysis-details-on-lockbit-ransomware/","pattern":"[url:value = 'https://seguranca-informatica.pt/malware-analysis-details-on-lockbit-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9013e42b-f03f-704e-a2e8-00007ec29b09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments","pattern":"[url:value = 'https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2d9fa34-b01b-5cbc-558e-0000c6486b17","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityintelligence.com/posts/lockbit-ransomware-attacks-surge-affiliate-recruitment/","pattern":"[url:value = 'https://securityintelligence.com/posts/lockbit-ransomware-attacks-surge-affiliate-recruitment/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e5f17fc-f69c-6b65-7f8a-0000b6ff07b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/new-ransomware-trends-in-2022/106457/","pattern":"[url:value = 'https://securelist.com/new-ransomware-trends-in-2022/106457/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95222332-c07a-6b2e-7fd7-0000b8504240","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack","pattern":"[url:value = 'https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d203c19-e7a9-223c-6c07-0000af1c84eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://redcanary.com/blog/intelligence-insights-november-2021/","pattern":"[url:value = 'https://redcanary.com/blog/intelligence-insights-november-2021/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31f143c5-467c-0f80-a96e-000072fccf78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2022/04/12/attackers-linger-on-government-agency-computers-before-deploying-lockbit-ransomware/","pattern":"[url:value = 'https://news.sophos.com/en-us/2022/04/12/attackers-linger-on-government-agency-computers-before-deploying-lockbit-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fde4b45c-a22c-d558-0694-0000b61edf5a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/10/21/lockbit-attackers-uses-automated-attack-tools-to-identify-tasty-targets","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/10/21/lockbit-attackers-uses-automated-attack-tools-to-identify-tasty-targets']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d046e2c-6103-df66-6dd5-000039327827","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88e3872c-d26b-eb4c-3718-000088e047ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/w4-jan-en-story-of-the-week-ransomware-on-the-darkweb-7595544363b1","pattern":"[url:value = 'https://medium.com/s2wlab/w4-jan-en-story-of-the-week-ransomware-on-the-darkweb-7595544363b1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1346d03f-74bb-ace3-d20f-0000c5c6c6aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/@amgedwageh/lockbit-ransomware-analysis-notes-93a542fc8511","pattern":"[url:value = 'https://medium.com/@amgedwageh/lockbit-ransomware-analysis-notes-93a542fc8511']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8ec192a-3ecf-95c8-0be9-0000f310813b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/lockbit-2-0-interview-with-russian-osint/","pattern":"[url:value = 'https://ke-la.com/lockbit-2-0-interview-with-russian-osint/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5acf51eb-fb73-e426-b581-0000f9bac981","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/privateloader-malware","pattern":"[url:value = 'https://intel471.com/blog/privateloader-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b3c6a6d-dfd8-02c2-8d7c-00000404e22c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/search?q=lockbit","pattern":"[url:value = 'https://id-ransomware.blogspot.com/search?q=lockbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09f1f659-e1dd-8446-e131-00001f47d429","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Lockbit.md","pattern":"[url:value = 'https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Lockbit.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52b2ba80-b308-cebd-c286-00002e06caee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://documents.trendmicro.com/assets/pdf/datasheet-ransomware-in-Q1-2022.pdf","pattern":"[url:value = 'https://documents.trendmicro.com/assets/pdf/datasheet-ransomware-in-Q1-2022.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b49d4cb-1621-5705-86a3-000083d8c51b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cybergeeks.tech/a-technical-analysis-of-the-leaked-lockbit-3-0-builder/","pattern":"[url:value = 'https://cybergeeks.tech/a-technical-analysis-of-the-leaked-lockbit-3-0-builder/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c41f9d1-3f0f-fa84-814a-0000bc9831d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cluster25.io/2022/07/06/lockbit-3-0-making-the-ransomware-great-again/","pattern":"[url:value = 'https://cluster25.io/2022/07/06/lockbit-3-0-making-the-ransomware-great-again/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1f73bb2-e9c1-e15f-6122-00002dc7e7f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/","pattern":"[url:value = 'https://chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8a2692c-af1a-1782-4849-000049c6e8b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities","pattern":"[url:value = 'https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--889227ef-c4f2-c27c-b16b-0000920c92b6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness","pattern":"[url:value = 'https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09b2aa84-15a4-95d9-14d9-000063cd7038","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.lexfo.fr/lockbit-malware.html","pattern":"[url:value = 'https://blog.lexfo.fr/lockbit-malware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b8cba0f-a18d-bb7e-6586-0000050e8ba1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2022/07/05/lockbit-3-0-ransomware-group-launches-new-version/","pattern":"[url:value = 'https://blog.cyble.com/2022/07/05/lockbit-3-0-ransomware-group-launches-new-version/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--323cba48-6f14-a7cc-b6c9-0000bbbaa351","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2021/08/16/a-deep-dive-analysis-of-lockbit-2-0/","pattern":"[url:value = 'https://blog.cyble.com/2021/08/16/a-deep-dive-analysis-of-lockbit-2-0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dac5f19f-d3d6-94a5-1ff4-0000e4905c7a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://asec.ahnlab.com/ko/39682/","pattern":"[url:value = 'https://asec.ahnlab.com/ko/39682/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6153577-de52-f52b-da32-00006a241dd0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://asec.ahnlab.com/en/35822/","pattern":"[url:value = 'https://asec.ahnlab.com/en/35822/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d509a2c7-0bf7-c723-3a63-0000857ba371","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://amgedwageh.medium.com/lockbit-ransomware-analysis-notes-93a542fc8511","pattern":"[url:value = 'https://amgedwageh.medium.com/lockbit-ransomware-analysis-notes-93a542fc8511']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afb2446e-669a-3e54-8a39-00000745fb8a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2022/220204.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2022/220204.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dbe8c3d-6b84-97f8-5277-0000632a7abc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fortinet.com/blog/threat-research/ransomware-roundup-new-variants","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/ransomware-roundup-new-variants']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ad5b796-cb3e-5390-0ea8-000050d59fb2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/","pattern":"[url:value = 'https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ab57156-b86e-3c23-8d8c-000011681812","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lockbit-victim-estimates-cost-of-ransomware-attack-to-be-42-million/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lockbit-victim-estimates-cost-of-ransomware-attack-to-be-42-million/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c47dacf-635e-cebf-9447-0000fdea6d09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf","pattern":"[url:value = 'https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f9e9658-94a9-dbcb-a0ab-0000a675a966","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.compass-security.com/2022/03/vpn-appliance-forensics/","pattern":"[url:value = 'https://blog.compass-security.com/2022/03/vpn-appliance-forensics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83b16727-6a21-425e-b20d-00005fae6b32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://usa.kaspersky.com/resource-center/threats/lockbit-ransomware","pattern":"[url:value = 'https://usa.kaspersky.com/resource-center/threats/lockbit-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df054d8a-4ea7-a681-4aab-00002d691ee0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/tales-from-the-trenches-a-lockbit-ransomware-story/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/tales-from-the-trenches-a-lockbit-ransomware-story/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcdca291-e220-7096-ad1c-00001bf3d741","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/wp-content/uploads/2020/04/content-in-restore-my-files.png","pattern":"[url:value = 'https://www.mcafee.com/wp-content/uploads/2020/04/content-in-restore-my-files.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ec6f545-7777-bbbe-60df-000069870d09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Restore-My-Files.txt","pattern":"[domain-name:value = 'Restore-My-Files.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f4b6eb0-2062-1281-034e-00002b5865e0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://lockbitks2tvnmwk.onion","pattern":"[url:value = 'http://lockbitks2tvnmwk.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bacbb9f-2266-a5bf-d06f-0000da682298","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/suncrypt","pattern":"[url:value = 'https://www.ransomlook.io/group/suncrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b01b769-0c94-b5e8-6668-00006ff3bd73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tesorion.nl/en/posts/shining-a-light-on-suncrypts-curious-file-encryption-mechanism/","pattern":"[url:value = 'https://www.tesorion.nl/en/posts/shining-a-light-on-suncrypts-curious-file-encryption-mechanism/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd4b5bc8-d615-2579-29bf-0000d38b9e2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60727902-c65e-c472-e782-0000b704430f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-is-still-alive-and-kicking-in-2022/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-is-still-alive-and-kicking-in-2022/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9db75e6-0a02-f53e-65e4-00001a506f9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pcsxcetrasupport3.wordpress.com/2021/03/28/suncrypt-powershell-obfuscation-shellcode-and-more-yara/","pattern":"[url:value = 'https://pcsxcetrasupport3.wordpress.com/2021/03/28/suncrypt-powershell-obfuscation-shellcode-and-more-yara/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d875d973-83f6-95d6-0cd9-0000d254689a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/w4-july-en-story-of-the-week-ransomware-on-the-darkweb-c61965d0386a","pattern":"[url:value = 'https://medium.com/s2wlab/w4-july-en-story-of-the-week-ransomware-on-the-darkweb-c61965d0386a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f435d26-8053-c26a-b2bb-000028764ce0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/case-analysis-of-suncrypt-ransomware-negotiation-and-bitcoin-transaction-43a2194ac0bc","pattern":"[url:value = 'https://medium.com/s2wlab/case-analysis-of-suncrypt-ransomware-negotiation-and-bitcoin-transaction-43a2194ac0bc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83a7c10f-9ff5-ebf9-a989-00006579d254","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/@sapphirex00/diving-into-the-sun-suncrypt-a-new-neighbour-in-the-ransomware-mafia-d89010c9df83","pattern":"[url:value = 'https://medium.com/@sapphirex00/diving-into-the-sun-suncrypt-a-new-neighbour-in-the-ransomware-mafia-d89010c9df83']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bac5fa5b-3121-dfbf-108e-000091c2bb4d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cdn.pathfactory.com/assets/10555/contents/394789/0dd521f8-aa64-4517-834e-bc852e9ab95d.pdf","pattern":"[url:value = 'https://cdn.pathfactory.com/assets/10555/contents/394789/0dd521f8-aa64-4517-834e-bc852e9ab95d.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acf2d34b-b815-4d6d-a477-0000711f22cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.minerva-labs.com/suncrypt-ransomware-gains-new-abilities-in-2022","pattern":"[url:value = 'https://blog.minerva-labs.com/suncrypt-ransomware-gains-new-abilities-in-2022']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89f17907-faa2-7be2-4235-0000c57e5397","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tetradefense.com/incident-response-services/cause-and-effect-suncrypt-ransomware-analysis","pattern":"[url:value = 'https://www.tetradefense.com/incident-response-services/cause-and-effect-suncrypt-ransomware-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4064d4f3-8740-a3ca-4a68-0000ec7f2d3d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityboulevard.com/2020/09/the-curious-case-of-suncrypt/","pattern":"[url:value = 'https://securityboulevard.com/2020/09/the-curious-case-of-suncrypt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f55a313-00ad-0107-bc96-0000743d1249","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-sheds-light-on-the-maze-ransomware-cartel/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-sheds-light-on-the-maze-ransomware-cartel/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dd87e3e-4000-128c-3d58-0000e33783e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.acronis.com/en-us/blog/posts/suncrypt-adopts-attacking-techniques-netwalker-and-maze-ransomware","pattern":"[url:value = 'https://www.acronis.com/en-us/blog/posts/suncrypt-adopts-attacking-techniques-netwalker-and-maze-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd92f40d-823c-ae08-2c82-0000927f00d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/s/suncrypt/maze-cartel/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/s/suncrypt/maze-cartel/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--147e697e-5f27-8400-f3b8-0000a99b8c35","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/egregor-ransomware-gang-arrested-in-ukraine/","pattern":"[url:value = 'https://www.zdnet.com/article/egregor-ransomware-gang-arrested-in-ukraine/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d59dc993-5619-dfad-1000-00009fa5c02c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/k/egregor-ransomware-emerges-as-maze-shuts-down-operations.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/k/egregor-ransomware-emerges-as-maze-shuts-down-operations.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bdda3bf-8aba-ffa5-950b-0000473cbd5b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/egregor-ransomware-linked-to-maze-arrests-made-in-ukraine/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/egregor-ransomware-linked-to-maze-arrests-made-in-ukraine/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8515322c-2ccd-dfa5-6c3b-0000458c4a35","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/egregor","pattern":"[url:value = 'https://www.ransomlook.io/group/egregor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8889a89c-5401-9ecb-928f-0000f2c509d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cybersecuritynews.com/egregor-ransomware/","pattern":"[url:value = 'https://cybersecuritynews.com/egregor-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--378985e6-d033-b6e8-d78c-00008b89be01","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/crytek-hit-by-egregor-ransomware-ubisoft-data-leaked/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/crytek-hit-by-egregor-ransomware-ubisoft-data-leaked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--497eb1ee-3f8d-4a8f-29ad-00001d697b8f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.appgate.com/news-press/appgate-labs-analyzes-new-family-of-ransomware-egregor","pattern":"[url:value = 'https://www.appgate.com/news-press/appgate-labs-analyzes-new-family-of-ransomware-egregor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d022dd69-84a3-5378-c937-000052864f67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://2kjpox12cnap3zv36440iue7-wpengine.netdna-ssl.com/wp-content/uploads/2020/10/egregor-ransom-demanding-message.png","pattern":"[url:value = 'https://2kjpox12cnap3zv36440iue7-wpengine.netdna-ssl.com/wp-content/uploads/2020/10/egregor-ransom-demanding-message.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c478aa0-1f77-eb17-ca97-000004dabc50","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2020/september/25/egregor.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2020/september/25/egregor.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfdaec0d-f48a-8d8e-6f99-00002509af8b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: RECOVER-FILES.txt","pattern":"[domain-name:value = 'RECOVER-FILES.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9afcff15-cbdb-fdbc-d470-0000c9b467ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://egregornews.com","pattern":"[url:value = 'http://egregornews.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a69471d2-18b4-7b75-a35d-0000bb3dbbbc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://egregoranrmzapcv.onion/","pattern":"[url:value = 'http://egregoranrmzapcv.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc1f6b3a-4d82-a6f7-043e-0000d68b9aad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ech0raix","pattern":"[url:value = 'https://www.ransomlook.io/group/ech0raix']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90299737-984a-8aa4-d11d-0000a9e0329a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.qnap.com/en/security-advisory/QSA-20-02","pattern":"[url:value = 'https://www.qnap.com/en/security-advisory/QSA-20-02']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb1dd121-0c27-17cc-5d56-000036dcf115","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intezer.com/blog/malware-analysis/when-viruses-mutate-did-suncrypt-ransomware-evolve-from-qnapcrypt","pattern":"[url:value = 'https://www.intezer.com/blog/malware-analysis/when-viruses-mutate-did-suncrypt-ransomware-evolve-from-qnapcrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c06d602b-1be5-fb2b-f934-000096909a2d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers/","pattern":"[url:value = 'https://www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44e9a983-9240-7466-ae9e-0000b116bd4f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intezer.com/blog-russian-cybercrime-group-fullofdeep-behind-qnapcrypt-ransomware-campaigns/","pattern":"[url:value = 'https://www.intezer.com/blog-russian-cybercrime-group-fullofdeep-behind-qnapcrypt-ransomware-campaigns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c781959-5510-3615-0e6c-000052c500cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ibm.com/downloads/cas/Z81AVOY7","pattern":"[url:value = 'https://www.ibm.com/downloads/cas/Z81AVOY7']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7776eb4b-9a41-2578-3084-00008c55d9d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08660d12-317c-dd41-4cb6-0000faab8898","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/ech0raix-ransomware-soho/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/ech0raix-ransomware-soho/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3b076e7-a8b4-bc41-70e9-0000eadfeeb4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought","pattern":"[url:value = 'https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58093cb9-355b-39ea-5b74-000034d64132","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://documents.trendmicro.com/assets/pdf/wp-backing-your-backup-defending-nas-devices-against-evolving-threats.pdf","pattern":"[url:value = 'https://documents.trendmicro.com/assets/pdf/wp-backing-your-backup-defending-nas-devices-against-evolving-threats.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb8ab57a-ffb5-1baf-6055-000039cf9810","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.netlab.360.com/qnap-nas-users-make-sure-you-check-your-system/","pattern":"[url:value = 'https://blog.netlab.360.com/qnap-nas-users-make-sure-you-check-your-system/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ef1e5b3-9867-1be5-5147-0000daddc08a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.anomali.com/blog/the-ech0raix-ransomware","pattern":"[url:value = 'https://www.anomali.com/blog/the-ech0raix-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac076a47-f989-3975-5391-000080d5c8c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ongoing-ech0raix-ransomware-campaign-targets-qnap-nas-devices/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ongoing-ech0raix-ransomware-campaign-targets-qnap-nas-devices/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4686c8f5-ec1e-7ed9-6e17-000040818f80","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://duckduckgo.com/html?q=tor+browser+how+to\\n\\nDo","pattern":"[url:value = 'https://duckduckgo.com/html?q=tor+browser+how+to\\\\n\\\\nDo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8a827df-35bb-6e13-8b4e-0000706baed4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sg3dwqfpnr4sl5hh.onion/order/[Bitcoin","pattern":"[url:value = 'http://sg3dwqfpnr4sl5hh.onion/order/[Bitcoin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0444ec16-c7be-3e9b-8669-00006fa7a301","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/large-scale-snake-ransomware-campaign-targets-healthcare-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/large-scale-snake-ransomware-campaign-targets-healthcare-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--758066b2-dc81-f2b4-c201-0000ecb320a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tripwire.com/state-of-security/security-data-protection/massive-spike-in-snake-ransomware-activity-attributed-to-new-campaign/","pattern":"[url:value = 'https://www.tripwire.com/state-of-security/security-data-protection/massive-spike-in-snake-ransomware-activity-attributed-to-new-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9da2e0f-4880-34eb-d53f-0000922b30bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybersecurity-insiders.com/meet-the-snake-ransomware-which-encrypts-all-connected-devices/","pattern":"[url:value = 'https://www.cybersecurity-insiders.com/meet-the-snake-ransomware-which-encrypts-all-connected-devices/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7cb136c-be08-bb96-8698-0000d8e22da7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/s/SNAKE/may-2020-campaign/snake-ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/s/SNAKE/may-2020-campaign/snake-ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d6816c1-30e6-7cc2-1625-000078d15ef7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Decrypt-Your-Files.txt","pattern":"[domain-name:value = 'Decrypt-Your-Files.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2629a330-a0a7-64a8-ae48-00001785d75e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b509f0f1-b04b-0d7f-2418-00002d1005e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/changed-mbrlocker-screen.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/changed-mbrlocker-screen.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--446936e0-6c1d-a1e5-9311-0000e0e6ddc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/mbr-locker.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/mbr-locker.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a80fa79e-d00f-b29a-c622-00007202e743","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99e8dba3-8484-3153-eef5-0000270dd9ab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: CoronaVirus.txt","pattern":"[domain-name:value = 'CoronaVirus.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40b9b9a8-8e74-07a1-bfc0-0000a4a757ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/mespinoza","pattern":"[url:value = 'https://www.ransomlook.io/group/mespinoza']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eec49744-0f1f-04d5-6747-000021ec7a28","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/pysa","pattern":"[url:value = 'https://www.ransomlook.io/group/pysa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ae3a07c-4b4c-0aed-e804-00003e99db3b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/france-warns-of-new-ransomware-gang-targeting-local-governments/","pattern":"[url:value = 'https://www.zdnet.com/article/france-warns-of-new-ransomware-gang-targeting-local-governments/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b52f887a-7a56-85f4-5fc3-0000f59b8787","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/","pattern":"[url:value = 'https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4d1556a-6fb1-bc85-3658-0000872e40df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.prodaft.com/resource/detail/pysa-ransomware-group-depth-analysis","pattern":"[url:value = 'https://www.prodaft.com/resource/detail/pysa-ransomware-group-depth-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4de2cee-5a73-2d69-2344-00000f502ccd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.prodaft.com/m/reports/PYSA_TLPWHITE_3.0.pdf","pattern":"[url:value = 'https://www.prodaft.com/m/reports/PYSA_TLPWHITE_3.0.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--919b1d6e-23fd-e761-fa96-00002e8e85c5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.lacework.com/blog/pysa-ransomware-gang-adds-linux-support/","pattern":"[url:value = 'https://www.lacework.com/blog/pysa-ransomware-gang-adds-linux-support/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fea7a643-63ea-4de7-518a-000036455bed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/threat-analysis-report-inside-the-destructive-pysa-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/threat-analysis-report-inside-the-destructive-pysa-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dc4d446-d732-2fce-2e5c-0000f93cb263","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d206d27-21f0-32bb-751c-000022492064","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/gasket-and-magicsocks-tools-install-mespinoza-ransomware/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/gasket-and-magicsocks-tools-install-mespinoza-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6651c884-fe06-8b59-9a31-00000d05cab0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/inversecos/status/1456486725664993287","pattern":"[url:value = 'https://twitter.com/inversecos/status/1456486725664993287']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6a74fb7-1a2b-5041-e543-00000b34c87c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/campuscodi/status/1347223969984897026","pattern":"[url:value = 'https://twitter.com/campuscodi/status/1347223969984897026']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8454c049-3802-2d2c-67ac-00002cc1b1c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2019/10/mespinoza-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2019/10/mespinoza-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--617fdc0d-dc94-a127-1097-000011993022","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://dissectingmalwa.re/another-one-for-the-collection-mespinoza-pysa-ransomware.html","pattern":"[url:value = 'https://dissectingmalwa.re/another-one-for-the-collection-mespinoza-pysa-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c9ed419-9f46-989c-3018-000015626345","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat","pattern":"[url:value = 'https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b85f5f6-6985-9c05-39b4-0000b1262810","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cyble.com/2021/11/29/pysa-ransomware-under-the-lens-a-deep-dive-analysis/","pattern":"[url:value = 'https://blog.cyble.com/2021/11/29/pysa-ransomware-under-the-lens-a-deep-dive-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f07ea253-8e03-94f9-7fb1-0000b10057e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-spotlight/2021/03/pysa-the-ransomware-attacking-schools","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-spotlight/2021/03/pysa-the-ransomware-attacking-schools']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f64a212a-f9a8-e327-2a11-0000db3a3b03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2021/210316.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2021/210316.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a700adb8-d273-663d-b35b-000024922805","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-002.pdf","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-002.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--baf32d87-3262-f1db-0b20-00001492b158","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/cti/CERTFR-2020-CTI-002/","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/cti/CERTFR-2020-CTI-002/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85229cda-b49d-1f9f-32a9-00007cfc713f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=ransom:win32/wadhrama.c&ThreatID=2147730655","pattern":"[url:value = 'https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=ransom:win32/wadhrama.c&ThreatID=2147730655']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14fe34e2-64d9-f8e2-45ac-0000bf3f6d98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/removal-guides/17016-razor-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/17016-razor-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebd20387-0ac7-8dde-6ca9-000053fca87b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/images/stories/screenshots202002/razor-ransom-note.jpg","pattern":"[url:value = 'https://www.pcrisk.com/images/stories/screenshots202002/razor-ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5a2f98c-a887-91e7-2cc9-0000af0815f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: www.youtube.com","pattern":"[domain-name:value = 'www.youtube.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20cd387a-e435-114e-f13a-0000202bb3d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: jxmpp.jp","pattern":"[domain-name:value = 'jxmpp.jp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0dd33e3-2825-8efd-9200-000094694275","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: 1.jpg.razor","pattern":"[domain-name:value = '1.jpg.razor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc65e7d9-9bbf-80cb-72d7-00005ac9bb21","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.knowbe4.com/bart-ransomware","pattern":"[url:value = 'https://www.knowbe4.com/bart-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97e47dbe-c2e5-6e33-fda9-00000640b7f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/robinhood","pattern":"[url:value = 'https://www.ransomlook.io/group/robinhood']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2363b04-3799-9e68-0fe4-000000779701","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/","pattern":"[url:value = 'https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5799cfed-2c2d-583b-bbdc-000090fde66b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/blog/robinhood-ransomware-coolmaker-function-not-cool/","pattern":"[url:value = 'https://www.sentinelone.com/blog/robinhood-ransomware-coolmaker-function-not-cool/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5cd8692-8d4e-8385-d7f3-000082eda855","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-exploits-gigabyte-driver-to-kill-av-processes/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-exploits-gigabyte-driver-to-kill-av-processes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28d40453-d917-7a2a-4c79-00007f5e06a6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/a-closer-look-at-the-robbinhood-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/a-closer-look-at-the-robbinhood-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dac26895-a68c-0057-52dc-0000d7e07d5c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/VK_Intel/status/1121440931759128576","pattern":"[url:value = 'https://twitter.com/VK_Intel/status/1121440931759128576']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e1e9f62-fc8e-6034-fc23-0000b3f3f118","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57229bc5-4f99-f4b3-a0d8-000024c70367","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2019/06/report-no-eternal-blue-exploit-found-in-baltimore-city-ransomware/","pattern":"[url:value = 'https://krebsonsecurity.com/2019/06/report-no-eternal-blue-exploit-found-in-baltimore-city-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfe2d641-a1f7-ac31-9a2c-00001c48434b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://goggleheadedhacker.com/blog/post/12","pattern":"[url:value = 'https://goggleheadedhacker.com/blog/post/12']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55df4ed8-16ea-cbed-275c-00000f7a8cbd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.quickheal.com/a-new-ransomware-goodwill-hacks-the-victims-for-charity-read-more-to-know-more-about-this-ransomware-and-how-it-affects-its-victims/","pattern":"[url:value = 'https://blogs.quickheal.com/a-new-ransomware-goodwill-hacks-the-victims-for-charity-read-more-to-know-more-about-this-ransomware-and-how-it-affects-its-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70b1565c-ffae-485f-c300-0000c157ebc2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://arstechnica.com/information-technology/2019/05/baltimore-city-government-hit-by-robbinhood-ransomware/","pattern":"[url:value = 'https://arstechnica.com/information-technology/2019/05/baltimore-city-government-hit-by-robbinhood-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3db341d1-b496-6797-8a1b-0000c33786e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/megacortex","pattern":"[url:value = 'https://www.ransomlook.io/group/megacortex']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da01fbc8-c4b4-1332-5b1c-0000eb858a6c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.quickheal.com/first-node-js-based-ransomware-nodera/","pattern":"[url:value = 'https://blogs.quickheal.com/first-node-js-based-ransomware-nodera/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95b36c63-0fff-cbc9-76c4-000025c7f6df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://exchange.xforce.ibmcloud.com/collection/6f18908ce6d9cf4efb551911e00d9ec4","pattern":"[url:value = 'https://exchange.xforce.ibmcloud.com/collection/6f18908ce6d9cf4efb551911e00d9ec4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19e20373-da83-871a-1cc5-0000c7e84329","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://bartblaze.blogspot.com/2020/01/satan-ransomware-rebrands-as-5ss5c.html","pattern":"[url:value = 'https://bartblaze.blogspot.com/2020/01/satan-ransomware-rebrands-as-5ss5c.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85756ce6-5cf0-e654-291f-0000b03e4821","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://1.bp.blogspot.com/-T0B4txHlNHs/Xh4-raVFVtI/AAAAAAAACTE/R-YoW8QHFLsuD140AF9vD-_rOifULExUgCLcBGAsYHQ/s1600/note.PNG","pattern":"[url:value = 'https://1.bp.blogspot.com/-T0B4txHlNHs/Xh4-raVFVtI/AAAAAAAACTE/R-YoW8QHFLsuD140AF9vD-_rOifULExUgCLcBGAsYHQ/s1600/note.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb574f52-d66d-2079-b1c7-000019a02826","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://bartblaze.blogspot.com/2018/08/mafia-ransomware-targeting-users-in.html","pattern":"[url:value = 'https://bartblaze.blogspot.com/2018/08/mafia-ransomware-targeting-users-in.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ee8ac0f-1023-6617-a978-000053499b22","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/06/kingouroboros-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/06/kingouroboros-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bb497df-9d35-87d4-4efe-0000f175b6fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: king.ouroboros","pattern":"[domain-name:value = 'king.ouroboros']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e9584a5-51cf-68b3-5009-0000f44fe02f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/blackmailware-found-on-porn-site-threatens-to-report-users-are-spreading-child-porn/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/blackmailware-found-on-porn-site-threatens-to-report-users-are-spreading-child-porn/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ab4540a-18ec-e27e-c829-0000eb3a2fb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/malware/b/blackmailware/pornblackmailer/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/malware/b/blackmailware/pornblackmailer/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a427301-6a8d-1d39-d33d-00006974252a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/clop","pattern":"[url:value = 'https://www.ransomlook.io/group/clop']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b46e55e6-8cf5-4e61-6de3-000034df0c46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/","pattern":"[url:value = 'https://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4a16aeb-cfaa-4de4-e597-00006f026a68","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/croatias-largest-petrol-station-chain-impacted-by-cyber-attack/","pattern":"[url:value = 'https://www.zdnet.com/article/croatias-largest-petrol-station-chain-impacted-by-cyber-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca918cb9-cb47-b4ce-22b1-00002ec7f46e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=PqGaZgepNTE","pattern":"[url:value = 'https://www.youtube.com/watch?v=PqGaZgepNTE']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5445c201-150c-3500-d4b1-00000ace2f1e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.vice.com/en/article/wx5eyx/meet-the-ransomware-gang-behind-one-of-the-biggest-supply-chain-hacks-ever","pattern":"[url:value = 'https://www.vice.com/en/article/wx5eyx/meet-the-ransomware-gang-behind-one-of-the-biggest-supply-chain-hacks-ever']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da3c9ce2-5976-11e4-6e51-0000ac8bf82b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-clop","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-clop']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf2d70f9-93d3-093c-f0f2-0000248328bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.telekom.com/en/blog/group/article/inside-of-cl0p-s-ransomware-operation-615824","pattern":"[url:value = 'https://www.telekom.com/en/blog/group/article/inside-of-cl0p-s-ransomware-operation-615824']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71079008-f917-388e-1f6b-000015400bde","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40374ee8-5e67-f55b-41d7-000085c00372","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.splunk.com/en_us/blog/security/clop-ransomware-detection-threat-research-release-april-2021.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/clop-ransomware-detection-threat-research-release-april-2021.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a4baf58-c8c1-da39-30cc-00005e4802b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shifruvalnika-ta-nanesenni-inozemnim-kompaniyam-piv-milyarda-dolariv-zbitkiv/","pattern":"[url:value = 'https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shifruvalnika-ta-nanesenni-inozemnim-kompaniyam-piv-milyarda-dolariv-zbitkiv/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d04ea03-c77b-96fa-3056-000055cc24e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-c26daec604da4db6b3c93e26e6c7aa26","pattern":"[url:value = 'https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-c26daec604da4db6b3c93e26e6c7aa26']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d57c5f78-e2c6-aed0-bb12-0000ca04001f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-English-088056baf01242409a6e9f844f0c5f2e","pattern":"[url:value = 'https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-English-088056baf01242409a6e9f844f0c5f2e']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6279953a-94c2-f0a5-0325-0000f865924d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hornetsecurity.com/en/security-information/clop-clop-ta505-html-malspam-analysis/","pattern":"[url:value = 'https://www.hornetsecurity.com/en/security-information/clop-clop-ta505-html-malspam-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2ed1662-4277-b93b-d8a9-00007d067150","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do","pattern":"[url:value = 'https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c47aef5-25e1-ba35-1c41-00009f45b19d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0d09ca9-ded7-19a2-507c-000079f83453","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52800b78-a0dc-bd97-dfa6-0000a0d826ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cf0b987-7939-bce5-7f29-000098b6af7a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/cti/CERTFR-2019-CTI-009/","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/cti/CERTFR-2019-CTI-009/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--438d1804-2f44-e449-dbf4-0000e26d8af5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.carbonblack.com/blog/cb-tau-threat-intelligence-notification-cryptomix-clop-ransomware-disables-startup-repair-removes-edits-shadow-volume-copies/","pattern":"[url:value = 'https://www.carbonblack.com/blog/cb-tau-threat-intelligence-notification-cryptomix-clop-ransomware-disables-startup-repair-removes-edits-shadow-volume-copies/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a1960dc-2e3f-8b56-b22a-000071734a17","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.boho.or.kr/filedownload.do?attach_file_seq=2808&attach_file_id=EpF2808.pdf","pattern":"[url:value = 'https://www.boho.or.kr/filedownload.do?attach_file_seq=2808&attach_file_id=EpF2808.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ade9fb4b-82a6-bbe6-9772-0000a6274588","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ta505-hackers-behind-maastricht-university-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ta505-hackers-behind-maastricht-university-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75ae80a4-ef2e-b12c-497c-000020eaa6c3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-gang-urges-victims-customers-to-demand-a-ransom-payment/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-gang-urges-victims-customers-to-demand-a-ransom-payment/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2fe80be-e038-6700-ef8d-00005a30d156","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-gang-says-they-stole-2-million-credit-cards-from-e-land/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-gang-says-they-stole-2-million-credit-cards-from-e-land/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7480cb2-5011-4b8a-81f0-0000e61ee9c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/indiabulls-group-hit-by-clop-ransomware-gets-24h-leak-deadline/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/indiabulls-group-hit-by-clop-ransomware-gets-24h-leak-deadline/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--372a6fc5-40c5-dbf3-0693-00005accaf8c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/cryptomix-clop-ransomware-says-its-targeting-networks-not-computers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/cryptomix-clop-ransomware-says-its-targeting-networks-not-computers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61cae541-2b2e-262a-d105-0000dd968e3f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-is-back-hits-21-victims-in-a-single-month/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-is-back-hits-21-victims-in-a-single-month/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0792e734-ae15-b784-f89f-0000d82a9fa6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.binance.com/en/blog/421499824684902240/Binance-Helps-Take-Down-Cybercriminal-Ring-Laundering-%24500M-in-Ransomware-Attacks","pattern":"[url:value = 'https://www.binance.com/en/blog/421499824684902240/Binance-Helps-Take-Down-Cybercriminal-Ring-Laundering-%24500M-in-Ransomware-Attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5439492c-3989-1d64-c9b4-0000bb9f863a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/darb0ng/status/1338692764121251840","pattern":"[url:value = 'https://twitter.com/darb0ng/status/1338692764121251840']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ce24441-cd93-3f25-84aa-00005f3fab20","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/ukrainian-police-arrest-clop-ransomware-members-seize-server-infrastructure/","pattern":"[url:value = 'https://therecord.media/ukrainian-police-arrest-clop-ransomware-members-seize-server-infrastructure/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c45e91c0-b2ad-cb4d-ae1f-000081501482","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/clop-ransomware/","pattern":"[url:value = 'https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/clop-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e600d86-5ad8-bc72-6231-0000e9d23da7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/modern-ransomware-groups-ttps/106824/","pattern":"[url:value = 'https://securelist.com/modern-ransomware-groups-ttps/106824/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e20fe161-5a41-bba1-06f8-00006ab93b67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/@Sebdraven/unpacking-clop-416b83718e0f","pattern":"[url:value = 'https://medium.com/@Sebdraven/unpacking-clop-416b83718e0f']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c829cf7-fb9e-f4c0-bdcb-00009abf07bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf","pattern":"[url:value = 'https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--034c9c81-dc85-dfa9-50b8-0000b61ffcb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.sentinelone.com/breaking-ta505s-crypter-with-an-smt-solver/","pattern":"[url:value = 'https://labs.sentinelone.com/breaking-ta505s-crypter-with-an-smt-solver/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51afd6d6-42ee-64ed-aa2c-0000ec79d09d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2021/06/ukrainian-police-nab-six-tied-to-clop-ransomware/","pattern":"[url:value = 'https://krebsonsecurity.com/2021/06/ukrainian-police-nab-six-tied-to-clop-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be94e901-70ce-5ebd-8a2d-00008d6a30df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Clop.md","pattern":"[url:value = 'https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Clop.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ecffd9e-46d1-1f58-2567-0000a93290bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/albertzsigovits/malware-notes/blob/master/Clop.md","pattern":"[url:value = 'https://github.com/albertzsigovits/malware-notes/blob/master/Clop.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bce15e46-c7e6-58ae-771b-000073541654","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/Tera0017/TAFOF-Unpacker","pattern":"[url:value = 'https://github.com/Tera0017/TAFOF-Unpacker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1576752b-fbec-cbe2-6562-00002b40b500","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://asec.ahnlab.com/wp-content/uploads/2021/01/Analysis_ReportCLOP_Ransomware.pdf","pattern":"[url:value = 'https://asec.ahnlab.com/wp-content/uploads/2021/01/Analysis_ReportCLOP_Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88cadd12-3b2d-19b6-c673-0000a4f3a2c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://asec.ahnlab.com/en/19542/","pattern":"[url:value = 'https://asec.ahnlab.com/en/19542/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7109a2ff-0dbf-cde5-035b-0000af0317fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://actu.fr/normandie/rouen_76540/une-rancon-apres-cyberattaque-chu-rouen-ce-reclament-pirates_29475649.html","pattern":"[url:value = 'https://actu.fr/normandie/rouen_76540/une-rancon-apres-cyberattaque-chu-rouen-ce-reclament-pirates_29475649.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4683f401-3ef1-c021-fbb6-0000f1d5d9fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/clop-ransomware","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/clop-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e74f40c-c42e-953e-5095-0000dad42d18","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/malwarebytes-news/2021/02/clop-targets-execs-ransomware-tactics-get-another-new-twist","pattern":"[url:value = 'https://blog.malwarebytes.com/malwarebytes-news/2021/02/clop-targets-execs-ransomware-tactics-get-another-new-twist']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1d39f83-22fe-3528-a891-0000fe06f51d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http:///2vi357dgf4246nvrcsavrt5jsrm7pfqim4t2n3ykzedjim5bzqezmlyd.onion","pattern":"[url:value = 'http:///2vi357dgf4246nvrcsavrt5jsrm7pfqim4t2n3ykzedjim5bzqezmlyd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6e5ad83-a0f8-f0a6-638e-0000dccc34f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://htmxyptur5wfjrd7uvg23snupub2pbtlfelk45n37b3augl2w4eearid.onion/remote0/","pattern":"[url:value = 'http://htmxyptur5wfjrd7uvg23snupub2pbtlfelk45n37b3augl2w4eearid.onion/remote0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d507acf-5de6-0816-3f9c-0000d03e5426","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://frgp3f3u2ddafv4ny7tqn6tc674m6fyymyywoaxot7xskbjmiyhhsyqd.onion/","pattern":"[url:value = 'http://frgp3f3u2ddafv4ny7tqn6tc674m6fyymyywoaxot7xskbjmiyhhsyqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2eeae0e-3775-245c-07f6-000089de366e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://l4rdimrqyonulqjttebry4t6wuzgjv5m62rnpjho3q22a6maf6d5evyd.onion/","pattern":"[url:value = 'http://l4rdimrqyonulqjttebry4t6wuzgjv5m62rnpjho3q22a6maf6d5evyd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--387f43d3-eb98-5bb1-1b18-00006057be94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6v4q5w7di74grj2vtmikzgx2tnq5eagyg2cubpcnqrvvee2ijpmprzqd.onion/remote0/","pattern":"[url:value = 'http://6v4q5w7di74grj2vtmikzgx2tnq5eagyg2cubpcnqrvvee2ijpmprzqd.onion/remote0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98e31dd2-fd5b-c537-77f2-0000bc147bb6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://npkoxkuygikbkpuf5yxte66um727wmdo2jtpg2djhb2e224i4r25v7ad.onion","pattern":"[url:value = 'http://npkoxkuygikbkpuf5yxte66um727wmdo2jtpg2djhb2e224i4r25v7ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--518a8aae-43d2-0f68-5c50-0000eb912f6a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qahjimrublt35jlv4teesicrw6zhpwhkb6nhtonwxuqafmjhr7hax2id.onion/","pattern":"[url:value = 'http://qahjimrublt35jlv4teesicrw6zhpwhkb6nhtonwxuqafmjhr7hax2id.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--959c77a3-91a4-b168-9867-0000b68f965c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://amnwxasjtjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onion/","pattern":"[url:value = 'http://amnwxasjtjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32e4b739-1764-5a67-b330-0000d32f859d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://3ws3t4uo7fehnn4qpmadk3zjrxta5xlt3gsc5mx4sztrsy7ficuz5ayd.onion/","pattern":"[url:value = 'http://3ws3t4uo7fehnn4qpmadk3zjrxta5xlt3gsc5mx4sztrsy7ficuz5ayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f076140b-cd8e-c8ed-2f99-00006feba9e3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/ftcode","pattern":"[url:value = 'https://www.ransomlook.io/group/ftcode']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--094a077e-c102-3b65-d336-000073513eb4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ftcode","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ftcode']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--970ea2f7-5ab2-bb28-83ba-00003f74d300","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://exchange.xforce.ibmcloud.com/collection/FTCODE-Ransomware-45dacdc2d5cf30722ced20b9d37988c2","pattern":"[url:value = 'https://exchange.xforce.ibmcloud.com/collection/FTCODE-Ransomware-45dacdc2d5cf30722ced20b9d37988c2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--300e1752-7d77-9ea8-c5e9-0000797516d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.certego.net/en/news/malware-tales-ftcode/","pattern":"[url:value = 'https://www.certego.net/en/news/malware-tales-ftcode/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9af98c10-ecef-3567-b545-0000bb077bbb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qvo5sd7p5yazwbrgioky7rdu4vslxrcaeruhjr7ztn3t2pihp56ewlqd.onion/","pattern":"[url:value = 'http://qvo5sd7p5yazwbrgioky7rdu4vslxrcaeruhjr7ztn3t2pihp56ewlqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed3886ae-33eb-17e1-c4ee-0000624bb27a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65bd25a8-b1f8-02cc-2e13-00007e3e56c5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4ebff1b200b-pi","pattern":"[url:value = 'https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4ebff1b200b-pi']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--882d959e-443d-d440-b49b-00004a12f2f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/maze","pattern":"[url:value = 'https://www.ransomlook.io/group/maze']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfe34dda-94e4-e222-a542-000008bc770d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/ransomware-gang-publishes-tens-of-gbs-of-internal-data-from-lg-and-xerox/","pattern":"[url:value = 'https://www.zdnet.com/article/ransomware-gang-publishes-tens-of-gbs-of-internal-data-from-lg-and-xerox/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42d66519-282d-42ea-1f49-000090bb3510","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zataz.com/cyber-attaque-a-lencontre-des-serveurs-de-bouygues-construction/","pattern":"[url:value = 'https://www.zataz.com/cyber-attaque-a-lencontre-des-serveurs-de-bouygues-construction/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2759d466-62bc-ad4f-d6b9-00004fcf1b50","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4033b114-0e0d-a8f1-d5ec-0000ad57b0ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.telsy.com/wp-content/uploads/Maze_Vaccine.pdf","pattern":"[url:value = 'https://www.telsy.com/wp-content/uploads/Maze_Vaccine.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8f6953c-a3dc-0ed5-dc1c-000081ef70e4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/gold-village","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/gold-village']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df724bf4-acf1-24e6-a266-0000eb3d18a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks-part-ii/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks-part-ii/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab66e61-e5b1-1678-cfaf-0000641fb453","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96d7680f-291d-d77d-fb31-00004ab9a4dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.docdroid.net/dUpPY5s/maze.pdf","pattern":"[url:value = 'https://www.docdroid.net/dUpPY5s/maze.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcc6afb3-efe2-0eba-2324-000068f6c298","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/maze-ransomware-deobfuscation/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/maze-ransomware-deobfuscation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b018c6c-81bb-8e73-9697-0000558a9030","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cityofpensacola.com/DocumentCenter/View/18879/Deloitte-Executive-Summary-PDF","pattern":"[url:value = 'https://www.cityofpensacola.com/DocumentCenter/View/18879/Deloitte-Executive-Summary-PDF']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2846b2fc-8cb8-ece0-023e-000001e4e7ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-007/","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-007/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28f5a16e-077c-a0a2-9a86-0000ccf42897","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.brighttalk.com/webcast/7451/408167/navigating-maze-analysis-of-a-rising-ransomware-threat","pattern":"[url:value = 'https://www.brighttalk.com/webcast/7451/408167/navigating-maze-analysis-of-a-rising-ransomware-threat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3343ebb1-620a-a1cf-0546-000062b5ebb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/escape-from-the-maze/","pattern":"[url:value = 'https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/escape-from-the-maze/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51ee6a59-e897-ab77-13cf-00004fbb1c92","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8398781-0c2c-0f09-2de8-00003f46b245","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/maze-ransomware-releases-files-stolen-from-city-of-pensacola/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/maze-ransomware-releases-files-stolen-from-city-of-pensacola/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2362e6a3-94a8-d528-0d4d-000084d0f2aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/maze-ransomware-now-encrypts-via-virtual-machines-to-evade-detection/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/maze-ransomware-now-encrypts-via-virtual-machines-to-evade-detection/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29a0bdf7-cd27-e15f-1ba2-0000c34053cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3458e046-23ac-5120-825d-0000bbaf9ec2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1299eab5-0efe-49d3-ff14-00001aa149c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85bb113b-7ced-971d-23a9-0000d322064e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/data-leak-marketplaces-aim-to-take-over-the-extortion-economy/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/data-leak-marketplaces-aim-to-take-over-the-extortion-economy/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a173c86-51a2-bd8f-cf8b-0000e1eedeee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/crytek-confirms-egregor-ransomware-attack-customer-data-theft/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/crytek-confirms-egregor-ransomware-attack-customer-data-theft/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef51c479-185e-e12a-3a76-00001cac65b6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d20603a-7550-f1d2-55f3-000083196eea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcf9a6e6-bc89-4d31-f7de-00006525b8b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf","pattern":"[url:value = 'https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e71954e5-97fe-0a9e-2060-0000e1e36792","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://web.archive.org/save/https://news.cognizant.com/2020-04-18-cognizant-security-update","pattern":"[url:value = 'https://web.archive.org/save/https://news.cognizant.com/2020-04-18-cognizant-security-update']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b98630ee-6a11-4239-8741-00008c97a85b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/certbund/status/1192756294307995655","pattern":"[url:value = 'https://twitter.com/certbund/status/1192756294307995655']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1f66558-f78d-7f28-5b27-0000da8df2cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://techcrunch.com/2020/03/26/chubb-insurance-breach-ransomware/","pattern":"[url:value = 'https://techcrunch.com/2020/03/26/chubb-insurance-breach-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c0400fb-e3ce-f004-c0d4-00004a8a1daa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityaffairs.co/wordpress/127826/malware/egregor-sekhmet-decryption-keys.html","pattern":"[url:value = 'https://securityaffairs.co/wordpress/127826/malware/egregor-sekhmet-decryption-keys.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc6c8ce2-5c7f-9f8c-bfab-00008d22bb98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/targeted-ransomware-encrypting-data/99255/","pattern":"[url:value = 'https://securelist.com/targeted-ransomware-encrypting-data/99255/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae34ba1f-d3eb-ba38-d9d1-0000dc9213ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/maze-ransomware/99137/","pattern":"[url:value = 'https://securelist.com/maze-ransomware/99137/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e7f254e-b4b2-452c-cd8c-0000a63b5900","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/543/original/CTIR_casestudy_1.pdf","pattern":"[url:value = 'https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/543/original/CTIR_casestudy_1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb32e62c-cf8b-3f35-2296-000005d2ff2b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://oag.ca.gov/system/files/Letter%204.pdf","pattern":"[url:value = 'https://oag.ca.gov/system/files/Letter%204.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccaec520-abf6-7d2b-0d02-00004bd8ae66","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/12/08/egregor-ransomware-mazes-heir-apparent/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/12/08/egregor-ransomware-mazes-heir-apparent/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5ae1b94-d3e5-d577-c0e8-000096341002","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/09/22/mtr-casebook-blocking-a-15-million-maze-ransomware-attack/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/09/22/mtr-casebook-blocking-a-15-million-maze-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5dc0a1d7-5554-a8db-4c9a-000050c8295e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98839d9e-c432-2f85-070e-0000b3a5f601","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://nakedsecurity.sophos.com/2020/06/04/nuclear-missile-contractor-hacked-in-maze-ransomware-attack/","pattern":"[url:value = 'https://nakedsecurity.sophos.com/2020/06/04/nuclear-missile-contractor-hacked-in-maze-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afbe91b4-a691-87dd-b181-000072a2361d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://media-exp1.licdn.com/dms/document/C4E1FAQHyhJYCWxq5eg/feedshare-document-pdf-analyzed/0?e=1584129600&v=beta&t=9wTDR-mZPDF4ET7ABNgE2ab9g8e9wxQrhXsxI1cSX8U","pattern":"[url:value = 'https://media-exp1.licdn.com/dms/document/C4E1FAQHyhJYCWxq5eg/feedshare-document-pdf-analyzed/0?e=1584129600&v=beta&t=9wTDR-mZPDF4ET7ABNgE2ab9g8e9wxQrhXsxI1cSX8U']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddd1b2a2-5fad-97f8-5be7-000009ade205","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/","pattern":"[url:value = 'https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d216dfb-22e4-aa80-09b9-0000d1dddcb6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.sentinelone.com/case-study-catching-a-human-operated-maze-ransomware-attack-in-action/","pattern":"[url:value = 'https://labs.sentinelone.com/case-study-catching-a-human-operated-maze-ransomware-attack-in-action/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a8301e6-0901-814d-c6e0-000034b30a2d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/","pattern":"[url:value = 'https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66b18220-c45d-f840-80d1-000079e87afb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://killbit.medium.com/applying-the-diamond-model-to-cognizant-msp-and-maze-ransomware-and-a-policy-assessment-498f01bd723f","pattern":"[url:value = 'https://killbit.medium.com/applying-the-diamond-model-to-cognizant-msp-and-maze-ransomware-and-a-policy-assessment-498f01bd723f']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a76fec4-0434-6541-8cf6-000051896352","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker","pattern":"[url:value = 'https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38073e04-1790-9150-5a70-00002cde6394","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2019/05/chacha-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2019/05/chacha-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9df23edd-11e3-72a3-6ca9-000063516b1d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Maze.md","pattern":"[url:value = 'https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Maze.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1da92a42-ec61-51e3-412a-00004709cb79","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/albertzsigovits/malware-notes/blob/master/Maze.md","pattern":"[url:value = 'https://github.com/albertzsigovits/malware-notes/blob/master/Maze.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70b449a6-f9bd-1f1f-86a4-0000c434e7d5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bitdefender.com/resources/files/News/CaseStudies/study/318/Bitdefender-TRR-Whitepaper-Maze-creat4351-en-EN-GenericUse.pdf","pattern":"[url:value = 'https://download.bitdefender.com/resources/files/News/CaseStudies/study/318/Bitdefender-TRR-Whitepaper-Maze-creat4351-en-EN-GenericUse.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eceed23e-003d-42ec-0293-00002e3fe53a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.quickheal.com/maze-ransomware-continues-threat-consumers/","pattern":"[url:value = 'https://blogs.quickheal.com/maze-ransomware-continues-threat-consumers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0707caa9-c940-afd7-e406-00008dae8921","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bc6bb7e-01be-20b6-ce55-0000df2f1039","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a812322a-a30f-e28e-b9e9-0000df65a309","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/2019/12/IR-Lessons-Maze.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2019/12/IR-Lessons-Maze.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29c03441-0474-f853-fd4d-0000a5609337","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.minerva-labs.com/egregor-ransomware-an-in-depth-analysis","pattern":"[url:value = 'https://blog.minerva-labs.com/egregor-ransomware-an-in-depth-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--893b47bf-31fc-f811-f421-00003447ccec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://techcrunch.com/2020/11/02/maze-ransomware-group-shutting-down","pattern":"[url:value = 'https://techcrunch.com/2020/11/02/maze-ransomware-group-shutting-down']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b300556-81cf-d850-970c-0000c7e9d32e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/maze-ransomware-now-delivered-by-spelevo-exploit-kit/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/maze-ransomware-now-delivered-by-spelevo-exploit-kit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15b4a177-d7c4-b80c-9783-0000ded8c153","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.maze","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.maze']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d39e44c8-0cfc-3797-fdec-0000e868b6c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://mazenews.top","pattern":"[url:value = 'http://mazenews.top']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f32dc05-b93f-c52c-af2e-000017e75cd9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://Newsmaze.top","pattern":"[url:value = 'http://Newsmaze.top']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77052d5d-dc35-f25c-8d73-0000c052565a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://xjypo5vzgmo7jca6b322dnqbsdnp3amd24ybx26x5nxbusccjkm4pwid.onion/","pattern":"[url:value = 'http://xjypo5vzgmo7jca6b322dnqbsdnp3amd24ybx26x5nxbusccjkm4pwid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c285771b-e59c-d7ac-7c43-000019a99163","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://dnspexdevfbct2agyu3oxrmhm4ggf4ec6iwpnlb3kwb2rigrtuz3sayd.onion/","pattern":"[url:value = 'http://dnspexdevfbct2agyu3oxrmhm4ggf4ec6iwpnlb3kwb2rigrtuz3sayd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7389c79-221c-0901-c91e-00005aa06b3e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://mazedecrypt.top/","pattern":"[url:value = 'https://mazedecrypt.top/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--609890be-6e26-8f69-810b-0000b42307b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://aoacugmutagkwctu.onion/","pattern":"[url:value = 'http://aoacugmutagkwctu.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7314b2c-4b79-38da-0c57-000087726c29","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2019/01/unnamed-desync-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2019/01/unnamed-desync-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d02a80f-ee64-ef4d-867d-000077fa5533","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/doppelpaymer","pattern":"[url:value = 'https://www.ransomlook.io/group/doppelpaymer']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c285f544-fade-31f6-72dc-000077fc0227","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/","pattern":"[url:value = 'https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--befb9acc-139d-dc14-e01c-0000cd026330","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf","pattern":"[url:value = 'https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c86755cd-b44c-40ff-d274-0000791b1d9f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/gold-drake","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/gold-drake']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9329750b-0c45-19e5-155f-0000e8d9bf03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b3b6dde-b0f7-cdb0-d29a-00001239a1c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/research/everis-bitpaymer-ransomware-attack-analysis-dridex/","pattern":"[url:value = 'https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/research/everis-bitpaymer-ransomware-attack-analysis-dridex/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5f6da7a-fa43-9824-289e-00008219d241","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d198c6be-8be7-622e-8fd8-000058c2fddb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://nakedsecurity.sophos.com/2018/09/11/the-rise-of-targeted-ransomware/","pattern":"[url:value = 'https://nakedsecurity.sophos.com/2018/09/11/the-rise-of-targeted-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f7290c5-f436-bc93-e361-0000ac588b60","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0bc8fb9-6fe8-8ac0-030e-00004035fbc2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/account-with-admin-privileges-abused-to-install-bitpaymer-ransomware-via-psexec","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/account-with-admin-privileges-abused-to-install-bitpaymer-ransomware-via-psexec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e35b2e6-a2d5-5c8f-8b74-0000d959e1cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp","pattern":"[url:value = 'https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0955adc-fb6e-fdbd-d4b4-0000b0d45b5f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/","pattern":"[url:value = 'https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a979ec7-8ebd-1740-8da5-0000e13f6422","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/","pattern":"[url:value = 'https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--471f9af0-728e-a9be-580d-00004714595c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/a/an-overview-of-the-doppelpaymer-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/a/an-overview-of-the-doppelpaymer-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d87d64f-ed4e-35b4-3ee1-00002b0efb64","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/gold-heron","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/gold-heron']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d27fb68-76ad-bb0f-5d13-0000e0f05266","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions","pattern":"[url:value = 'https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd536e56-ef11-2fe1-de3a-0000955b5176","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot","pattern":"[url:value = 'https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d4e6d97-6262-358e-5f77-00004d1d92fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ic3.gov/Media/News/2020/201215-1.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2020/201215-1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cc297d0-e7c3-41f3-9cbc-00003295cfa3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.heise.de/news/Uniklinik-Duesseldorf-Ransomware-DoppelPaymer-soll-hinter-dem-Angriff-stecken-4908608.html","pattern":"[url:value = 'https://www.heise.de/news/Uniklinik-Duesseldorf-Ransomware-DoppelPaymer-soll-hinter-dem-Angriff-stecken-4908608.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edb0b519-499f-9cf0-08f4-0000b55234cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cf82798-011a-2777-f64a-00006ed564b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-attackers-use-your-cloud-backups-against-you/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-attackers-use-your-cloud-backups-against-you/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28221429-240d-85ce-e221-00003824ae58","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/laptop-maker-compal-hit-by-ransomware-17-million-demanded/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/laptop-maker-compal-hit-by-ransomware-17-million-demanded/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--413dfa91-567f-694a-15be-0000be9cd20e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/foxconn-electronics-giant-hit-by-ransomware-34-million-ransom/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/foxconn-electronics-giant-hit-by-ransomware-34-million-ransom/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc72be66-2909-346f-84f4-00007c6161a6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a257d15b-efa4-dbbc-15ef-0000f9b3b454","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-launches-site-to-post-victims-data/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-launches-site-to-post-victims-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1649b79-acde-6b7e-1aa3-0000773ce050","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.armor.com/resources/threat-intelligence/the-evolution-of-doppel-spider-from-bitpaymer-to-grief-ransomware/","pattern":"[url:value = 'https://www.armor.com/resources/threat-intelligence/the-evolution-of-doppel-spider-from-bitpaymer-to-grief-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae898990-5711-85f5-f7ef-00007740e576","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/vikas891/status/1385306823662587905","pattern":"[url:value = 'https://twitter.com/vikas891/status/1385306823662587905']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--090457ec-b33f-4b6e-c6a1-0000a61963e9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BrettCallow/status/1453557686830727177?s=20","pattern":"[url:value = 'https://twitter.com/BrettCallow/status/1453557686830727177?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05510338-dc32-87ce-3258-0000e94fc322","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/AltShiftPrtScn/status/1385103712918642688","pattern":"[url:value = 'https://twitter.com/AltShiftPrtScn/status/1385103712918642688']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0436e835-7013-c293-2e7c-00008fcb8eac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://techcrunch.com/2020/03/01/visser-breach/","pattern":"[url:value = 'https://techcrunch.com/2020/03/01/visser-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e51040e-beb8-fcfe-8a23-000086e8cc9c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://redcanary.com/blog/grief-ransomware/","pattern":"[url:value = 'https://redcanary.com/blog/grief-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca7a8ad0-13d6-68e5-8615-0000084398b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/operation-synctrek-e5013df8d167","pattern":"[url:value = 'https://medium.com/s2wlab/operation-synctrek-e5013df8d167']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83ccc14a-632b-2085-5cc2-0000c94825af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf","pattern":"[url:value = 'https://lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a08f89db-9160-ab0b-3d99-0000e2ec226c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://killingthebear.jorgetesta.tech/actors/evil-corp","pattern":"[url:value = 'https://killingthebear.jorgetesta.tech/actors/evil-corp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ffd31f-fe55-d7b1-3348-0000641bd885","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/ransomware-attack-access-merchants-infostealer-escrow-service/","pattern":"[url:value = 'https://intel471.com/blog/ransomware-attack-access-merchants-infostealer-escrow-service/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ddd87a6-ab7d-f7af-671f-0000a523c484","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer","pattern":"[url:value = 'https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3df741e1-b5c0-50bb-368b-000096ede6ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://apnews.com/article/virus-outbreak-elections-georgia-voting-2020-voting-c191f128b36d1c0334c9d0b173daa18c","pattern":"[url:value = 'https://apnews.com/article/virus-outbreak-elections-georgia-voting-2020-voting-c191f128b36d1c0334c9d0b173daa18c']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c18bd0a-a312-07c7-d9ff-0000bbe68857","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/doppelpaymer-continues-cause-grief-through-rebranding","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/doppelpaymer-continues-cause-grief-through-rebranding']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bffca11-14bf-aeb1-718c-0000f5855cfb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://aithority.com/security/doppelpaymer-ransomware-attack-sinks-a-global-motor-companys-20-million","pattern":"[url:value = 'https://aithority.com/security/doppelpaymer-ransomware-attack-sinks-a-global-motor-companys-20-million']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be4eb32e-bb17-3c66-afe9-00009829bf16","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--183c4904-6bc4-1b0b-d61f-0000fdab65a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a2f8ef4-27f3-520c-5876-0000486a1674","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion/","pattern":"[url:value = 'http://qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1290c6f1-4a11-0cf1-0f66-00002ddfbfd7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2019/06/freeme-freezing-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2019/06/freeme-freezing-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a5959af-466e-31ab-2287-00009583bd24","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Mr.Dec","pattern":"[domain-name:value = 'Mr.Dec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--291379dd-7f5b-e618-4fe5-00000b646085","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/05/mrdec-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/05/mrdec-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e423509-04d5-024a-7e13-0000c1449c65","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.2-spyware.com/remove-mr-dec-ransomware.html","pattern":"[url:value = 'https://www.2-spyware.com/remove-mr-dec-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a9769d1-7e98-e7a0-0907-0000a269cc3a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securitynews.sonicwall.com/xmlpost/hildacrypt-ransomware-actively-spreading-in-the-wild/","pattern":"[url:value = 'https://securitynews.sonicwall.com/xmlpost/hildacrypt-ransomware-actively-spreading-in-the-wild/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c4a2133-c687-4ee5-8995-0000c8cda346","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.acronis.com/en-us/blog/posts/meet-buran-new-delphi-ransomware-delivered-rig-exploit-kit","pattern":"[url:value = 'https://www.acronis.com/en-us/blog/posts/meet-buran-new-delphi-ransomware-delivered-rig-exploit-kit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e96cea1-d5bd-1a6e-d526-000060d9be26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/nemty","pattern":"[url:value = 'https://www.ransomlook.io/group/nemty']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01e1a349-5c99-c492-6816-0000d91ace24","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tesorion.nl/nemty-update-decryptors-for-nemty-1-5-and-1-6/","pattern":"[url:value = 'https://www.tesorion.nl/nemty-update-decryptors-for-nemty-1-5-and-1-6/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58721eef-269a-3879-dc53-00003c82fda4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tesorion.nl/en/posts/nemty-update-decryptors-for-nemty-1-5-and-1-6/","pattern":"[url:value = 'https://www.tesorion.nl/en/posts/nemty-update-decryptors-for-nemty-1-5-and-1-6/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5f20fe3-9dee-af07-8952-00008bf9a45d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf","pattern":"[url:value = 'https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ce901f1-19f2-7ea5-039d-000080bd37f8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/","pattern":"[url:value = 'https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a6a890b-4d09-6695-8cbf-0000bf050191","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/karma-ransomware-an-emerging-threat-with-a-hint-of-nemty-pedigree/","pattern":"[url:value = 'https://www.sentinelone.com/labs/karma-ransomware-an-emerging-threat-with-a-hint-of-nemty-pedigree/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25fc1e5d-3528-4c55-2bc7-0000f0587980","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/","pattern":"[url:value = 'https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04aec350-0350-cf66-c0fb-000049736178","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/","pattern":"[url:value = 'https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--749649f7-1792-6090-c550-00007c2ae2b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.lastline.com/labsblog/nemty-ransomware-scaling-up-apac-mailboxes-swarmed-dual-downloaders/","pattern":"[url:value = 'https://www.lastline.com/labsblog/nemty-ransomware-scaling-up-apac-mailboxes-swarmed-dual-downloaders/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d608f1ac-663b-92fb-e7a4-00002768b9b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fortinet.com/blog/threat-research/nemty-ransomware-early-stage-threat.html","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/nemty-ransomware-early-stage-threat.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a36e26ae-dce6-6d52-ad27-00004e44fa1c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-nemty-ransomware-may-spread-via-compromised-rdp-connections/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-nemty-ransomware-may-spread-via-compromised-rdp-connections/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0806014f-060e-d8e4-c20e-00007fc81b2f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/nemty-ransomware-gets-distribution-from-rig-exploit-kit/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/nemty-ransomware-gets-distribution-from-rig-exploit-kit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a4e0c72-2ef6-25cf-670a-00009ed2da81","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/nemty-ransomware-decryptor-released-recover-files-for-free/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/nemty-ransomware-decryptor-released-recover-files-for-free/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07a4870c-ea9c-ecb4-17e9-00005815d5b0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fake-paypal-site-spreads-nemty-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fake-paypal-site-spreads-nemty-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fa2c9ab-69e2-dca8-dc1b-000003bb5963","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nemty-ransomware-trik-botnet","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nemty-ransomware-trik-botnet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--524f29a6-96d9-5993-b92e-00008ba6a7c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/evolution-of-jsworm-ransomware/102428/","pattern":"[url:value = 'https://securelist.com/evolution-of-jsworm-ransomware/102428/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--724d0a8e-3208-660e-bc0c-0000ed5fa6f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2019-08-24-nemty-ransomware-notes.vk.raw","pattern":"[url:value = 'https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2019-08-24-nemty-ransomware-notes.vk.raw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1e3c3cc-d40c-931c-93b4-0000b5171d24","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/csis-techblog/the-nemty-affiliate-model-13f5cf7ab66b","pattern":"[url:value = 'https://medium.com/csis-techblog/the-nemty-affiliate-model-13f5cf7ab66b']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76eb6b63-cacd-caea-8992-00000f36b93d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145","pattern":"[url:value = 'https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfa839bb-3b3f-034a-9501-0000ebf4f280","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.sentinelone.com/meet-nemty-successor-nefilim-nephilim-ransomware/","pattern":"[url:value = 'https://labs.sentinelone.com/meet-nemty-successor-nefilim-nephilim-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc45d370-755c-e0cf-d476-00000c240ef1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/albertzsigovits/malware-notes/blob/master/Nemty.md","pattern":"[url:value = 'https://github.com/albertzsigovits/malware-notes/blob/master/Nemty.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8efc9bb6-3d5e-70c8-0848-0000131b2a64","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/nemty-ransomware-possibly-spreads-through-exposed-remote-desktop-connections","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/nemty-ransomware-possibly-spreads-through-exposed-remote-desktop-connections']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df648f4b-b31f-ee42-1566-00007e7d0695","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ehackingnews.com/2019/05/getcrypt-ransomware-modus-operandi-and.html","pattern":"[url:value = 'https://www.ehackingnews.com/2019/05/getcrypt-ransomware-modus-operandi-and.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5c7cf7f-c24f-7883-0864-0000e2b9f684","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/phobos","pattern":"[url:value = 'https://www.ransomlook.io/group/phobos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdf6a28d-b3da-6df4-f283-0000d57444f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/new-phobos-ransomware-exploits-weak-security-to-hit-targets-around-the-world/","pattern":"[url:value = 'https://www.zdnet.com/article/new-phobos-ransomware-exploits-weak-security-to-hit-targets-around-the-world/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49447044-6e7d-8ba1-5135-0000dd6b9c84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/revil","pattern":"[url:value = 'https://www.ransomlook.io/group/revil']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b346076c-d5a9-de7c-4df9-00006545053b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zscaler.com/blogs/security-research/kaseya-supply-chain-ransomware-attack-technical-analysis-revil-payload","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/kaseya-supply-chain-ransomware-attack-technical-analysis-revil-payload']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e30b7db0-c8fa-9c5d-6d30-00003c6b656e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/revil-ransomware-gang-launches-auction-site-to-sell-stolen-data/","pattern":"[url:value = 'https://www.zdnet.com/article/revil-ransomware-gang-launches-auction-site-to-sell-stolen-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a5c9fae-71c5-ed7b-16f3-0000b394be94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/revil-ransomware-gang-acquires-kpot-malware/","pattern":"[url:value = 'https://www.zdnet.com/article/revil-ransomware-gang-acquires-kpot-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1636f064-6ca9-a431-d3b6-000060ae5260","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=tZVFMVm5GAk","pattern":"[url:value = 'https://www.youtube.com/watch?v=tZVFMVm5GAk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d9ab80f-2625-853e-3078-0000c3ec5c14","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=l2P5CMH9TE0","pattern":"[url:value = 'https://www.youtube.com/watch?v=l2P5CMH9TE0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79bc520e-5d94-2c06-8870-0000b4b2a8ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=QYQQUUpU04s","pattern":"[url:value = 'https://www.youtube.com/watch?v=QYQQUUpU04s']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6344febf-c3db-1d51-9aac-0000c1fab55a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=P8o6GItci5w","pattern":"[url:value = 'https://www.youtube.com/watch?v=P8o6GItci5w']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e39f2416-3533-5735-23e9-00007d85f5fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=LUxOcpIRxmg","pattern":"[url:value = 'https://www.youtube.com/watch?v=LUxOcpIRxmg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e1b7c35-8199-f91a-e22b-0000df399d9d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf","pattern":"[url:value = 'https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab089c69-610e-f942-2a48-0000605ff88e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.washingtonpost.com/national-security/ransomware-fbi-revil-decryption-key/2021/09/21/4a9417d0-f15f-11eb-a452-4da5fe48582d_story.html","pattern":"[url:value = 'https://www.washingtonpost.com/national-security/ransomware-fbi-revil-decryption-key/2021/09/21/4a9417d0-f15f-11eb-a452-4da5fe48582d_story.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48a7a0e1-3465-94ef-a471-0000bae375d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/undressing-the-revil/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/undressing-the-revil/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de8adaf0-399c-17ee-b607-00003708710b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/","pattern":"[url:value = 'https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b60ad42-ee94-2c7e-0545-0000d173bfc7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d81d0f3d-2794-cea8-ce33-00003c5b43a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9dd06bb0-4df7-210f-f1b5-000031f2db9b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acf95296-8c09-7715-ba0a-00004104f42e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/h/supply-chain-attacks-from-a-managed-detection-and-response-persp.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/h/supply-chain-attacks-from-a-managed-detection-and-response-persp.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab4def9-263f-43e8-704b-00009dd4928f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/a/sodinokibi-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/a/sodinokibi-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73dae449-1549-ee69-ddff-0000d729feb0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/l/the-impact-of-modern-ransomware-on-manufacturing-networks.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/l/the-impact-of-modern-ransomware-on-manufacturing-networks.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--badf25c6-c6a2-20b0-5156-00009fcbb044","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.tgsoft.it/english/news_archivio_eng.asp?id=1004","pattern":"[url:value = 'https://www.tgsoft.it/english/news_archivio_eng.asp?id=1004']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88374223-e4e1-42fe-c5ea-0000b48f3517","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf","pattern":"[url:value = 'https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ae83e87-726e-efd5-0c43-0000ff183906","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.splunk.com/en_us/blog/security/revil-ransomware-threat-research-update-and-detections.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/revil-ransomware-threat-research-update-and-detections.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b9c4757-3d6a-02ee-3eb4-0000db047b0d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.splunk.com/en_us/blog/security/kaseya-sera-what-revil-shall-encrypt-shall-encrypt.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/kaseya-sera-what-revil-shall-encrypt-shall-encrypt.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16c8e693-52f0-08e6-fd90-000096b85df9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eb26fb4-cc89-9a3a-db74-0000f12bb634","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/research/lv-ransomware","pattern":"[url:value = 'https://www.secureworks.com/research/lv-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5f55fd6-6606-2f82-b136-00008d864b91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/blog/revil-development-adds-confidence-about-gold-southfield-reemergence?linkId=164334801","pattern":"[url:value = 'https://www.secureworks.com/blog/revil-development-adds-confidence-about-gold-southfield-reemergence?linkId=164334801']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ce47983-d087-c1ca-b6ed-00004e9f04e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/","pattern":"[url:value = 'https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a98ce7ee-7c2e-82e6-b54d-0000a23b128d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/","pattern":"[url:value = 'https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a988b417-5d9b-f492-6fb4-00008ed5905c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html","pattern":"[url:value = 'https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b0aa97-783e-0647-0816-000093a30cbc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pandasecurity.com/emailhtml/2007-CAM-RANSOMWARE-AD360-WG/2006-Report-Sodinokibi-EN.pdf","pattern":"[url:value = 'https://www.pandasecurity.com/emailhtml/2007-CAM-RANSOMWARE-AD360-WG/2006-Report-Sodinokibi-EN.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--733d1b8c-1815-e8f3-57ef-0000ed0720b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf","pattern":"[url:value = 'https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1db3375d-720e-3746-080c-0000527dba52","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.nytimes.com/2019/08/22/us/ransomware-attacks-hacking.html","pattern":"[url:value = 'https://www.nytimes.com/2019/08/22/us/ransomware-attacks-hacking.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9030b8dd-10a5-b508-16c8-00007be2f741","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.netskope.com/blog/netskope-threat-coverage-revil","pattern":"[url:value = 'https://www.netskope.com/blog/netskope-threat-coverage-revil']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c41e103-6782-b951-1560-0000b08e4800","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4c7966d-2dcc-1eaa-4703-0000966267f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.kpn.com/security-blogs/Tracking-REvil.htm","pattern":"[url:value = 'https://www.kpn.com/security-blogs/Tracking-REvil.htm']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b78438c-92cb-d6f1-ce38-000099d342a9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.kaseya.com/potential-attack-on-kaseya-vsa/","pattern":"[url:value = 'https://www.kaseya.com/potential-attack-on-kaseya-vsa/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aa804c3-f957-d58d-125b-0000dbfe8323","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.justice.gov/opa/pr/sodinokibirevil-ransomware-defendant-extradited-united-states-and-arraigned-texas","pattern":"[url:value = 'https://www.justice.gov/opa/pr/sodinokibirevil-ransomware-defendant-extradited-united-states-and-arraigned-texas']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30e205d2-5c5a-fe1a-ae79-00004908d3d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ironnet.com/blog/ransomware-graphic-blog","pattern":"[url:value = 'https://www.ironnet.com/blog/ransomware-graphic-blog']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db1b49c8-e058-eb55-98cf-0000c014bf2d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.huntress.com/blog/security-researchers-hunt-to-discover-origins-of-the-kaseya-vsa-mass-ransomware-incident","pattern":"[url:value = 'https://www.huntress.com/blog/security-researchers-hunt-to-discover-origins-of-the-kaseya-vsa-mass-ransomware-incident']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90810471-e312-8152-eea3-00005f9631eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling","pattern":"[url:value = 'https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4b823d2-e28c-3416-500f-00000168e88b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox","pattern":"[url:value = 'https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40d0f500-1e04-9859-874d-00001b6e82c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hsgac.senate.gov/media/minority-media/new-portman-report-demonstrates-threat-ransomware-presents-to-the-united-states","pattern":"[url:value = 'https://www.hsgac.senate.gov/media/minority-media/new-portman-report-demonstrates-threat-ransomware-presents-to-the-united-states']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--218d2f1f-6b12-5139-fb42-000062196632","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/","pattern":"[url:value = 'https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e656a8ee-1976-ccf5-e07e-0000b3dc7ac2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.grahamcluley.com/travelex-paid-ransom/","pattern":"[url:value = 'https://www.grahamcluley.com/travelex-paid-ransom/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d19ca5d7-9679-88c7-3802-00005679f109","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.goggleheadedhacker.com/blog/post/sodinokibi-ransomware-analysis","pattern":"[url:value = 'https://www.goggleheadedhacker.com/blog/post/sodinokibi-ransomware-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7375758-1976-3880-22ae-0000db9e54fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.goggleheadedhacker.com/blog/post/reversing-crypto-functions","pattern":"[url:value = 'https://www.goggleheadedhacker.com/blog/post/reversing-crypto-functions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f6f1c5b-6ec4-e64f-6780-0000afe5a534","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.flashpoint-intel.com/blog/revils-cryptobackdoor-con-ransomware-groups-tactics-roil-affiliates-sparking-a-fallout/","pattern":"[url:value = 'https://www.flashpoint-intel.com/blog/revils-cryptobackdoor-con-ransomware-groups-tactics-roil-affiliates-sparking-a-fallout/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2dd2eaa-de8a-0d49-4836-0000d3fc3a9f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.flashpoint-intel.com/blog/possible-universal-revil-master-key-posted-to-xss/","pattern":"[url:value = 'https://www.flashpoint-intel.com/blog/possible-universal-revil-master-key-posted-to-xss/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fa44237-320d-6d40-d558-0000c6a6fca2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.flashpoint-intel.com/blog/darkside-ransomware-links-to-revil-difficult-to-dismiss/","pattern":"[url:value = 'https://www.flashpoint-intel.com/blog/darkside-ransomware-links-to-revil-difficult-to-dismiss/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb12d48-533e-0199-6546-000016b3407c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.flashpoint-intel.com/blog/cl0p-and-revil-escalate-their-ransomware-tactics/","pattern":"[url:value = 'https://www.flashpoint-intel.com/blog/cl0p-and-revil-escalate-their-ransomware-tactics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--503bb28b-d6d3-d1d1-fb34-00007eee9481","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.flashpoint-intel.com/blog/chatter-indicates-blackmatter-as-revil-successor/","pattern":"[url:value = 'https://www.flashpoint-intel.com/blog/chatter-indicates-blackmatter-as-revil-successor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9dec83e-260d-165d-c509-0000b8cb2f08","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.europol.europa.eu/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged","pattern":"[url:value = 'https://www.europol.europa.eu/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e226268-50aa-d9b7-39c1-0000301997e9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elastic.co/blog/ransomware-interrupted-sodinokibi-and-the-supply-chain","pattern":"[url:value = 'https://www.elastic.co/blog/ransomware-interrupted-sodinokibi-and-the-supply-chain']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acd93669-aae7-8d45-296f-0000c5634ea8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elastic.co/blog/elastic-security-prevents-100-percent-of-revil-ransomware-samples?utm_content=&utm_medium=social&utm_source=twitter","pattern":"[url:value = 'https://www.elastic.co/blog/elastic-security-prevents-100-percent-of-revil-ransomware-samples?utm_content=&utm_medium=social&utm_source=twitter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca5a19e6-6c45-d6ac-1e18-000049a7f884","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.domaintools.com/resources/blog/revealing-revil-ransomware-with-domaintools-and-maltego","pattern":"[url:value = 'https://www.domaintools.com/resources/blog/revealing-revil-ransomware-with-domaintools-and-maltego']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--921a4b05-abb7-1821-7994-00001c52e863","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.documentcloud.org/documents/21505031-hgsac-staff-report-americas-data-held-hostage-032422","pattern":"[url:value = 'https://www.documentcloud.org/documents/21505031-hgsac-staff-report-americas-data-held-hostage-032422']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94c3265a-812e-3010-292e-000054eefe72","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.digitalshadows.com/blog-and-research/ransomware-as-a-service-rogue-affiliates-and-whats-next/","pattern":"[url:value = 'https://www.digitalshadows.com/blog-and-research/ransomware-as-a-service-rogue-affiliates-and-whats-next/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2eb6055c-6452-de6c-1ae5-0000cea570a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.digitalshadows.com/blog-and-research/competitions-on-russian-language-cybercriminal-forums-sharing-expertise-or-threat-actor-showboating/","pattern":"[url:value = 'https://www.digitalshadows.com/blog-and-research/competitions-on-russian-language-cybercriminal-forums-sharing-expertise-or-threat-actor-showboating/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--223a9989-6351-9923-e092-00007c1d8d62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.databreaches.net/a-former-darkside-listing-shows-up-on-revils-leak-site/","pattern":"[url:value = 'https://www.databreaches.net/a-former-darkside-listing-shows-up-on-revils-leak-site/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f968cb09-5afd-aad4-b378-000090c09937","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyjax.com/2021/07/09/revilevolution/","pattern":"[url:value = 'https://www.cyjax.com/2021/07/09/revilevolution/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--356ecd22-64b8-68c2-0606-00001be13249","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/","pattern":"[url:value = 'https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a99c622-6a66-ee04-ca1f-0000dbcc8c82","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cybereason.com/blog/cybereason-vs-revil-ransomware-the-kaseya-chronicles","pattern":"[url:value = 'https://www.cybereason.com/blog/cybereason-vs-revil-ransomware-the-kaseya-chronicles']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c00d84e8-f365-9975-051f-000072d9e584","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40e84689-7874-693d-67e2-00001260e728","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/how-falcon-complete-thwarted-a-revil-ransomware-attack/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/how-falcon-complete-thwarted-a-revil-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82c4c9b7-bda6-adf7-8e15-0000b256c717","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/how-crowdstrike-stops-revil-ransomware-from-kaseya-attack/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/how-crowdstrike-stops-revil-ransomware-from-kaseya-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b65f78b9-12f8-6db3-1608-000022cb3f1c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout","pattern":"[url:value = 'https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a46e32c-cf44-08da-398c-00002fcdbeba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware","pattern":"[url:value = 'https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaf32df2-419b-5859-5510-000046a81bf3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound","pattern":"[url:value = 'https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41e6afcb-4384-bbf1-83e4-0000097adb25","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.connectwise.com/resources/revil-profile","pattern":"[url:value = 'https://www.connectwise.com/resources/revil-profile']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b20b74bd-b580-553c-401d-0000e5714d25","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cnbc.com/2021/04/23/axis-of-revil-inside-the-hacker-collective-taunting-apple.html","pattern":"[url:value = 'https://www.cnbc.com/2021/04/23/axis-of-revil-inside-the-hacker-collective-taunting-apple.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9990eeb-c5e0-44f7-8fa6-000046917c78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.certego.net/en/news/malware-tales-sodinokibi/","pattern":"[url:value = 'https://www.certego.net/en/news/malware-tales-sodinokibi/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d46452c-5e82-2be1-51c3-0000d790a5c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0a0d768-c2c5-7ac0-623d-0000aa1d2fe6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6c59f72-93a9-8d52-b42e-0000bed459cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e89fd3b-c79a-8af0-880d-0000e93eebe5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2","pattern":"[url:value = 'https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13efd24f-d7f2-f394-91df-00000c0bd734","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.boll.ch/datasheets/WG_Threat_Report_EN.pdf","pattern":"[url:value = 'https://www.boll.ch/datasheets/WG_Threat_Report_EN.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--903ec358-d2d8-19f1-3a17-0000b76fa310","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1a4ff88-660f-d17b-1c1c-000059cf95f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-to-stop-taking-bitcoin-to-hide-money-trail/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-to-stop-taking-bitcoin-to-hide-money-trail/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ce6f547-b2b2-9c8d-1c93-0000a1018cd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-threatens-to-publish-data-of-automotive-group/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-threatens-to-publish-data-of-automotive-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6377414-bc54-a0a6-2ba0-00001cb75729","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-says-travelex-will-pay-one-way-or-another/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-says-travelex-will-pay-one-way-or-another/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9008ca18-2516-7d85-ea1f-0000d98d0000","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-publishes-stolen-data-for-the-first-time/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-publishes-stolen-data-for-the-first-time/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b00e8cc-15b7-cfab-7579-0000fa645365","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-may-tip-nasdaq-on-attacks-to-hurt-stock-prices/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-may-tip-nasdaq-on-attacks-to-hurt-stock-prices/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e41deb2-847e-0bc2-ab2b-00002cccf649","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-travelex-demands-3-million/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-travelex-demands-3-million/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db4d27a0-9777-11a4-e1b8-0000ffa6975d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-new-york-airport-systems/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-new-york-airport-systems/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad733ecf-644d-dd4d-41a5-0000e64caf85","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revils-tor-sites-come-alive-to-redirect-to-new-ransomware-operation/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revils-tor-sites-come-alive-to-redirect-to-new-ransomware-operation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aa2667f-37c1-f6b6-1d9f-0000a0a4644c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-ransomwares-servers-mysteriously-come-back-online/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-ransomwares-servers-mysteriously-come-back-online/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2906ed78-9d4f-6e42-928a-0000ac2754fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-ransomware-returns-new-malware-sample-confirms-gang-is-back/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-ransomware-returns-new-malware-sample-confirms-gang-is-back/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7abf0caa-3315-1436-2636-0000d7f27c73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-managedcom-hosting-provider-500k-ransom/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-managedcom-hosting-provider-500k-ransom/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54abc632-d8af-0c28-9eeb-00000f3d7eac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-1-000-plus-companies-in-msp-supply-chain-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-1-000-plus-companies-in-msp-supply-chain-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faa524c6-7393-cda3-2cc9-000036001967","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc72f1c8-16ee-5c43-15ae-0000d8664206","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-ransomware-gang-claims-over-100-million-profit-in-a-year/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-ransomware-gang-claims-over-100-million-profit-in-a-year/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0ac67d8-fd4d-94a9-70ea-000082303365","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-ransomware-devs-added-a-backdoor-to-cheat-affiliates/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-ransomware-devs-added-a-backdoor-to-cheat-affiliates/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad9be7bf-6080-bad3-6800-00004c96d3c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-gang-tries-to-extort-apple-threatens-to-sell-stolen-blueprints/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-gang-tries-to-extort-apple-threatens-to-sell-stolen-blueprints/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb0f4eb4-cf60-e9ea-564a-0000c8646cb3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-threatens-to-reveal-companys-dirty-secrets/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-threatens-to-reveal-companys-dirty-secrets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1769cf6d-98ea-f1f8-6dc5-0000cc750fb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6209632d-40e8-5b15-6bb9-0000f3ef10bf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-jersey-synagogue-suffers-sodinokibi-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-jersey-synagogue-suffers-sodinokibi-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d6d0f2a-766f-3686-3542-0000753787af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/kaseyas-universal-revil-decryption-key-leaked-on-a-hacking-forum/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/kaseyas-universal-revil-decryption-key-leaked-on-a-hacking-forum/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--692eb9fa-a811-7da7-cc92-0000a5f4abff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/kaseya-obtains-universal-decryptor-for-revil-ransomware-victims/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/kaseya-obtains-universal-decryptor-for-revil-ransomware-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--639e328d-7177-6fbe-2cde-0000e75c272c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fbi-revil-cybergang-behind-the-jbs-ransomware-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fbi-revil-cybergang-behind-the-jbs-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68094d4f-d2b2-9c4c-5221-0000b3bb06d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5e2c389-b09f-1c1f-cf71-0000b441629d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02f46ef2-ab12-bd4e-4d5c-00000398923e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/another-ransomware-will-now-publish-victims-data-if-not-paid/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/another-ransomware-will-now-publish-victims-data-if-not-paid/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a29cd21-91c5-fd2d-c449-0000f11f581c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/a-look-inside-the-highly-profitable-sodinokibi-ransomware-business/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/a-look-inside-the-highly-profitable-sodinokibi-ransomware-business/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--496c7628-c5d8-bc5f-5803-0000ff49a1bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf","pattern":"[url:value = 'https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01425c49-ff6b-1769-55d4-000005e1c104","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bankinfosecurity.com/interviews/ransomware-files-episode-6-kaseya-revil-i-5045","pattern":"[url:value = 'https://www.bankinfosecurity.com/interviews/ransomware-files-episode-6-kaseya-revil-i-5045']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--016c05c6-9b4e-cd81-7790-00005827766b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.appgate.com/blog/electric-company-ransomware-attack-calls-for-14-million-in-ransom","pattern":"[url:value = 'https://www.appgate.com/blog/electric-company-ransomware-attack-calls-for-14-million-in-ransom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96ca09c9-df33-dec2-34a9-0000c07b7810","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/the-dark-web-of-intrigue-how-revil-used-the-underground-ecosystem-to-form-an-extortion-cartel","pattern":"[url:value = 'https://www.advanced-intel.com/post/the-dark-web-of-intrigue-how-revil-used-the-underground-ecosystem-to-form-an-extortion-cartel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efa9cfbd-b8a6-99bb-9827-0000da98f8cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/revil-vanishes-from-underground-infrastructure-down-support-staff-adverts-silent","pattern":"[url:value = 'https://www.advanced-intel.com/post/revil-vanishes-from-underground-infrastructure-down-support-staff-adverts-silent']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3eb9fe02-1815-dfa5-e7da-0000cf7056e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/inside-revil-extortionist-machine-predictive-insights","pattern":"[url:value = 'https://www.advanced-intel.com/post/inside-revil-extortionist-machine-predictive-insights']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52d1a0d8-ebfd-2134-d1c6-0000283f7fdf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/from-qbot-with-revil-ransomware-initial-attack-exposure-of-jbs","pattern":"[url:value = 'https://www.advanced-intel.com/post/from-qbot-with-revil-ransomware-initial-attack-exposure-of-jbs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49c65fde-1067-21ac-a7e6-00003c457bc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities","pattern":"[url:value = 'https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1691e93-a701-7876-533a-0000eb0ca5f5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.acronis.com/en-sg/articles/sodinokibi-ransomware/","pattern":"[url:value = 'https://www.acronis.com/en-sg/articles/sodinokibi-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5a1b1ef-b449-3210-54ac-00000ac7de01","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion","pattern":"[url:value = 'https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68a80b93-6d7a-cc17-4378-000030dab17e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf","pattern":"[url:value = 'https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6011f2ce-fa8b-81e0-5985-0000237d5d49","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/","pattern":"[url:value = 'https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c57258be-9b33-9c7d-aecb-0000f7df513d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://vimeo.com/449849549","pattern":"[url:value = 'https://vimeo.com/449849549']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ac587cf-978b-c4c2-20cd-0000f149ac5a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://velzart.nl/blog/ransomeware/","pattern":"[url:value = 'https://velzart.nl/blog/ransomeware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb718aad-85ae-32c8-958c-0000c3b8ba4d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://us-cert.cisa.gov/ncas/alerts/aa20-345a","pattern":"[url:value = 'https://us-cert.cisa.gov/ncas/alerts/aa20-345a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b180be8-20a8-e091-8772-0000a31f8550","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/threat-brief-kaseya-vsa-ransomware-attacks/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/threat-brief-kaseya-vsa-ransomware-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6707fbb0-4116-333a-2c64-00005804160c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/revil-threat-actors/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/revil-threat-actors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a328512-81ac-c02c-37e5-000065f70f64","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://unit42.paloaltonetworks.com/prometheus-ransomware/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/prometheus-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4b050ef-7db0-66cd-3f5c-000027123c1f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/svch0st/status/1411537562380816384","pattern":"[url:value = 'https://twitter.com/svch0st/status/1411537562380816384']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b0e41a0-968e-122f-9065-000023d44bd6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/resecurity_com/status/1412662343796813827","pattern":"[url:value = 'https://twitter.com/resecurity_com/status/1412662343796813827']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bfd2e3c-df4e-3cc6-4329-0000110cdefc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/fwosar/status/1420119812815138824","pattern":"[url:value = 'https://twitter.com/fwosar/status/1420119812815138824']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--682e4365-c99b-a917-567b-0000bde85d04","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/fwosar/status/1411281334870368260","pattern":"[url:value = 'https://twitter.com/fwosar/status/1411281334870368260']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6592daa8-9a61-9319-b64d-000046cb96ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/_alex_il_/status/1412403420217159694","pattern":"[url:value = 'https://twitter.com/_alex_il_/status/1412403420217159694']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--854ebecc-11be-6d34-0e56-000087e1c5ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/VK_Intel/status/1411066870350942213","pattern":"[url:value = 'https://twitter.com/VK_Intel/status/1411066870350942213']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--383b91df-918b-7a5d-de9f-0000abf265e4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/VK_Intel/status/1374571480370061312?s=20","pattern":"[url:value = 'https://twitter.com/VK_Intel/status/1374571480370061312?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12ecd733-b47d-19d9-691c-0000b59ee3fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/SyscallE/status/1411074271875670022","pattern":"[url:value = 'https://twitter.com/SyscallE/status/1411074271875670022']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d60d10b-7f41-d291-0945-00002db23f04","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/SophosLabs/status/1413616952313004040?s=20","pattern":"[url:value = 'https://twitter.com/SophosLabs/status/1413616952313004040?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f40070b0-d8d3-cde7-b38b-00001e17c2bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/SophosLabs/status/1412056467201462276","pattern":"[url:value = 'https://twitter.com/SophosLabs/status/1412056467201462276']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a27b758e-f188-c1ce-17f1-00008a425681","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/R3MRUM/status/1412064882623713283","pattern":"[url:value = 'https://twitter.com/R3MRUM/status/1412064882623713283']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daf05c0d-d935-725f-85f5-0000571d3663","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/LloydLabs/status/1411098844209819648","pattern":"[url:value = 'https://twitter.com/LloydLabs/status/1411098844209819648']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52fbff74-8fc9-5547-dd22-00001ec55396","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/Jacob_Pimental/status/1398356030489251842?s=20","pattern":"[url:value = 'https://twitter.com/Jacob_Pimental/status/1398356030489251842?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34e228e0-8a61-73d3-56e5-00004ecdb8c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/Jacob_Pimental/status/1391055792774729728","pattern":"[url:value = 'https://twitter.com/Jacob_Pimental/status/1391055792774729728']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b4d5638-cb68-cea2-d581-00003a8236f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/revil-ransomware-executes-supply-chain-attack-via-malicious-kaseya-update/","pattern":"[url:value = 'https://therecord.media/revil-ransomware-executes-supply-chain-attack-via-malicious-kaseya-update/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b599f0cd-ddc6-252a-36af-0000f06e8a55","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/","pattern":"[url:value = 'https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac6d7878-0c74-9901-eb4e-00007a7192f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/i-scrounged-through-the-trash-heaps-now-im-a-millionaire-an-interview-with-revils-unknown/","pattern":"[url:value = 'https://therecord.media/i-scrounged-through-the-trash-heaps-now-im-a-millionaire-an-interview-with-revils-unknown/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f39ec00a-a84b-8454-95a3-000025aca986","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/","pattern":"[url:value = 'https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--977efbfb-8a21-4e7b-dccb-00000d12bd45","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/","pattern":"[url:value = 'https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--912ffcee-3443-5fed-62b0-000044d22b7d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/","pattern":"[url:value = 'https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dd1680c-734c-f36a-13f7-0000a19cbf6a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thehackernews.com/2022/03/ukrainian-hacker-linked-to-revil.html","pattern":"[url:value = 'https://thehackernews.com/2022/03/ukrainian-hacker-linked-to-revil.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--885660f4-7ded-73cc-e437-0000a14e014c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","pattern":"[url:value = 'https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60b148f6-af0c-6565-7c88-0000c1f90cbb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://tehtris.com/fr/peut-on-neutraliser-un-ransomware-lance-en-tant-que-system-sur-des-milliers-de-machines-en-meme-temps/","pattern":"[url:value = 'https://tehtris.com/fr/peut-on-neutraliser-un-ransomware-lance-en-tant-que-system-sur-des-milliers-de-machines-en-meme-temps/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8330e5b3-d7e9-f610-a7f4-000036be3261","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://teamt5.org/tw/posts/revil-dll-sideloading-technique-used-by-other-hackers/","pattern":"[url:value = 'https://teamt5.org/tw/posts/revil-dll-sideloading-technique-used-by-other-hackers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--529c7c1d-6c6d-aeaf-33fd-00009abb9c4a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://teamt5.org/en/posts/introducing-the-most-profitable-ransomware-revil/","pattern":"[url:value = 'https://teamt5.org/en/posts/introducing-the-most-profitable-ransomware-revil/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67d162b6-aebb-6ead-7eb6-000093ba2c0c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf","pattern":"[url:value = 'https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a8363e0-83b2-b3f4-8e8b-000067f57f9a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9e3d3d2-e163-a914-81ed-0000e96d8157","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/kaseya-ransomware-supply-chain","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/kaseya-ransomware-supply-chain']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a0e29f0-0ee9-5116-5beb-0000e24c8498","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://sites.temple.edu/care/ci-rw-attacks/","pattern":"[url:value = 'https://sites.temple.edu/care/ci-rw-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bf17479-e85f-3a86-5bc9-00002ebf6842","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityscorecard.com/research/a-detailed-analysis-of-the-last-version-of-revil-ransomware","pattern":"[url:value = 'https://securityscorecard.com/research/a-detailed-analysis-of-the-last-version-of-revil-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--364b6931-662e-5c8e-b217-000084ee82c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityintelligence.com/posts/sodinokibi-revil-ransomware-disrupt-trade-secrets/","pattern":"[url:value = 'https://securityintelligence.com/posts/sodinokibi-revil-ransomware-disrupt-trade-secrets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb5de569-ae77-a11b-d4f0-000085a39f1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/","pattern":"[url:value = 'https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9acf8191-0afb-cf66-cd0c-000021e4e1d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securityaffairs.co/wordpress/98694/malware/sodinokibi-kenneth-cole-data-breach.html","pattern":"[url:value = 'https://securityaffairs.co/wordpress/98694/malware/sodinokibi-kenneth-cole-data-breach.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08ba1e36-eacb-e3f5-a95b-00002b65b9c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/","pattern":"[url:value = 'https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3eb3c97c-db22-df2d-affb-0000e1cd5a95","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/","pattern":"[url:value = 'https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--559c77e8-0004-07f0-82d5-0000ca40f4bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/revil-ransomware-attack-on-msp-companies/103075/","pattern":"[url:value = 'https://securelist.com/revil-ransomware-attack-on-msp-companies/103075/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9916357d-acc2-34d7-0122-0000febac9d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/ransomware-world-in-2021/102169/","pattern":"[url:value = 'https://securelist.com/ransomware-world-in-2021/102169/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17b000e2-cfb0-7dc2-16b8-00009571f2fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://searchsecurity.techtarget.com/feature/Ransomware-negotiations-An-inside-look-at-the-process","pattern":"[url:value = 'https://searchsecurity.techtarget.com/feature/Ransomware-negotiations-An-inside-look-at-the-process']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81a84d72-fa87-b19d-401c-00003ed9e383","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf","pattern":"[url:value = 'https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1b86c6c-6278-75f5-4c6d-0000b949680e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/","pattern":"[url:value = 'https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6d9dc3b-74e6-c499-91ad-00000ecaaf0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://redcanary.com/blog/uncompromised-kaseya/","pattern":"[url:value = 'https://redcanary.com/blog/uncompromised-kaseya/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c5a84bb-dc48-aaaa-c3cc-0000e92cb186","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2022-05-01-revil-reborn-ransom.vk.cfg.txt","pattern":"[url:value = 'https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2022-05-01-revil-reborn-ransom.vk.cfg.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3779f8a-2fc0-0290-8e3a-0000206ca971","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://public.intel471.com/blog/revil-ransomware-interview-russian-osint-100-million/","pattern":"[url:value = 'https://public.intel471.com/blog/revil-ransomware-interview-russian-osint-100-million/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d5e5e5d-ff5f-79f7-b2c0-000038f9f429","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/","pattern":"[url:value = 'https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1dfd54f-f8c4-1a49-ed9c-0000659371bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/","pattern":"[url:value = 'https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1532822-b7a3-9205-5bee-000060807925","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--362348cd-7484-cc09-dbeb-0000f7c6f4f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/06/30/what-to-expect-when-youve-been-hit-with-revil-ransomware/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/06/30/what-to-expect-when-youve-been-hit-with-revil-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28363e67-8e13-e04b-5b90-0000379116c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/06/30/mtr-in-real-time-hand-to-hand-combat-with-revil-ransomware-chasing-a-2-5-million-pay-day/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/06/30/mtr-in-real-time-hand-to-hand-combat-with-revil-ransomware-chasing-a-2-5-million-pay-day/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed4f2834-dcbd-a0ab-dbae-00006c2afaa4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.sophos.com/en-us/2021/06/11/relentless-revil-revealed/","pattern":"[url:value = 'https://news.sophos.com/en-us/2021/06/11/relentless-revil-revealed/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b5a88e5-aa00-b79c-a72f-000023bbfd47","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/w4-may-en-story-of-the-week-ransomware-on-the-darkweb-5f5b8d4c3b6f","pattern":"[url:value = 'https://medium.com/s2wlab/w4-may-en-story-of-the-week-ransomware-on-the-darkweb-5f5b8d4c3b6f']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcc1f5a6-1388-deb7-52cf-0000ac2b831e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/s2wlab/deep-analysis-of-revil-ransomware-written-in-korean-d1899c0e9317","pattern":"[url:value = 'https://medium.com/s2wlab/deep-analysis-of-revil-ransomware-written-in-korean-d1899c0e9317']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e3126a2-2448-fe87-7e2d-0000bc8a4ff0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://medium.com/@underthebreach/tracking-down-revils-lalartu-by-utilizing-multiple-osint-methods-2bf3a6c65a80","pattern":"[url:value = 'https://medium.com/@underthebreach/tracking-down-revils-lalartu-by-utilizing-multiple-osint-methods-2bf3a6c65a80']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afe4333c-0239-9947-d170-00008a0b1aa4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/","pattern":"[url:value = 'https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be111666-aaf2-a64d-8075-0000ce0467a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/","pattern":"[url:value = 'https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--959548b5-0d4a-64b4-2a7d-00008f26db06","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/","pattern":"[url:value = 'https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a45f8e3a-188d-748e-5748-0000835edcec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/","pattern":"[url:value = 'https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--430a3dbe-9111-7018-1209-0000b18b3757","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/ransomware-gangs-are-starting-to-look-like-oceans-11/","pattern":"[url:value = 'https://ke-la.com/ransomware-gangs-are-starting-to-look-like-oceans-11/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd92d2da-9d23-2c58-f5de-0000d967a000","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/","pattern":"[url:value = 'https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4620c35a-4b68-acb0-ebfe-00004ee44acb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/easy-way-in-5-ransomware-victims-had-their-pulse-secure-vpn-credentials-leaked/","pattern":"[url:value = 'https://ke-la.com/easy-way-in-5-ransomware-victims-had-their-pulse-secure-vpn-credentials-leaked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b95d6e75-a437-adc4-673a-000048e884cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/darknet-threat-actors-are-not-playing-games-with-the-gaming-industry/","pattern":"[url:value = 'https://ke-la.com/darknet-threat-actors-are-not-playing-games-with-the-gaming-industry/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3046affb-c35b-1925-be90-0000fbc79d2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://kaseya.app.box.com/s/0ysvgss7w48nxh8k1xt7fqhbcjxhas40","pattern":"[url:value = 'https://kaseya.app.box.com/s/0ysvgss7w48nxh8k1xt7fqhbcjxhas40']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f6ee84b-1261-e090-a7cc-0000b414123b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf","pattern":"[url:value = 'https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dc97b42-2318-8a06-454d-0000a91bc644","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://isc.sans.edu/diary/27012","pattern":"[url:value = 'https://isc.sans.edu/diary/27012']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1700fc7b-9627-8d52-7734-000014db6cb9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://intel471.com/blog/changes-in-revil-ransomware-version-2-2","pattern":"[url:value = 'https://intel471.com/blog/changes-in-revil-ransomware-version-2-2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba9e142d-d959-4f2e-bbc6-0000fdfaf9b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf","pattern":"[url:value = 'https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aca5107b-5437-1ac7-143e-000040ac8785","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89","pattern":"[url:value = 'https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c773584c-12e2-81f9-9818-00003698c617","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf","pattern":"[url:value = 'https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b333380-8d64-e6fb-041a-00005ef85a23","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf","pattern":"[url:value = 'https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21084a1e-4a1f-307e-d16b-0000e683e448","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://hatching.io/blog/ransomware-part2","pattern":"[url:value = 'https://hatching.io/blog/ransomware-part2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9011c7fd-9519-7756-c23d-0000a761c4c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://gist.githubusercontent.com/fwosar/a63e1249bfccb8395b961d3d780c0354/raw/312b2bbc566cbee2dac7b143dc143c1913ddb729/revil.json","pattern":"[url:value = 'https://gist.githubusercontent.com/fwosar/a63e1249bfccb8395b961d3d780c0354/raw/312b2bbc566cbee2dac7b143dc143c1913ddb729/revil.json']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc7db025-4b4e-98d9-efe0-000000816240","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://f.hubspotusercontent10.net/hubfs/7095517/FLINT-Kaseya-Another%20Massive%20Heist%20by%20REvil.pdf","pattern":"[url:value = 'https://f.hubspotusercontent10.net/hubfs/7095517/FLINT-Kaseya-Another%20Massive%20Heist%20by%20REvil.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5227a3f8-ab9a-55e9-4de8-00006f813dd5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://f.hubspotusercontent10.net/hubfs/5943619/Whitepaper-Downloads/Ransomware_in_ICS_Environments_Whitepaper_10_12_20.pdf","pattern":"[url:value = 'https://f.hubspotusercontent10.net/hubfs/5943619/Whitepaper-Downloads/Ransomware_in_ICS_Environments_Whitepaper_10_12_20.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e4f3c3f-b262-311c-d691-00004ed1c2f3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://drive.google.com/file/d/1ph1E0onZ7TiNyG87k4WjofCKNuCafMLk/view","pattern":"[url:value = 'https://drive.google.com/file/d/1ph1E0onZ7TiNyG87k4WjofCKNuCafMLk/view']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2896d04b-44df-8362-f4bb-000010edd4c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf","pattern":"[url:value = 'https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a3211a5-fe59-b441-ba0d-0000b0cba8df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b","pattern":"[url:value = 'https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be84c242-251d-1021-82c5-00009471ee4b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3","pattern":"[url:value = 'https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e25a3b5-07b8-f499-ceef-0000f9cd4256","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://dissectingmalwa.re/germanwipers-big-brother-gandgrabs-kid-sodinokibi.html","pattern":"[url:value = 'https://dissectingmalwa.re/germanwipers-big-brother-gandgrabs-kid-sodinokibi.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34deb105-6007-8a15-de30-00006e08e75b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf","pattern":"[url:value = 'https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8dd2a0c8-435b-1272-0871-0000ad108dca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://community.riskiq.com/article/3315064b","pattern":"[url:value = 'https://community.riskiq.com/article/3315064b']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d9ea6c0-d9c3-94e3-4a83-00008a33764f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf","pattern":"[url:value = 'https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a9a50f0-ef5e-0c6f-85d5-0000ebd311fa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--918faca3-ffbb-d7aa-990c-000050fdcb52","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2021/11/revil-under-the-microscope","pattern":"[url:value = 'https://blogs.blackberry.com/en/2021/11/revil-under-the-microscope']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05eaf80d-2b68-4638-a89d-00006014b62b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.blackberry.com/en/2021/05/threat-thursday-dr-revil-ransomware-strikes-again-employs-double-extortion-tactics","pattern":"[url:value = 'https://blogs.blackberry.com/en/2021/05/threat-thursday-dr-revil-ransomware-strikes-again-employs-double-extortion-tactics']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2fa1ca4-8344-31c4-277c-00009118f6ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.truesec.com/2021/07/06/kaseya-vsa-zero-day-exploit","pattern":"[url:value = 'https://blog.truesec.com/2021/07/06/kaseya-vsa-zero-day-exploit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab3ed2e1-4b8e-0281-e69f-00002e3945a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/","pattern":"[url:value = 'https://blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2800a376-84c6-2fb9-f7ef-00002120be4e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.talosintelligence.com/2021/03/ctir-trends-winter-2020-21.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2021/03/ctir-trends-winter-2020-21.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95572841-0ec5-875e-50fb-00002d7cc831","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/","pattern":"[url:value = 'https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b111376-1621-b297-b341-0000af553077","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html","pattern":"[url:value = 'https://blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d049bf-59de-31fc-85df-00009d1cdad9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.morphisec.com/real-time-prevention-of-the-kaseya-vsa-supply-chain-revil-ransomware-attack","pattern":"[url:value = 'https://blog.morphisec.com/real-time-prevention-of-the-kaseya-vsa-supply-chain-revil-ransomware-attack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e9c36ba-8fc7-6679-afa9-00004c1a707c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted-with-gootkit-banker-or-revil-ransomware/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted-with-gootkit-banker-or-revil-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1388543f-e19c-a888-6879-0000e6f57452","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.intel471.com/2020/03/31/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/","pattern":"[url:value = 'https://blog.intel471.com/2020/03/31/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26d07a2a-a19e-07af-35a3-000092afc516","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.group-ib.com/REvil_RaaS","pattern":"[url:value = 'https://blog.group-ib.com/REvil_RaaS']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20de72cd-d600-8d75-46f6-00001163a43a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.gigamon.com/2021/07/08/observations-and-recommendations-from-the-ongoing-revil-kaseya-incident/","pattern":"[url:value = 'https://blog.gigamon.com/2021/07/08/observations-and-recommendations-from-the-ongoing-revil-kaseya-incident/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--377f3d23-3b51-7f0c-82fb-0000642f9933","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.amossys.fr/sodinokibi-malware-analysis.html","pattern":"[url:value = 'https://blog.amossys.fr/sodinokibi-malware-analysis.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74f11c9d-2af7-321f-b455-00002d70f1ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blag.nullteilerfrei.de/2020/02/02/defeating-sodinokibi-revil-string-obfuscation-in-ghidra/","pattern":"[url:value = 'https://blag.nullteilerfrei.de/2020/02/02/defeating-sodinokibi-revil-string-obfuscation-in-ghidra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2afdb103-d3f2-6a61-191a-0000c8e2ea85","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blag.nullteilerfrei.de/2019/11/09/api-hashing-why-and-how/","pattern":"[url:value = 'https://blag.nullteilerfrei.de/2019/11/09/api-hashing-why-and-how/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8171c422-cd0f-e1ab-66cc-0000472b8441","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://awakesecurity.com/blog/threat-hunting-for-revil-ransomware/","pattern":"[url:value = 'https://awakesecurity.com/blog/threat-hunting-for-revil-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f7a682f-5929-9e4a-cd48-0000da933db1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://asec.ahnlab.com/ko/19860/","pattern":"[url:value = 'https://asec.ahnlab.com/ko/19860/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac21cb72-0ab8-75d3-438d-0000c764e7e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://asec.ahnlab.com/ko/19640/","pattern":"[url:value = 'https://asec.ahnlab.com/ko/19640/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f936d51-8a65-3856-b2e2-0000205dd602","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://areteir.com/wp-content/uploads/2020/07/Arete_Insight_Sodino-Ransomware_June-2020.pdf","pattern":"[url:value = 'https://areteir.com/wp-content/uploads/2020/07/Arete_Insight_Sodino-Ransomware_June-2020.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a83f853a-05e1-3895-2d58-00002d186473","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=ptbNMlWxYnE","pattern":"[url:value = 'https://www.youtube.com/watch?v=ptbNMlWxYnE']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32250319-fd11-c981-6932-000087a85ae7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=mDUMpYAOMOo","pattern":"[url:value = 'https://www.youtube.com/watch?v=mDUMpYAOMOo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c80b38e7-aa1b-1b63-9b3d-0000d896e630","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf","pattern":"[url:value = 'https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70a7bd69-58cb-4cd1-6aa5-0000aaa953cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-revil","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-revil']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b792c140-6f5a-43c0-73a3-0000480cdcbe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html","pattern":"[url:value = 'https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d20a2797-3fc2-8fe4-e28e-0000363ab072","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/blog/revil-ransomware-reemerges-after-shutdown-universal-decryptor-released","pattern":"[url:value = 'https://www.secureworks.com/blog/revil-ransomware-reemerges-after-shutdown-universal-decryptor-released']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d48728d-e4ca-e8cc-04dd-000078951ff6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/","pattern":"[url:value = 'https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f523cc01-9716-db8b-084c-0000309cc65c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya","pattern":"[url:value = 'https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24f70f36-fa06-0c8a-a7ca-000070d1a7d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.flashpoint-intel.com/blog/revil-disappears-again/","pattern":"[url:value = 'https://www.flashpoint-intel.com/blog/revil-disappears-again/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67bd0942-09d9-1129-9236-0000e37a681f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.flashpoint-intel.com/blog/interview-with-revil-affiliated-ransomware-contractor/","pattern":"[url:value = 'https://www.flashpoint-intel.com/blog/interview-with-revil-affiliated-ransomware-contractor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f1bfa55-576b-24cd-c6a0-0000fa376941","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fincen.gov/sites/default/files/advisory/2021-11-08/FinCEN%20Ransomware%20Advisory_FINAL_508_.pdf","pattern":"[url:value = 'https://www.fincen.gov/sites/default/files/advisory/2021-11-08/FinCEN%20Ransomware%20Advisory_FINAL_508_.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19e6fdd0-2365-7d24-feef-00009184a83a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin","pattern":"[url:value = 'https://www.fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3488509-a814-4dfc-a353-0000c554db2e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment","pattern":"[url:value = 'https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--090be021-347f-8dc3-aecf-000004554314","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide","pattern":"[url:value = 'https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5cad7f1-5db4-06ab-51b1-0000f5b824ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.digitalshadows.com/blog-and-research/revil-analysis-of-competing-hypotheses/","pattern":"[url:value = 'https://www.digitalshadows.com/blog-and-research/revil-analysis-of-competing-hypotheses/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--538523a5-1ef6-f998-f350-000008bedab8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.darktrace.com/en/blog/staying-ahead-of-r-evils-ransomware-as-a-service-business-model/","pattern":"[url:value = 'https://www.darktrace.com/en/blog/staying-ahead-of-r-evils-ransomware-as-a-service-business-model/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6f5df24-1b23-2c2d-9f46-000000457467","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.darkowl.com/blog-content/page-not-found-revil-darknet-services-offline-after-attack-last-weekend","pattern":"[url:value = 'https://www.darkowl.com/blog-content/page-not-found-revil-darknet-services-offline-after-attack-last-weekend']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f23949f5-b6ac-b457-2bd5-000039c78823","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b67d6dd-e016-fd32-094b-000075937534","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed8fea3d-54f2-b736-5b89-00000153b657","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1374b975-c9e8-2528-ddf6-0000c4234fd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.br.de/nachrichten/deutschland-welt/mutmasslicher-ransomware-millionaer-identifiziert","pattern":"[url:value = 'https://www.br.de/nachrichten/deutschland-welt/mutmasslicher-ransomware-millionaer-identifiziert']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50d207d0-7976-43d6-15d0-00005e6355f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revil-ransomware-shuts-down-again-after-tor-sites-were-hijacked/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revil-ransomware-shuts-down-again-after-tor-sites-were-hijacked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93ebecca-f2c8-a53b-718e-0000ad5dd1bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bbc.com/news/technology-59297187","pattern":"[url:value = 'https://www.bbc.com/news/technology-59297187']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcf546a0-bd77-3722-c372-000046faf602","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/storm-in-safe-haven-takeaways-from-russian-authorities-takedown-of-revil","pattern":"[url:value = 'https://www.advintel.io/post/storm-in-safe-haven-takeaways-from-russian-authorities-takedown-of-revil']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1341fbe-a270-a1da-02e1-0000d7586c7e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom","pattern":"[url:value = 'https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee8fe91d-e0e5-85be-da75-00001233a377","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://us-cert.cisa.gov/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa","pattern":"[url:value = 'https://us-cert.cisa.gov/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21135179-3567-515e-5f24-000088483b9b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/VK_Intel/status/1409601311092490248?s=20","pattern":"[url:value = 'https://twitter.com/VK_Intel/status/1409601311092490248?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d4a7c25-599e-fbf9-9e2e-0000df735f8c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/VK_Intel/status/1409601311092490248","pattern":"[url:value = 'https://twitter.com/VK_Intel/status/1409601311092490248']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0a9f629-6c0d-de64-9a90-00002e066566","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/IntezerLabs/status/1452980772953071619","pattern":"[url:value = 'https://twitter.com/IntezerLabs/status/1452980772953071619']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b64ec1cb-71c5-2ef9-3899-00002a09b621","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/AdamTheAnalyst/status/1409499591452639242?s=20","pattern":"[url:value = 'https://twitter.com/AdamTheAnalyst/status/1409499591452639242?s=20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--975882fb-361e-83b7-f932-000021e2fa07","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/ransomware-revil-sites-disappears/167745/","pattern":"[url:value = 'https://threatpost.com/ransomware-revil-sites-disappears/167745/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c4bfa30-4702-d335-4baf-0000df40310d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://threatpost.com/linux-variant-ransomware-vmwares-nas/167511/","pattern":"[url:value = 'https://threatpost.com/linux-variant-ransomware-vmwares-nas/167511/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76a515d9-95dd-ce9c-2f90-0000e727fa14","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/us-arrests-and-charges-ukrainian-man-for-kaseya-ransomware-attack/","pattern":"[url:value = 'https://therecord.media/us-arrests-and-charges-ukrainian-man-for-kaseya-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a7b5014-281e-e54c-04a1-00009235bb78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://storage.courtlistener.com/recap/gov.uscourts.txnd.352371/gov.uscourts.txnd.352371.1.0_1.pdf","pattern":"[url:value = 'https://storage.courtlistener.com/recap/gov.uscourts.txnd.352371/gov.uscourts.txnd.352371.1.0_1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9be3fdac-7fa7-fd24-ae2a-0000bc05cd03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://storage.courtlistener.com/recap/gov.uscourts.txnd.351760/gov.uscourts.txnd.351760.1.0_3.pdf","pattern":"[url:value = 'https://storage.courtlistener.com/recap/gov.uscourts.txnd.351760/gov.uscourts.txnd.351760.1.0_3.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7602c113-d520-6b2c-daf9-0000d6f9dfd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://russian.rt.com/russia/article/926347-barnaulec-rozysk-fbr-kibermoshennichestvo","pattern":"[url:value = 'https://russian.rt.com/russia/article/926347-barnaulec-rozysk-fbr-kibermoshennichestvo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b56e4e16-0c1b-d89d-165f-0000282db40d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v","pattern":"[url:value = 'https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15442487-9d0b-55e6-2ea8-000090552c91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://otx.alienvault.com/pulse/60da2c80aa5400db8f1561d5","pattern":"[url:value = 'https://otx.alienvault.com/pulse/60da2c80aa5400db8f1561d5']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d010806f-9342-7142-93ca-000091c9414c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malienist.medium.com/revix-linux-ransomware-d736956150d0","pattern":"[url:value = 'https://malienist.medium.com/revix-linux-ransomware-d736956150d0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a34e1856-b620-36c8-5db2-00008f38e3c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/","pattern":"[url:value = 'https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84c0789b-2957-dc69-9ce1-000079b22375","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ke-la.com/will-the-revils-story-finally-be-over/","pattern":"[url:value = 'https://ke-la.com/will-the-revils-story-finally-be-over/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93f50769-997b-ec69-ff49-000031e625c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://home.treasury.gov/news/press-releases/jy0471","pattern":"[url:value = 'https://home.treasury.gov/news/press-releases/jy0471']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--414a58a3-fe75-6e26-67fa-0000cb23d904","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/f0wl/REconfig-linux","pattern":"[url:value = 'https://github.com/f0wl/REconfig-linux']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d0bea43-8d87-f8ba-65ae-0000b5e9b4c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf","pattern":"[url:value = 'https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12355f07-bd21-fa09-308a-00009aa9d681","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://diicot.ro/mass-media/3341-comunicat-de-presa-2-08-11-2021","pattern":"[url:value = 'https://diicot.ro/mass-media/3341-comunicat-de-presa-2-08-11-2021']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5c52ac6-8f39-534f-817a-0000e531558e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/","pattern":"[url:value = 'https://cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceb29a9b-8980-ae9a-50aa-0000abf1a241","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version","pattern":"[url:value = 'https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b1f0abc-7e0b-20db-490b-00004fd5a7ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html","pattern":"[url:value = 'https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0416197b-b20d-7a08-9e55-0000c306de52","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://angle.ankura.com/post/102hcny/revix-linux-ransomware","pattern":"[url:value = 'https://angle.ankura.com/post/102hcny/revix-linux-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0facf5a6-a7da-56c3-0605-00009f289e48","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://analyst1.com/file-assets/History-of-REvil.pdf","pattern":"[url:value = 'https://analyst1.com/file-assets/History-of-REvil.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--220aaa0d-6dc3-fa12-5ee8-000048936ba2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html","pattern":"[url:value = 'http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b4ee9c-3417-8c93-a90e-00000c8ead45","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.theverge.com/2021/7/22/22589643/ransomware-kaseya-vsa-decryptor-revil","pattern":"[url:value = 'https://www.theverge.com/2021/7/22/22589643/ransomware-kaseya-vsa-decryptor-revil']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b30824ff-556a-540d-f09f-0000b5dd1864","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.macrumors.com/2021/04/26/revil-delists-stolen-apple-schematics-threat","pattern":"[url:value = 'https://www.macrumors.com/2021/04/26/revil-delists-stolen-apple-schematics-threat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2af63c5e-1617-af3c-b8b3-0000b57968e8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/revil-ransomware-group-resurfaces-after-brief-hiatus","pattern":"[url:value = 'https://www.zdnet.com/article/revil-ransomware-group-resurfaces-after-brief-hiatus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6e0c5a7-cf28-3b18-0492-00003ec6cf9e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://landxxeaf2hoyl2jvcwuazypt6imcsbmhb7kx3x33yhparvtmkatpaad.onion/","pattern":"[url:value = 'http://landxxeaf2hoyl2jvcwuazypt6imcsbmhb7kx3x33yhparvtmkatpaad.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e84f3df1-1c17-4df2-15a0-0000ccfb481e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ttn4gqpgvyy6tuezexxhwiukmm2t6zzawj6p3w3jprve36f43zxr24qd.onion","pattern":"[url:value = 'http://ttn4gqpgvyy6tuezexxhwiukmm2t6zzawj6p3w3jprve36f43zxr24qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e367b1e8-9143-58e8-d167-00007d8faf57","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rrjwr4jsju3nuwjz77hbcquiuq5hc3oc7yxlgi5rxeazehf7mlkzcvid.onion","pattern":"[url:value = 'http://rrjwr4jsju3nuwjz77hbcquiuq5hc3oc7yxlgi5rxeazehf7mlkzcvid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17f7acfb-d7ee-6e2f-694b-00006c8c4dd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://fsgwyl2xd2h5s43er7epr6vuqu5eddmmtgp6cq7khmkoe3ba4d37w7ad.onion","pattern":"[url:value = 'http://fsgwyl2xd2h5s43er7epr6vuqu5eddmmtgp6cq7khmkoe3ba4d37w7ad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--609a17f2-ae7d-7e81-16ad-0000576f1cbc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://65x5syrn4gmgfnicrhyfwkokw5x3xipxer2z4vhhckrh756v6m5272qd.onion","pattern":"[url:value = 'http://65x5syrn4gmgfnicrhyfwkokw5x3xipxer2z4vhhckrh756v6m5272qd.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aedc386-ba1f-9c2f-bbc2-00002fa238be","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://54xj22qsftuzs6bhcistgz27reblgijdjggkgb3fdhfgl3ghkmzk7dad.onion","pattern":"[url:value = 'http://54xj22qsftuzs6bhcistgz27reblgijdjggkgb3fdhfgl3ghkmzk7dad.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f021c72-3f0a-7abc-7283-0000ab7ac5fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://2wub3njb7zvmnn6xohbuizjcbvy4w5dvlb4puesry3rrl6gx4452ezid.onion","pattern":"[url:value = 'http://2wub3njb7zvmnn6xohbuizjcbvy4w5dvlb4puesry3rrl6gx4452ezid.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c78e704b-5026-c5b4-4d86-0000ad86f099","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion/Blog","pattern":"[url:value = 'http://blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion/Blog']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--380ac774-d3a5-91bc-3758-0000c3e02d8d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/elf.cr1ptt0r","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/elf.cr1ptt0r']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c3dc39f-f025-dfe6-5364-0000ba8672d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.coveware.com/blog/2019/3/13/cr1ptt0r-ransomware-targets-nas-devices-with-old-firmware","pattern":"[url:value = 'https://www.coveware.com/blog/2019/3/13/cr1ptt0r-ransomware-targets-nas-devices-with-old-firmware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e0b1e7e-e588-2cac-f2bf-0000e98ae63d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/removal-guides/12121-planetary-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/12121-planetary-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00104817-a81c-3090-5c2c-0000c8082532","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.2-spyware.com/remove-bigbobross-ransomware.html","pattern":"[url:value = 'https://www.2-spyware.com/remove-bigbobross-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9587aa1a-ce1e-355e-48d8-0000c2f3217d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malware.wikia.org/wiki/Tellyouthepass","pattern":"[url:value = 'https://malware.wikia.org/wiki/Tellyouthepass']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48d0f439-2b60-e40b-6edd-000029cf6d94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://spyware-techie.com/blackworm-ransomware-removal-guide","pattern":"[url:value = 'https://spyware-techie.com/blackworm-ransomware-removal-guide']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbeeaa5c-a6c9-f6bb-34a3-0000828a09ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fortinet.com/blog/threat-research/analysis-of-new-globeimposter-ransomware-variant.html","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/analysis-of-new-globeimposter-ransomware-variant.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a9e32ad-831e-c27a-21f8-0000df1161a5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/jokeroo-ransomware-as-a-service-offers-multiple-membership-packages/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/jokeroo-ransomware-as-a-service-offers-multiple-membership-packages/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--951f1a7d-241a-3620-e730-0000c9e7b2e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Exploit.in","pattern":"[domain-name:value = 'Exploit.in']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41762c2e-2d8e-9a75-590c-000046f291a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/ransomware-as-a-service-princess-evolution-looking-for-affiliates/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/ransomware-as-a-service-princess-evolution-looking-for-affiliates/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b54b6b78-fd6d-0067-80fa-000021ba343c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: MALXMR.TIDBF","pattern":"[domain-name:value = 'MALXMR.TIDBF']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08a56095-c455-2648-4423-0000ccef037d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/lockergoga","pattern":"[url:value = 'https://www.ransomlook.io/group/lockergoga']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08353ef5-d6be-9813-9bcc-0000500f2bc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-lockergoga-ransomware-allegedly-used-in-altran-attack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-lockergoga-ransomware-allegedly-used-in-altran-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f9380b9-f59e-7edb-8959-00006c7cdaeb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/u/1100723/Ransomware/LockerGoga-ransom-note.png","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/u/1100723/Ransomware/LockerGoga-ransom-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--248b837e-0986-11e9-c423-000065db67fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: README-NOW.txt","pattern":"[domain-name:value = 'README-NOW.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e45d8ed-b48f-27d2-e1e2-00001a1bfc7b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acaf4ce9-df91-38b6-f430-000048e0105d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/wp-content/uploads/2019/01/RansomeNote-fig4.png","pattern":"[url:value = 'https://www.crowdstrike.com/blog/wp-content/uploads/2019/01/RansomeNote-fig4.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e8f90f9-450b-af8f-c731-000042251944","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/wp-content/uploads/2019/01/RansomeNote-fig3.png","pattern":"[url:value = 'https://www.crowdstrike.com/blog/wp-content/uploads/2019/01/RansomeNote-fig3.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c81029b-bb7a-5026-4096-0000bee048f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: RyukReadMe.txt","pattern":"[domain-name:value = 'RyukReadMe.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--241b5685-f0e8-cdad-3352-0000750cafdf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1072907748155842565","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1072907748155842565']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3664d7da-fc04-76ed-f34d-0000bb7b7b7d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: openme.txt","pattern":"[domain-name:value = 'openme.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75813e06-2b7e-7724-2e63-00002b8191a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GrujaRS/status/1072468548977680385","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1072468548977680385']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14aa0ccb-00d5-e2d8-2836-0000f33a39e1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/DuIsIoWXQAEGKlr.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DuIsIoWXQAEGKlr.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09bc603a-38ab-a451-a073-0000c30f8720","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: TERAZ.txt","pattern":"[domain-name:value = 'TERAZ.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53f6093f-1945-8877-fe36-00005e5d0b30","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1072164314608480257","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1072164314608480257']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ad1dd70-3cd4-ff95-ce4b-00004e91f308","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: n3.Then","pattern":"[domain-name:value = 'n3.Then']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40f33bb5-b008-ccfb-2f48-0000df1621d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: n2.We","pattern":"[domain-name:value = 'n2.We']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d137e744-4b34-7ce9-4207-00004823d2a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: n1.Send","pattern":"[domain-name:value = 'n1.Send']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bacfd3b-cf84-6fb2-6ca4-0000a23a3fb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=uHYY6XZZEw4","pattern":"[url:value = 'https://www.youtube.com/watch?v=uHYY6XZZEw4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--711a9d7a-9502-83f5-6bfb-0000949da574","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-14th-2018-slow-week/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-14th-2018-slow-week/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbc78494-0497-56f3-49bb-000054835f65","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GrujaRS/status/1071349228172124160","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1071349228172124160']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--872dd21d-5dcf-abb8-22db-000016598ee2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/Dt4xTDjWwAEBjBh.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Dt4xTDjWwAEBjBh.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac94bdc4-078a-3442-583b-0000c4d9fc36","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1071123090564923393","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1071123090564923393']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3efeb02c-5002-cc27-0386-00007be18bb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://ccrypt.sourceforge.net/","pattern":"[url:value = 'http://ccrypt.sourceforge.net/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5fd3392-1bda-2331-8c69-00003d86c274","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=iB019lDvArs","pattern":"[url:value = 'https://www.youtube.com/watch?v=iB019lDvArs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46e593ba-49b8-b3c5-5992-0000b6b3f100","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GrujaRS/status/1071153192975642630","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1071153192975642630']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e88f31b-977d-3a22-7621-000038f7b04d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/Dt1_DpMXcAMC8J_[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/Dt1_DpMXcAMC8J_[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dd8a028-569f-9ca9-3366-0000e427b484","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/Emm_ADC_Soft/status/1071716275590782976","pattern":"[url:value = 'https://twitter.com/Emm_ADC_Soft/status/1071716275590782976']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48566fba-2c51-8d95-6bc9-00005cd2bd89","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/petrovic082/status/1071003939015925760","pattern":"[url:value = 'https://twitter.com/petrovic082/status/1071003939015925760']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0093cb39-c676-7268-26be-00009ec457ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/14/Dt-APfCW0AADWV8[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/14/Dt-APfCW0AADWV8[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e65bce0c-6640-3616-48d9-000054acce90","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/Dtz4PD2WoAIWtRv.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Dtz4PD2WoAIWtRv.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3dff046-1124-c229-9b32-000082b19ae7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/1069905624954269696","pattern":"[url:value = 'https://twitter.com/struppigel/status/1069905624954269696']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd3aeddd-1076-2078-0e87-00005cfbb703","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/DtkQKCDWoAM13kD[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/DtkQKCDWoAM13kD[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--032c0e32-0d25-ca6b-1903-00007fc2353e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GrujaRS/status/1070011234521673728","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1070011234521673728']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50dcbaec-27ad-77c0-ae62-0000c5c1b4f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=QevoUzbqNTQ","pattern":"[url:value = 'https://www.youtube.com/watch?v=QevoUzbqNTQ']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc80abef-fd15-cbf2-8368-0000f683348d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-7th-2018-wechat-ransomware-scammers-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-7th-2018-wechat-ransomware-scammers-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e062096-b136-de0e-58fb-0000710f0045","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/DtlxfFsW4AAs-Co.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DtlxfFsW4AAs-Co.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14d6a951-c55b-157c-b1e1-0000897d717c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/Dtlxf0eW4AAJCdZ[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/Dtlxf0eW4AAJCdZ[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--804972c3-3dc5-6834-2c11-000075968f77","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/chinese-police-arrest-dev-behind-unnamed1989-wechat-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/chinese-police-arrest-dev-behind-unnamed1989-wechat-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36808c55-02df-ebea-73a6-0000e48ffda4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-infects-100k-pcs-in-china-demands-wechat-payment/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-infects-100k-pcs-in-china-demands-wechat-payment/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c382edb0-958c-bc9e-b7c8-0000d94ed4d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1067109661076262913","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1067109661076262913']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f7c6f5a-c9aa-4628-13bb-00002e8ba4c8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=_aaFon7FVbc","pattern":"[url:value = 'https://www.youtube.com/watch?v=_aaFon7FVbc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86aadfb2-17ca-cfa8-7bce-0000020ffc70","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GrujaRS/status/1066799421080461312","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1066799421080461312']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a007b82-a78a-3e23-8f26-0000da0c2a37","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-30th-2018-indictments-sanctions-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-30th-2018-indictments-sanctions-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f9ed170-ba90-9e54-d30d-00002f13676c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/Ds4IYbfWsAECNuJ.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Ds4IYbfWsAECNuJ.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9651ad0-11bb-df92-d0f1-0000f40a1f5b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/Ds4IKL3X4AIHKrj.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Ds4IKL3X4AIHKrj.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d49bb5ca-78ff-a575-0543-0000962146dd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/30/Ds4IYbfWsAECNuJ[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/30/Ds4IYbfWsAECNuJ[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c32584f-6b8b-2495-0abc-000035050993","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1066099799705960448","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1066099799705960448']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f16bb300-c1b1-c87f-e1be-0000e1fe00f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/petrovic082/status/1065223932637315074","pattern":"[url:value = 'https://twitter.com/petrovic082/status/1065223932637315074']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5417dea-341f-f298-84d5-0000cb496680","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsuMFrZW0AIIUXs[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsuMFrZW0AIIUXs[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48af93a3-9fd2-4f66-a69c-0000334dc17f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsiUA0LXgAAoqkd[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsiUA0LXgAAoqkd[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e94862c6-34a1-3781-02c5-00004e986f32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GrujaRS/status/1063930127610986496","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1063930127610986496']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d00de7-5e28-b7cb-e6e1-00006ba62fd0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsPVGaHXcAAtnXz[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsPVGaHXcAAtnXz[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8c62398-1226-a02a-eb61-0000cbd8bcca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1063769884608348160","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1063769884608348160']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fb1c560-bb8f-ed16-4319-0000b64a2ed0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/vapor.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/vapor.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc0fcf34-23b4-a327-c8a5-00000bc9de4e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1060921043957755904","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1060921043957755904']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73558c68-ecad-e06b-3f05-00003e85ad79","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/DrkmCriWwAMCdqF.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DrkmCriWwAMCdqF.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd426c14-4ff7-1333-b267-0000bec34ae8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1059470985055875074","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1059470985055875074']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b121c25-a00a-312c-f6f2-0000f76ce8a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: aboutYourFiles.txt","pattern":"[domain-name:value = 'aboutYourFiles.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba4e8a5b-8730-a5c9-fa7f-0000c4979813","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1058775145005887489","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1058775145005887489']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8df1e56-8675-f3be-ea16-00005e6ae7de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/9/moira.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/9/moira.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c70f0125-c638-d801-395d-00004354edb2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GrujaRS/status/1040677247735279616","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1040677247735279616']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01ac2852-2a54-fbfe-fc39-00001973fe18","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/1039077365039673344","pattern":"[url:value = 'https://twitter.com/siri_urz/status/1039077365039673344']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce361947-66b3-521b-292f-0000d519e2a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/september/14/mvp.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/september/14/mvp.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e274860-bcd5-8526-961f-0000210bfe66","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-pretends-to-be-proton-security-team-securing-data-from-hackers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-pretends-to-be-proton-security-team-securing-data-from-hackers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0be8710-9875-4b12-7eb1-0000b04b7609","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1049325784979132417","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1049325784979132417']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8749f18b-3c7f-f0a5-e695-0000a4ec994f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: readmy.txt","pattern":"[domain-name:value = 'readmy.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5737aa16-36cf-73d8-f55e-000000886b57","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1048616343975682048","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1048616343975682048']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c54722d-982b-7a7a-134d-000059e3bc78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"hash_md5: 29b579fb811f05c3c334a2bd2646a27a","pattern":"[file:hashes.'MD5' = '29b579fb811f05c3c334a2bd2646a27a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bb555e1-866e-1b6b-f264-000020911110","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/commonransom-ransomware-demands-rdp-access-to-decrypt-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/commonransom-ransomware-demands-rdp-access-to-decrypt-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f394dfa-461e-02e9-15da-000056f70a67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/c/CommonRansom/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/c/CommonRansom/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87751e69-52bf-209e-436e-0000ef1934d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: nuke.africa","pattern":"[domain-name:value = 'nuke.africa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4887a2ca-2c5b-b479-d4b1-000087a39e98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/file-locker-ransomware-targets-korean-victims-and-asks-for-50k-won/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/file-locker-ransomware-targets-korean-victims-and-asks-for-50k-won/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11b55d56-046d-5381-404c-0000285973a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/f/file-locker/ransom-note%20-%20Copy.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/f/file-locker/ransom-note%20-%20Copy.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--340f1332-b2d9-68a9-0fe4-000022c92867","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.localbitcoins.com/","pattern":"[url:value = 'http://www.localbitcoins.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5d4368a-4ef1-f242-7c92-000010765ce5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-pushing-the-savefiles-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-pushing-the-savefiles-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd44c6b8-8b95-1faf-4fe5-0000d32a1f8a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-9th-2018-mostly-dharma-variants/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-9th-2018-mostly-dharma-variants/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2afc681d-d132-a009-7938-0000f9a72a3f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/MarceloRivero/status/1059575186117328898","pattern":"[url:value = 'https://twitter.com/MarceloRivero/status/1059575186117328898']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cb021f7-8d59-7adf-d7eb-0000030386d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/kraken-cryptor-ransomware-masquerading-as-superantispyware-security-program/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/kraken-cryptor-ransomware-masquerading-as-superantispyware-security-program/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a80756ef-7b65-6779-f192-0000244dbdea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-now-installing-the-kraken-cryptor-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-now-installing-the-kraken-cryptor-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d7256a3-8985-e903-fb19-00007da24cd8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/security/f/fallout-exploit-kit/savefiles/ransom-note-red.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/security/f/fallout-exploit-kit/savefiles/ransom-note-red.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--376926c9-6326-d406-6dae-00009db8b28e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/mongo-lock-attack-ransoming-deleted-mongodb-databases/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/mongo-lock-attack-ransoming-deleted-mongodb-databases/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b356bd64-0242-04d1-468a-0000f5e58fd5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: 8chan.co","pattern":"[domain-name:value = '8chan.co']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6409ba53-8638-d082-1691-000045125891","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Shodan.io","pattern":"[domain-name:value = 'Shodan.io']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c84678b0-2ce7-1c42-8fe6-00004971ac2d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sigma-ransomware-being-distributed-using-fake-craigslist-malspam/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sigma-ransomware-being-distributed-using-fake-craigslist-malspam/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1f22307-e5ea-8376-5127-00001c23b7bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/payment-portal.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/payment-portal.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28919f77-e4df-d01b-bfca-0000d4190e54","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/ransom-note-html-part_02.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/ransom-note-html-part_02.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f31e5a7-5090-cc6a-505e-00005a9609b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/ransom-note-html-part_01.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/ransom-note-html-part_01.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a9c2a21-ec3c-8f70-d06d-00005b2b7a24","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/1035138577934557184","pattern":"[url:value = 'https://twitter.com/siri_urz/status/1035138577934557184']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f575490-9c77-3e8f-9903-000022bda1c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/Dl2M9kdX0AAcGbJ[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/Dl2M9kdX0AAcGbJ[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c53ba40-1ee8-d13b-565a-000068a48e3e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/B_H101/status/1034379267956715520","pattern":"[url:value = 'https://twitter.com/B_H101/status/1034379267956715520']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b49e62b-d2d2-e5b3-a118-0000c74a417a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlraMbTWwAA_367[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlraMbTWwAA_367[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4b4ff2f-2058-c065-ed30-0000984fce40","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/leotpsc/status/1034346447112679430","pattern":"[url:value = 'https://twitter.com/leotpsc/status/1034346447112679430']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--625cbfce-3101-d736-8fa0-00006ec7512e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/Dlq8W3FXoAAYR1v[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/Dlq8W3FXoAAYR1v[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6294f20-117f-320c-46dd-0000f968c83e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/08/cassetto-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/08/cassetto-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5fc5888-5f7f-58a8-09ce-0000dd396648","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1034213399922524160","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1034213399922524160']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eca41f26-8a52-a129-2a36-0000d457167f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlpDe-kXsAA2lmH[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlpDe-kXsAA2lmH[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5dbd5c7-f633-a728-d9f5-00008dd8ffc8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/leotpsc/status/1033625496003731458","pattern":"[url:value = 'https://twitter.com/leotpsc/status/1033625496003731458']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e0f64fb-a0c1-12a1-a572-0000dcc96ae3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/08/creampie-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/08/creampie-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0eacf433-d001-a419-5f0b-00007debd513","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/1033656080839139333","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/1033656080839139333']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5980e56c-db2f-57f7-65b7-00007b0af33a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/08/cryptonar-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/08/cryptonar-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6381b18-200c-7e2e-068a-00006777c4b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1034492151541977088","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1034492151541977088']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f68752d-9340-1510-1aa9-0000d5c2f4fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13faf036-a3dc-f1ef-99c6-00009d442620","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8631999f-cc41-1efa-b91b-00003aa0070a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: INFORMATION.txt","pattern":"[domain-name:value = 'INFORMATION.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77436efb-6a84-1e41-e12c-000026e1b7fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: partially.cryptoNar","pattern":"[domain-name:value = 'partially.cryptoNar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a86aa34-270c-ca2b-8b2b-00003a630846","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: fully.cryptoNar","pattern":"[domain-name:value = 'fully.cryptoNar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5c7df65-51f8-66ae-693f-0000b9cac203","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/08/barack-obamas-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/08/barack-obamas-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bed09d8-0e07-4260-0068-000078950421","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/barack-obamas-blackmail-virus-ransomware-only-encrypts-exe-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/barack-obamas-blackmail-virus-ransomware-only-encrypts-exe-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--178fa125-fbec-04fc-a3ce-000000ebd2ab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1032242391665790981","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1032242391665790981']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97d6f8f1-a8d3-abf6-b273-0000f3a5408a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/b/barack-obama-ransomware/barack-obama-everlasting-blue-blackmail-virus.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/b/barack-obama-ransomware/barack-obama-everlasting-blue-blackmail-virus.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64572bab-83cc-d973-0349-0000a224ce75","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/12/stop-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/12/stop-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--850ccfa6-d9f8-b7f2-a236-00006c57e353","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/MarceloRivero/status/1065694365056679936","pattern":"[url:value = 'https://twitter.com/MarceloRivero/status/1065694365056679936']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc3361a1-5184-7375-dddc-0000effa49c5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/Emm_ADC_Soft/status/1064459080016760833","pattern":"[url:value = 'https://twitter.com/Emm_ADC_Soft/status/1064459080016760833']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c28dda6-8442-464c-33bd-000028a07748","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsobVENXcAAR3GC[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsobVENXcAAR3GC[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddd9f04a-aaba-2d8c-2511-000062c8c6a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsW33OQXgAAwJzv[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsW33OQXgAAwJzv[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89daa9dc-1fda-e545-5a33-00006926b519","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.kaspersky.com/blog/keypass-ransomware/23447/","pattern":"[url:value = 'https://www.kaspersky.com/blog/keypass-ransomware/23447/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01a7e4e9-958e-6a49-ae46-000020e5ae23","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-keypass-ransomware-campaign-underway/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-keypass-ransomware-campaign-underway/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c4183e6-a476-2122-1b6a-00005a75f16a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: bitmessage.ch","pattern":"[domain-name:value = 'bitmessage.ch']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3b8d3d8-4350-8a59-0d94-000018438ca7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/11/wannasmile-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/11/wannasmile-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caa1f41f-b5f9-026d-81bc-00008172352e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: www.digiarz.com","pattern":"[domain-name:value = 'www.digiarz.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b484c83-f4d9-a2d6-4c47-0000f07b5206","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: www.farhadexchange.net","pattern":"[domain-name:value = 'www.farhadexchange.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2071ed76-6773-7a77-8af1-0000415872a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: www.payment","pattern":"[domain-name:value = 'www.payment']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--062d83fd-e176-8142-9052-0000ae36d5df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: www.exchangeing","pattern":"[domain-name:value = 'www.exchangeing']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd256598-1177-5d72-3efb-000054f8e7fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/10/tyrant-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/10/tyrant-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6446f29-99bc-582a-3db1-000055eb44d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: webmoney.ir.Shared","pattern":"[domain-name:value = 'webmoney.ir.Shared']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9486696-30c1-7190-bbc6-0000ba3ab4a5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: exchange.ir","pattern":"[domain-name:value = 'exchange.ir']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6bf9428-e39f-23f5-6f9b-00008cdbb303","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/11/rastakhiz-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/11/rastakhiz-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2807a9f2-72ee-434f-114a-0000a397703b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/06/dbger-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/06/dbger-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c7cf91e-a54d-422e-9f64-00007e03ac1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/dbger-ransomware-uses-eternalblue-and-mimikatz-to-spread-across-networks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/dbger-ransomware-uses-eternalblue-and-mimikatz-to-spread-across-networks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9548149-4d38-5369-7b8e-0000c5a3cfdf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/u/986406/Ransomware/DBGer/DBGer-ransom-note.png","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/u/986406/Ransomware/DBGer/DBGer-ransom-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77f1fa7f-7adb-2aa4-cd50-0000303de6f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: image.png.dbger","pattern":"[domain-name:value = 'image.png.dbger']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--324dbb15-fcd5-0efe-dbcb-0000e1c76e59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.johannesbader.ch/2015/03/the-dga-of-dircrypt/","pattern":"[url:value = 'https://www.johannesbader.ch/2015/03/the-dga-of-dircrypt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fb5f63c-9f33-d044-fa3a-000020ea58fd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/03/everbe-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/03/everbe-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3a5971a-421d-167c-7829-00007d7b2801","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1065675918000234497","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1065675918000234497']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f0350f5-edaa-2713-ca70-000064cbf824","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/decryptor-released-for-the-everbe-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/decryptor-released-for-the-everbe-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae893a3a-b146-0c89-3524-00006c47c0bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsoIB_0U0AAXgEz[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsoIB_0U0AAXgEz[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef8798c7-c8d7-8f19-aea3-0000aad2d315","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1007334654918250496","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1007334654918250496']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa3e5cdf-249b-b7c9-14c4-00007d39c51f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Notice.txt","pattern":"[domain-name:value = 'Notice.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8644ae0-82d4-a0dd-97a7-00001ddd9738","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/05/yyto-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/05/yyto-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98b96381-26ea-43f0-a481-0000e8ec07cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1006237353474756610","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1006237353474756610']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9caacc30-6bdd-5dd2-92e3-000059e9a489","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: mail.com.ovgm","pattern":"[domain-name:value = 'mail.com.ovgm']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9277ec3-9994-abc8-a5f2-000073298c6d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/03/b2dr-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/03/b2dr-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf3ca4cd-5715-fe46-32af-000088054568","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1006220895302705154","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1006220895302705154']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17bbaa50-edc7-bacd-6766-00009091556e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.torproject.org/download/download-easy.html.en\\nb)","pattern":"[url:value = 'https://www.torproject.org/download/download-easy.html.en\\\\nb)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--669d9763-8bb7-0335-5ba4-0000499f1614","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ScrewYou.txt","pattern":"[domain-name:value = 'ScrewYou.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f2b17f1-46ea-8d00-53e9-0000f3a315b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: protonmail.com.gw","pattern":"[domain-name:value = 'protonmail.com.gw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4d8de12-22eb-8618-49c3-00007c678013","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/09/paradise-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/09/paradise-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a48163c-4582-8fed-9683-0000bd982535","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/993499349199056897","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/993499349199056897']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12d3e485-a410-0380-34e5-000036402951","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1005420103415017472","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1005420103415017472']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81e71d52-5a68-5a3d-53be-0000d5c0ecf2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: all-ransomware.info.txt","pattern":"[domain-name:value = 'all-ransomware.info.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5512760-d9c8-1e35-b4fc-000070be1509","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: all-ransomware.info","pattern":"[domain-name:value = 'all-ransomware.info']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97d79267-7e83-b7a4-69c1-0000915e2bf2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"ip: 0.0.0.1","pattern":"[ipv4-addr:value = '0.0.0.1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7277703-4f5c-8cc3-aade-00003344a14a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/01/nemesis-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/01/nemesis-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--965c71b8-0af3-0672-0dd6-00006bc2bff8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/nemes1s-raas-is-padcrypt-ransomwares-affiliate-system/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/nemes1s-raas-is-padcrypt-ransomwares-affiliate-system/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--094f9b88-4cd3-2348-ed44-00006f86004f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/Damian1338B/status/1005411102660923392","pattern":"[url:value = 'https://twitter.com/Damian1338B/status/1005411102660923392']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c982d992-be06-45d1-332e-000059adb5a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/06/donut-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/06/donut-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4fc2b72-9cb9-df12-3935-00006178ba7a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-15th-2018-dbger-scarab-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-15th-2018-dbger-scarab-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bbc73bf-5a51-18a7-87ef-0000fcb1299a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/1005438610806583296","pattern":"[url:value = 'https://twitter.com/siri_urz/status/1005438610806583296']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8376f86-843f-067f-678d-00004b16f003","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/15/DfQI_lnXUAAukGK[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/15/DfQI_lnXUAAukGK[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d88a242d-2429-b8e2-77a5-000038661b5d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/04/spartacus-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/04/spartacus-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab242399-b6de-6055-6b86-0000841e55ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1005136022282428419","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1005136022282428419']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5adafe2-17f2-86e7-8f67-0000dfe83ea6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1005138187621191681","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1005138187621191681']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21a0fe08-bd64-6ebc-973e-0000a68c7bec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/05/pgpsnippet-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/05/pgpsnippet-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44dd8a0b-8804-a946-e6b7-0000c12d74a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/pgpsnippet-variant.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/pgpsnippet-variant.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--086e1f65-3404-3443-7922-0000dd3a0eac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/05/aurora-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/05/aurora-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5547b29-e5b9-b494-e464-000063270de4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/aurora-zorro-ransomware-actively-being-distributed/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/aurora-zorro-ransomware-actively-being-distributed/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ec2dba3-a26c-baea-6d57-000038ee1981","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1004435398687379456","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1004435398687379456']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8942e7f0-2896-c3a3-9d73-0000c85f7360","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.spamfighter.com/News-21588-Aurora-Ransomware-Circulating-the-Cyber-Space.htm","pattern":"[url:value = 'https://www.spamfighter.com/News-21588-Aurora-Ransomware-Circulating-the-Cyber-Space.htm']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--add1918e-e6fc-3a60-f91a-000086532a90","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/a/aurora/wallpaper.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/a/aurora/wallpaper.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--416c9d01-d0db-6c20-d7f3-0000755ff6fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/a/aurora/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/a/aurora/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab2e2e75-8e41-6aea-b4a6-000017777990","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: mail.com","pattern":"[domain-name:value = 'mail.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--004c6a82-3d12-8084-f329-0000f69123b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: n.We","pattern":"[domain-name:value = 'n.We']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef4dbb85-a88b-cf11-d042-00004503b518","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: vfemail.net","pattern":"[domain-name:value = 'vfemail.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b78d5c0-9da1-a2b5-8ef5-0000b4bf8c84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: nbig.fish","pattern":"[domain-name:value = 'nbig.fish']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd3f2b44-53f8-8952-7ffd-0000b44ea580","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: anonimus.mr","pattern":"[domain-name:value = 'anonimus.mr']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c343a85-4d87-e447-2e77-00001795b615","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/06/redeye-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/06/redeye-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6de12784-9816-100f-be1f-00001f829614","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://bartblaze.blogspot.com/2018/06/redeye-ransomware-theres-more-than.html","pattern":"[url:value = 'https://bartblaze.blogspot.com/2018/06/redeye-ransomware-theres-more-than.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7c57693-d4aa-5a3d-cf8c-00009948abef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/1004463935905509376","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/1004463935905509376']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b575b940-7332-3940-d59b-000091845899","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/DfCO0T2WsAQvclJ[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/DfCO0T2WsAQvclJ[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a334624-ee96-876d-737d-00001f08852b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: system.The","pattern":"[domain-name:value = 'system.The']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39a71faf-5324-4607-371b-0000a3ba671f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/06/scarab-diskdoctor-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/06/scarab-diskdoctor-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df1f2313-2b5d-267a-e47b-0000d9b722cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De2sj4GW0AAuQer[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De2sj4GW0AAuQer[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec4dea83-5383-e72c-42eb-0000bbf9c6d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/06/pedcont-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/06/pedcont-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd709704-2373-4e02-6909-00009d7a804e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De00yEDVQAE_p9z[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De00yEDVQAE_p9z[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4375a4e-8c49-5a1a-b7c5-0000769bf541","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/06/crybrazil-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/06/crybrazil-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22102b15-ab6a-9059-7502-0000855cc91a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1002953824590614528","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1002953824590614528']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f55cded8-d493-ce73-b8cd-00000a8ad49d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/crybrazil.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/crybrazil.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43b61d85-27ac-7966-01fa-0000cee6e623","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/05/sigrun-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/05/sigrun-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52b2d110-019f-713f-df6e-0000551cc072","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sigrun-ransomware-author-decrypting-russian-victims-for-free/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sigrun-ransomware-author-decrypting-russian-victims-for-free/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e55a54f-9c58-ce4f-44fb-0000f6187f4e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: RESTORE-SIGRUN.txt","pattern":"[domain-name:value = 'RESTORE-SIGRUN.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d98588a1-b27f-1789-2ac0-0000424417cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.dash.org/exchanges/","pattern":"[url:value = 'https://www.dash.org/exchanges/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a36b6d1-cc04-ac58-c514-000005188634","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/04/hpe-ilo-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/04/hpe-ilo-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32874c5d-2d88-8551-d938-0000bf02eef5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/M_Shahpasandi/status/989157283799162880","pattern":"[url:value = 'https://twitter.com/M_Shahpasandi/status/989157283799162880']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bce6f6d6-2dd0-5269-5ff6-000076fd0de6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-hits-hpe-ilo-remote-management-interfaces/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-hits-hpe-ilo-remote-management-interfaces/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58ba4920-b2ee-aa51-2c1d-0000c634adc8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://localbitcoins.com\\nhttps://www.kraken.com\\nPlease","pattern":"[url:value = 'https://localbitcoins.com\\\\nhttps://www.kraken.com\\\\nPlease']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0abb0ae-e65f-61a1-a9e8-0000bbd68b55","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: yopmail.com","pattern":"[domain-name:value = 'yopmail.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4fe0f38-f9cf-68dd-aa89-0000039332f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-c-ransomware-compiles-itself-at-runtime/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-c-ransomware-compiles-itself-at-runtime/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24a23358-1f95-ca6b-7d32-00005a6a9d76","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/c/compiled-ransomware/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/c/compiled-ransomware/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4563388b-8c86-8c2b-3e50-0000da323d93","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/04/tron-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/04/tron-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0eda82d-d123-cc6d-bf7c-00007c863899","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/985152346773696512","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/985152346773696512']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--376f963e-df8f-5821-1da9-00002095dc56","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/DavxIr-W4AEq3Ny.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DavxIr-W4AEq3Ny.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b14be983-6751-7020-5978-000079b7307b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/04/ironlocker-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/04/ironlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8606478e-b7e3-7b18-b8cb-000049860f55","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://bartblaze.blogspot.lu/2018/04/maktub-ransomware-possibly-rebranded-as.html","pattern":"[url:value = 'https://bartblaze.blogspot.lu/2018/04/maktub-ransomware-possibly-rebranded-as.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--764d362b-ab0a-07ad-65f7-0000411f4081","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.enigmasoftware.com/nmcryptansomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/nmcryptansomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12bd08dc-d9d3-9f7f-2487-00000decccd1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://sensorstechforum.com/nmcrypt-files-ransomware-virus-remove-restore-data/","pattern":"[url:value = 'https://sensorstechforum.com/nmcrypt-files-ransomware-virus-remove-restore-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7199bf6-c358-48db-2bd1-0000b3e1b13a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://sensorstechforum.com/wp-content/uploads/2018/04/stf-NMCRYPT-ransomware-virus-ransom-note-tor-onion-network-page-768x827.png","pattern":"[url:value = 'https://sensorstechforum.com/wp-content/uploads/2018/04/stf-NMCRYPT-ransomware-virus-ransom-note-tor-onion-network-page-768x827.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3d4451f-1e32-d91d-dba5-0000efbc0cad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lylh3uqyzay3lhrd.onion.link/","pattern":"[url:value = 'https://lylh3uqyzay3lhrd.onion.link/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6c24ee4-d10c-768a-eb36-0000410dfc23","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://lylh3uqyzay3lhrd.onion.to/","pattern":"[url:value = 'https://lylh3uqyzay3lhrd.onion.to/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f2e4948-ee7f-f624-a06d-00007792601a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/10/xiaoba-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/10/xiaoba-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a36ef179-4185-9e6c-ab13-000008fb8a71","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1004048636530094081","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1004048636530094081']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--044dc99c-accf-1d61-ae50-0000122a5514","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/968552114787151873","pattern":"[url:value = 'https://twitter.com/demonslay335/status/968552114787151873']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5dce102-04d7-0caf-1c6d-00003ff2cd67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/926748937477939200","pattern":"[url:value = 'https://twitter.com/struppigel/status/926748937477939200']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e05d0162-ae1a-b074-3bb4-0000b3e44608","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/923847744137154560","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/923847744137154560']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f4864e6-4963-3f8b-27b5-0000208f8ee2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/xiaoba-ransomware-retooled-as-coinminer-but-manages-to-ruin-your-files-anyway/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/xiaoba-ransomware-retooled-as-coinminer-but-manages-to-ruin-your-files-anyway/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca5e8037-2189-d930-2a84-0000620252c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De8WvF_X0AARtYr[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De8WvF_X0AARtYr[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac79e053-bba4-d921-8526-0000ed2bef9f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/DNx5Of-X0AASVda.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DNx5Of-X0AASVda.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02444195-8519-5516-a3be-0000977dc47a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/DNIoIFuX4AAce7J.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DNIoIFuX4AAce7J.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--281fc203-f8f6-5cd0-437a-00008ccc878f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: yeah.net","pattern":"[domain-name:value = 'yeah.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dba512e-a91f-e14f-f179-00004eb118ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/minecraft-and-cs-go-ransomware-strive-for-media-attention/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/minecraft-and-cs-go-ransomware-strive-for-media-attention/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--013cf76d-ace4-4002-133d-0000c0eb1621","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/04/skyfile-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/04/skyfile-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ef4b184-5a3b-1fff-ca1e-000055445f50","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/982229994364547073","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/982229994364547073']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d065c48-1e46-7810-765c-000075922ed6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/03/bansomqarewanna-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/03/bansomqarewanna-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4530a236-b82c-38c6-c86f-00006e78320e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/981270787905720320","pattern":"[url:value = 'https://twitter.com/demonslay335/status/981270787905720320']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4536a4f1-ca31-eae9-28f9-000045a1b078","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pastebin.com/xkRaRytW","pattern":"[url:value = 'https://pastebin.com/xkRaRytW']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe6b5edb-c7c3-fd6e-9f28-00000b0ead95","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: File.s.txt","pattern":"[domain-name:value = 'File.s.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16287e67-85ff-e3d5-6afa-00003de7649f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blockchain.info/wallet/#/buy-sell\\n","pattern":"[url:value = 'https://blockchain.info/wallet/#/buy-sell\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ad1de68-63fe-b3d0-3444-00005cddd59f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blockchain.info/fr/wallet/#/signup\\nStep","pattern":"[url:value = 'https://blockchain.info/fr/wallet/#/signup\\\\nStep']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fb91c42-e480-3619-6ae1-0000d3a24a4a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://en.wikipedia.org/wiki/Ransomware#Fusob","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Ransomware#Fusob']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82543000-c1bb-ea52-8167-00004736e632","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://nakedsecurity.sophos.com/2012/08/29/reveton-ransomware-exposed-explained-and-eliminated/","pattern":"[url:value = 'https://nakedsecurity.sophos.com/2012/08/29/reveton-ransomware-exposed-explained-and-eliminated/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0496d29-9334-7075-7dc2-00001cb9d4ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://en.wikipedia.org/wiki/Ransomware#Reveton","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Ransomware#Reveton']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ffcc044-7db0-d6d7-87bf-0000fc1409c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/microsoft-engineer-charged-in-reveton-ransomware-case/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/microsoft-engineer-charged-in-reveton-ransomware-case/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8dfab82-8cee-4f45-290c-00004d58209f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/vurten","pattern":"[url:value = 'https://www.ransomlook.io/group/vurten']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8dc6bc72-042d-39ff-28f5-000099747f2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/04/vurten-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/04/vurten-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10947fd0-158d-48bf-7488-0000263a42ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/981191281195044867","pattern":"[url:value = 'https://twitter.com/siri_urz/status/981191281195044867']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--debba32a-68dd-b3c6-ebdb-000018350368","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/april/6/vurten.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/april/6/vurten.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ede5f316-d56b-4e39-ab8e-00003d2927f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: UNCRYPT.README","pattern":"[domain-name:value = 'UNCRYPT.README']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46b2a1e2-e1b3-7225-822a-0000cc631e2e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/10/my-decryptor-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/10/my-decryptor-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33c51bcc-fe3c-fb47-5b95-00002efbd71c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1005133410501787648","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1005133410501787648']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24e9128f-fa43-a8d5-3e58-0000bf3d3338","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/goodbye-cerber-hello-magniber-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/goodbye-cerber-hello-magniber-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b07fe990-a00c-c8fc-5d50-00004663d9e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/decrypters-for-some-versions-of-magniber-ransomware-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/decrypters-for-some-versions-of-magniber-ransomware-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a245d32-971c-ee4b-0c53-0000e08fb3f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://[victim_id].hotdisk.world/EP866p5M93wDS513\\n\\n\\n","pattern":"[url:value = 'http://[victim_id].hotdisk.world/EP866p5M93wDS513\\\\n\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d410cca-6e96-9341-f73f-0000c52068bf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://[victim_id].carefit.agency/EP866p5M93wDS513\\n\\n","pattern":"[url:value = 'http://[victim_id].carefit.agency/EP866p5M93wDS513\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a689a116-29cb-7a5b-713c-0000cfa52ce6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://[victim_id].jobsnot.services/EP866p5M93wDS513\\n\\n","pattern":"[url:value = 'http://[victim_id].jobsnot.services/EP866p5M93wDS513\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--364c8b65-fdc5-92be-f862-00001d770068","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://[victim_id].bankme.date/EP866p5M93wDS513\\n\\n","pattern":"[url:value = 'http://[victim_id].bankme.date/EP866p5M93wDS513\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3345485c-c6d0-5abc-6d14-0000afc6e25b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://[victim_id].ofotqrmsrdc6c3rz.onion/EP866p5M93wDS513\\n\\n\\n","pattern":"[url:value = 'http://[victim_id].ofotqrmsrdc6c3rz.onion/EP866p5M93wDS513\\\\n\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48789961-f755-7066-12b2-0000433e2cac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/06/lockcrypt-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/06/lockcrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6928a2d6-405c-7664-b8f3-0000d4f67ad4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/1034436350748053504","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/1034436350748053504']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6f44f30-6f35-0536-4f7d-00001d2cc557","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/lockcrypt-ransomware-cracked-due-to-bad-crypto/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/lockcrypt-ransomware-cracked-due-to-bad-crypto/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a03d215-2849-c77d-baaf-0000c49cd268","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlsLwUjXsAA0xyY[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlsLwUjXsAA0xyY[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c43333d-b5b5-11aa-0985-0000c37b461b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/04/pubg-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/04/pubg-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4c96a37-35a2-7fd2-a204-0000a8f84f46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/pubg-ransomware-decrypts-your-files-if-you-play-playerunknowns-battlegrounds/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/pubg-ransomware-decrypts-your-files-if-you-play-playerunknowns-battlegrounds/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89ae2e19-d863-54f3-1238-0000dde85a1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/p/pubg-ransomware/pubg-ransomware.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/p/pubg-ransomware/pubg-ransomware.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--209813ec-e8ad-576b-80f9-0000cbb536ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/03/whiterose-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/03/whiterose-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35c3543d-82d0-89e7-5cee-0000047f3802","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-whiterose-ransomware-is-decryptable-and-tells-a-strange-story/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-whiterose-ransomware-is-decryptable-and-tells-a-strange-story/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c59240a-62b1-3bc2-5332-0000e1d02355","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: nVIII.Everything","pattern":"[domain-name:value = 'nVIII.Everything']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90d68097-8a0b-f2c2-2507-0000581904e1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://torbox3uiot6wchz.onion\\","pattern":"[url:value = 'http://torbox3uiot6wchz.onion\\\\']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61cffbc9-fae9-b3a8-f0ea-0000c9916f7c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: IV.II","pattern":"[domain-name:value = 'IV.II']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc07692e-fb62-dfc1-7103-00002f24dd7c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: HOW-TO-RECOVERY-FILES.TXT","pattern":"[domain-name:value = 'HOW-TO-RECOVERY-FILES.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12cd877a-a8b5-a1ff-4878-00003c0718bb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://tox.chat/download.html]\\nII","pattern":"[url:value = 'https://tox.chat/download.html]\\\\nII']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42dcd10b-db41-429b-5b0a-00006667e7ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: BY.WHITEROSE","pattern":"[domain-name:value = 'BY.WHITEROSE']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6d039fe-fe8f-cd75-4adb-0000c37b44dc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.accenture.com/t20180803T064557Z__w__/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf","pattern":"[url:value = 'https://www.accenture.com/t20180803T064557Z__w__/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5be652ef-5fee-6add-3524-0000972caaf3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/black-ruby-ransomware-skips-victims-in-iran-and-adds-a-miner-for-good-measure/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/black-ruby-ransomware-skips-victims-in-iran-and-adds-a-miner-for-good-measure/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a6c25e1-6906-2b7f-40ff-000013d11845","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: HOW-TO-DECRYPT-FILES.txt","pattern":"[domain-name:value = 'HOW-TO-DECRYPT-FILES.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ad0508f-870f-22ff-48c2-000022779699","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/flotera-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/flotera-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d6588ff-aa30-fd3c-9204-0000846cf65a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/author-of-polski-vortex-and-flotera-ransomware-families-arrested-in-poland/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/author-of-polski-vortex-and-flotera-ransomware-families-arrested-in-poland/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91e569a6-d9f5-ce50-447d-00004ddca2f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/03/zenis-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/03/zenis-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa6c68f6-d498-6098-43f4-0000ac1f86ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/zenis-ransomware-encrypts-your-data-and-deletes-your-backups/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/zenis-ransomware-encrypts-your-data-and-deletes-your-backups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cc27aa9-4904-9192-6277-00008f1cf46a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: MailFence.com","pattern":"[domain-name:value = 'MailFence.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--070c1835-771a-3c95-a873-00005d7bb6a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/qwerty-ransomware-utilizes-gnupg-to-encrypt-a-victims-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/qwerty-ransomware-utilizes-gnupg-to-encrypt-a-victims-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b70aa625-276c-7cc7-9746-0000d2783363","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.lu/2017/04/","pattern":"[url:value = 'http://id-ransomware.blogspot.lu/2017/04/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abe579ff-2ad9-10cf-6481-00006473a5a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.lu/2017/04/rsautil-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.lu/2017/04/rsautil-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a2f021c-e190-94b5-246d-000078ad406b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/rsautil-ransomware-helppme-india-com-installed-via-hacked-remote-desktop-services/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/rsautil-ransomware-helppme-india-com-installed-via-hacked-remote-desktop-services/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f92bbf23-c170-fe82-6208-0000019cf6d9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.securityweek.com/rsautil-ransomware-distributed-rdp-attacks","pattern":"[url:value = 'https://www.securityweek.com/rsautil-ransomware-distributed-rdp-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1da8b4b-f8ae-4e45-8bd7-000036c85d34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://2.bp.blogspot.com/-T4lvnNISc_A/WQY1SI1r1mI/AAAAAAAAE-E/tH7p02nS2LUTvXmq66poiyM1RYhHc4HbwCLcB/s200/lock-note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-T4lvnNISc_A/WQY1SI1r1mI/AAAAAAAAE-E/tH7p02nS2LUTvXmq66poiyM1RYhHc4HbwCLcB/s200/lock-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6de4ddce-dcea-994a-de60-0000fcb663ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-6jE-GW6wCr8/WQY1L_uHsFI/AAAAAAAAE-A/3YR0bwwBJqgp8CsApZq4F_44JkMB0m2WwCLcB/s320/image-note.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-6jE-GW6wCr8/WQY1L_uHsFI/AAAAAAAAE-A/3YR0bwwBJqgp8CsApZq4F_44JkMB0m2WwCLcB/s320/image-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6580f550-6989-54b0-9b9c-000088b67621","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: gmx.de","pattern":"[domain-name:value = 'gmx.de']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c96fd86-a602-7017-8eb9-0000a9b08b91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2018/02/thanatos-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2018/02/thanatos-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b1c419e-8f1b-2f57-338d-0000fe98f244","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.eclecticiq.com/resources/thanatos--ransomware-first-ransomware-ask-payment-bitcoin-cash?type=intel-report","pattern":"[url:value = 'https://www.eclecticiq.com/resources/thanatos--ransomware-first-ransomware-ask-payment-bitcoin-cash?type=intel-report']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7294bd04-344d-5107-f450-000055766aa8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://mobile.twitter.com/EclecticIQ/status/968478323889332226","pattern":"[url:value = 'https://mobile.twitter.com/EclecticIQ/status/968478323889332226']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2bba401-63c7-2a5e-0729-0000636c3cd2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.zdnet.com/article/cryakl-ransomware-decryption-keys-now-available-for-free/","pattern":"[url:value = 'http://www.zdnet.com/article/cryakl-ransomware-decryption-keys-now-available-for-free/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3714d096-4c38-f1ee-42e3-0000960a90b9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.technologynews.tech/cryakl-ransomware-virus","pattern":"[url:value = 'https://www.technologynews.tech/cryakl-ransomware-virus']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--181a77dc-3b97-ccd6-0da0-0000edf99fa9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://sensorstechforum.com/fr/fairytail-files-virus-cryakl-ransomware-remove-restore-data/","pattern":"[url:value = 'https://sensorstechforum.com/fr/fairytail-files-virus-cryakl-ransomware-remove-restore-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e47000c-e1ce-63d3-d6b5-000015d468c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/shurl0ckr-ransomware-as-a-service-peddled-on-dark-web-can-reportedly-bypass-cloud-applications","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/shurl0ckr-ransomware-as-a-service-peddled-on-dark-web-can-reportedly-bypass-cloud-applications']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eda2d18a-16a8-5140-9879-0000b82fed8f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/gandcrab-ransomware/89631/","pattern":"[url:value = 'https://securelist.com/gandcrab-ransomware/89631/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a84c6ad-9d1d-aea9-ad69-000052a3bc66","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa19-024a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa19-024a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da3471db-388e-b600-02ad-0000623a23a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/en_us/research/19/f/uncovering-the-evolution-of-gandcrab-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/19/f/uncovering-the-evolution-of-gandcrab-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1549d14c-315c-6c42-1035-00001ad53c75","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-shuts-down-after-claiming-to-have-made-over-2-billion/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-shuts-down-after-claiming-to-have-made-over-2-billion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d111a9d9-f4da-6496-4250-0000635b6c92","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/gandcrab","pattern":"[url:value = 'https://www.ransomlook.io/group/gandcrab']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b53d5d4a-e510-3da9-f3cf-0000de062205","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2018/01/gandcrab-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2018/01/gandcrab-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61647be0-ab75-06cb-0b52-0000db809013","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/gandcrab-v5-ransomware-utilizing-the-alpc-task-scheduler-exploit/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/gandcrab-v5-ransomware-utilizing-the-alpc-task-scheduler-exploit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1936b647-b12f-97c6-26a1-0000fc864255","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-fallout-exploit-kit-drops-gandcrab-ransomware-or-redirects-to-pups/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-fallout-exploit-kit-drops-gandcrab-ransomware-or-redirects-to-pups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d552da1-7243-eab1-c9b8-000017e78d40","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/gandcrab-version-3-released-with-autorun-feature-and-desktop-background/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/gandcrab-version-3-released-with-autorun-feature-and-desktop-background/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1fa793f-0c76-1af9-c4f3-000078d43e0f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-version-2-released-with-new-crab-extension-and-other-changes/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-version-2-released-with-new-crab-extension-and-other-changes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d978142-7a46-69d9-5944-0000cb9bb3c0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-being-distributed-via-malspam-disguised-as-receipts/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-being-distributed-via-malspam-disguised-as-receipts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--778d4e68-6115-4467-7416-00004f414257","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8911acbe-236d-dfc1-3582-000053b4452a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/security/f/fallout-exploit-kit/gandcrab-fallout.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/security/f/fallout-exploit-kit/gandcrab-fallout.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bd9fec5-cb06-b84b-2eff-00001622b75d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/g/gandcrab/v3/desktop-background.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/g/gandcrab/v3/desktop-background.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23f9892a-fd50-451b-7957-00007c0d4b2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: GDCB-DECRYPT.txt","pattern":"[domain-name:value = 'GDCB-DECRYPT.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e143922-2c69-8ef6-129d-0000dbe18e89","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.sfu.ca/jabber/Psi_Jabber_PC.pdf","pattern":"[url:value = 'http://www.sfu.ca/jabber/Psi_Jabber_PC.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--074724e3-ab98-1378-7948-000000b488e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: sj.ms","pattern":"[domain-name:value = 'sj.ms']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4d638e8-a555-2fc5-df98-00002ba80f08","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://sj.ms/register.php\\n0)","pattern":"[url:value = 'http://sj.ms/register.php\\\\n0)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8717f0ad-182d-0aa7-9681-0000b2b9ef60","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://psi-im.org/download/\\n1","pattern":"[url:value = 'https://psi-im.org/download/\\\\n1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c874f8a8-4c2f-ee4b-3e41-0000a810972e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gandcrab2pie73et.onion/[id]","pattern":"[url:value = 'http://gandcrab2pie73et.onion/[id]']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--703e4abd-d1fc-9918-86df-000057bbb98a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: CRAB-DECRYPT.txt","pattern":"[domain-name:value = 'CRAB-DECRYPT.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--effcf934-84e8-dd44-f512-0000a661ecce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://tox.chat/download.html\\n2","pattern":"[url:value = 'https://tox.chat/download.html\\\\n2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45934a02-4b8b-f686-2c81-00009462f4f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gdcbmuveqjsli57x.onion/[id]\\n5","pattern":"[url:value = 'http://gdcbmuveqjsli57x.onion/[id]\\\\n5']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--590d16cc-bfea-a0ef-d1e6-00000eeae3b9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gdcbghvjyqy7jclk.onion.plus/[id]\\n\\nOn","pattern":"[url:value = 'http://gdcbghvjyqy7jclk.onion.plus/[id]\\\\n\\\\nOn']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9e53ada-ecad-8b9e-f5d1-000081a13d3f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gdcbghvjyqy7jclk.onion.rip/[id]\\n5","pattern":"[url:value = 'http://gdcbghvjyqy7jclk.onion.rip/[id]\\\\n5']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c91b0a81-0506-7fe1-790c-0000640b15b6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gdcbghvjyqy7jclk.onion.guide/[id]\\n4","pattern":"[url:value = 'http://gdcbghvjyqy7jclk.onion.guide/[id]\\\\n4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a614317-8956-4dfb-7c63-00000cfebd49","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gdcbghvjyqy7jclk.onion.casa/[id]\\n3","pattern":"[url:value = 'http://gdcbghvjyqy7jclk.onion.casa/[id]\\\\n3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--822a157d-a3ec-3ba8-f6ce-0000445191ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gdcbghvjyqy7jclk.onion.top/[id]\\n2","pattern":"[url:value = 'http://gdcbghvjyqy7jclk.onion.top/[id]\\\\n2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96014a30-92bf-88aa-4763-0000ad8c37b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gdcbghvjyqy7jclk.onion/[id]\\n5","pattern":"[url:value = 'http://gdcbghvjyqy7jclk.onion/[id]\\\\n5']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e65a7bd4-50b1-25b2-3e18-00003983c073","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.torproject.org/\\n2","pattern":"[url:value = 'https://www.torproject.org/\\\\n2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44cdafe9-da11-9b0d-16a5-00009e0fb0ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://gandcrabmfe6mnef.onion/","pattern":"[url:value = 'http://gandcrabmfe6mnef.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--025c81be-9fc2-df40-fc1d-00007bf32263","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://objective-see.com/blog/blog_0x25.html#FileCoder","pattern":"[url:value = 'https://objective-see.com/blog/blog_0x25.html#FileCoder']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0180c7d-6ab6-75e5-830d-000017866907","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/12/file-spider-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/12/file-spider-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a12efac4-67de-21fe-d669-000050557f6b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/file-spider-ransomware-targeting-the-balkans-with-malspam/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/file-spider-ransomware-targeting-the-balkans-with-malspam/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5d05ce3-9dc2-4061-f5c4-00005fc15d4f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: computer.File","pattern":"[domain-name:value = 'computer.File']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c4955ff-6ff9-5319-2136-00008222214a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/scarab","pattern":"[url:value = 'https://www.ransomlook.io/group/scarab']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fef95230-0586-987b-bc72-00009cf1d5ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/06/scarab-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/06/scarab-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba1b016d-9417-c9f2-7050-00002707e5ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/GrujaRS/status/1072057088019496960","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1072057088019496960']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e809e268-9559-dd88-c671-0000a726f614","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/Amigo_A_/status/1039105453735784448","pattern":"[url:value = 'https://twitter.com/Amigo_A_/status/1039105453735784448']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5358c9bf-a3b5-f351-38b2-000045fc4911","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1049316344183836672","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1049316344183836672']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3eecdd6-24d7-188d-876b-000044946a83","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1007694117449682945","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1007694117449682945']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f754aee-c379-1f3a-53de-00007df39a17","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1006908267862396928","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1006908267862396928']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5614357-3ab2-8b42-d162-00007c643076","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1006222754385924096","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1006222754385924096']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c68ad0d-8a2c-6205-8e88-0000a46efd6f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://myonlinesecurity.co.uk/necurs-botnet-malspam-delivering-a-new-ransomware-via-fake-scanner-copier-messages/","pattern":"[url:value = 'https://myonlinesecurity.co.uk/necurs-botnet-malspam-delivering-a-new-ransomware-via-fake-scanner-copier-messages/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9aacd61-b82b-5b1a-ea6f-0000f5340795","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/933643147766321152","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/933643147766321152']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7693e265-d73d-6afa-c098-0000bf241f83","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.forcepoint.com/security-labs/massive-email-campaign-spreads-scarab-ransomware","pattern":"[url:value = 'https://blogs.forcepoint.com/security-labs/massive-email-campaign-spreads-scarab-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92121ade-2531-eb5b-7592-000030f5d695","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labsblog.f-secure.com/2017/11/23/necurs-business-is-booming-in-a-new-partnership-with-scarab-ransomware/","pattern":"[url:value = 'https://labsblog.f-secure.com/2017/11/23/necurs-business-is-booming-in-a-new-partnership-with-scarab-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80a5e114-1ea7-b46d-99ba-00000e80db48","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/scarab-ransomware-pushed-via-massive-spam-campaign/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/scarab-ransomware-pushed-via-massive-spam-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32735907-1fe5-7946-9a8d-0000534c9582","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/DuC07vPWkAAMekP.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DuC07vPWkAAMekP.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0368a51-8bd7-557b-3b14-000097dee4c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/DtzAAIAW0AEHC86[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/DtzAAIAW0AEHC86[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c866d4a-c1e6-03b8-c902-00005df37e3b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/30/Ds8PMFpW0AIcYuJ[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/30/Ds8PMFpW0AIcYuJ[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b335772-c58e-8dae-0162-0000e929539e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsnFZrGX4AE2H1c[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsnFZrGX4AE2H1c[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a998ed44-a266-052e-7d30-000096e1f6cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/september/14/Scarab-ransomware.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/september/14/Scarab-ransomware.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4055a454-8adc-3913-be1d-000039581fec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ReadMeToDecrypt.txt","pattern":"[domain-name:value = 'ReadMeToDecrypt.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9d3c047-2568-666c-d265-0000bea9bc9c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: airmail.cc.TXT","pattern":"[domain-name:value = 'airmail.cc.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fe518fb-0fb5-d975-65e5-00001f9c570e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://en.wikipedia.org/wiki/Bitcoin\\n\\n","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Bitcoin\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4eb3a7b9-9161-97b4-7fbc-00008dd74867","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.buybitcoinworldwide.com/\\nhttps://localbitcoins.net\\n","pattern":"[url:value = 'https://www.buybitcoinworldwide.com/\\\\nhttps://localbitcoins.net\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e5687cf-6c3f-a88c-c9e1-0000984f6ef0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://buy.blockexplorer.com/","pattern":"[url:value = 'https://buy.blockexplorer.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cc400c0-06bf-aed2-9c09-00002ac8ae3a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: cyrill.fedor","pattern":"[domain-name:value = 'cyrill.fedor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2f6fcf5-19c6-79ae-c60a-0000abae0def","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.coindesk.com/information/how-can-i-buy-bitcoins\\n\\nAttention!","pattern":"[url:value = 'http://www.coindesk.com/information/how-can-i-buy-bitcoins\\\\n\\\\nAttention!']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffa76ad0-e356-589f-7405-0000ae5fc507","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://localbitcoins.com/buy_bitcoins\\n","pattern":"[url:value = 'https://localbitcoins.com/buy_bitcoins\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c27a5d39-8292-fdcc-b022-0000d2f641c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: mr.leen","pattern":"[domain-name:value = 'mr.leen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b989ba8-b9f4-9289-6cc1-0000b8dcfbc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: cock.li.TXT","pattern":"[domain-name:value = 'cock.li.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a172eb24-74e3-83b1-ab6d-00007d1cf0a5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: THIS.TXT","pattern":"[domain-name:value = 'THIS.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b538ca8c-d051-0cb1-ee75-0000054e20a5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/11/qkg-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/11/qkg-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5dd2405c-6fe9-8c8b-1f84-000009746eda","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/qkg-ransomware-encrypts-only-word-documents-hides-and-spreads-via-macros/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/qkg-ransomware-encrypts-only-word-documents-hides-and-spreads-via-macros/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2d9f59d-7012-78d6-0ca5-000097791127","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/11/hc6-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/11/hc6-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2376217d-6a65-d4ce-8869-00009da67f64","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/935622942737817601?ref_src=twsrc%5Etfw","pattern":"[url:value = 'https://twitter.com/demonslay335/status/935622942737817601?ref_src=twsrc%5Etfw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6020380e-d0c0-05b6-1992-0000d219f4f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/12/hc7-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/12/hc7-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--291f311e-aa96-a0d4-3dd0-0000a99bc1ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hc7-gotya-ransomware-installed-via-remote-desktop-services-spread-with-psexec/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hc7-gotya-ransomware-installed-via-remote-desktop-services-spread-with-psexec/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6609d69a-217b-5ba8-4511-0000aa4ca2d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/11/storagecrypter.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/11/storagecrypter.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65aefb4f-700d-8c8a-54c7-0000499639af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/storagecrypt-ransomware-infecting-nas-devices-using-sambacry/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/storagecrypt-ransomware-infecting-nas-devices-using-sambacry/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8310a272-bf28-b9d1-5ce5-00002285371c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://localbitcoins.com/buy_bitcoins\\n\\nhttps://paxful.com/buy-bitcoin\\n\\nhttp://bitcointalk.org/\\n\\n","pattern":"[url:value = 'https://localbitcoins.com/buy_bitcoins\\\\n\\\\nhttps://paxful.com/buy-bitcoin\\\\n\\\\nhttp://bitcointalk.org/\\\\n\\\\n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--820d21c7-2fdf-2cd3-9dc1-000092b8acb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/11/halloware-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/11/halloware-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b869bcd-017d-1a05-9355-0000fb6f3532","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/halloware-ransomware-on-sale-on-the-dark-web-for-only-40/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/halloware-ransomware-on-sale-on-the-dark-web-for-only-40/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f78d8250-3da1-4724-d21f-000002766ebd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.intezer.com/notpetya-returns-bad-rabbit/","pattern":"[url:value = 'http://www.intezer.com/notpetya-returns-bad-rabbit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0193e273-caea-6ca9-348a-0000a78fc036","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/10/badrabbit-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/10/badrabbit-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02e43f03-173d-21ff-d4c7-00000989f7a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.talosintelligence.com/2017/10/bad-rabbit.html","pattern":"[url:value = 'http://blog.talosintelligence.com/2017/10/bad-rabbit.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e8c5a3c-eac4-484e-c951-00007d5d23d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.welivesecurity.com/wp-content/uploads/2017/10/mbr_cut.png","pattern":"[url:value = 'https://www.welivesecurity.com/wp-content/uploads/2017/10/mbr_cut.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--616c5951-08f3-af87-2658-0000b675ca26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/08/synccrypt-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/08/synccrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fc54884-34a2-3d48-a577-0000c1e4055f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/synccrypt-ransomware-hides-inside-jpg-files-appends-kk-extension/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/synccrypt-ransomware-hides-inside-jpg-files-appends-kk-extension/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bf00d85-161d-4a9f-9b48-00001b9b109f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/synack","pattern":"[url:value = 'https://www.ransomlook.io/group/synack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8052845-760e-6a82-8c28-0000af105048","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://therecord.media/synack-ransomware-gang-releases-decryption-keys-for-old-victims/","pattern":"[url:value = 'https://therecord.media/synack-ransomware-gang-releases-decryption-keys-for-old-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79ce9fd5-ed50-f562-ab26-0000f531cb6e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.zdnet.com/article/synack-ransomware-group-releases-decryption-keys-as-they-rebrand-to-el-cometa","pattern":"[url:value = 'https://www.zdnet.com/article/synack-ransomware-group-releases-decryption-keys-as-they-rebrand-to-el-cometa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47ce167c-7e5a-285b-da73-0000c9d98ebd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/09/synack-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/09/synack-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36b7009d-5dcd-d0fc-20d2-000054b84814","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/synack-ransomware-uses-process-doppelg-nging-technique/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/synack-ransomware-uses-process-doppelg-nging-technique/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3eceb5c-fdb0-a9ab-c337-000085e616ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/synack-ransomware-sees-huge-spike-in-activity/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/synack-ransomware-sees-huge-spike-in-activity/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17267a3b-70a7-28a1-c086-0000e646541c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: test.jpg.XbMiJQiuoh","pattern":"[domain-name:value = 'test.jpg.XbMiJQiuoh']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a15abecf-4df4-a124-e46f-000094eadc8e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: INFO-4ABFA0EF.txt","pattern":"[domain-name:value = 'INFO-4ABFA0EF.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e7e1b2c-8414-84b9-eba4-0000dbaa6da5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/08/flatchestware-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/08/flatchestware-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7199a3f7-c7b0-43e1-ab02-00004804e440","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/900238572409823232","pattern":"[url:value = 'https://twitter.com/struppigel/status/900238572409823232']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--582b62ff-2b55-e5f6-8dd1-0000b199817e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DH5KChhXsAADOIu[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DH5KChhXsAADOIu[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3186501d-6527-5019-5f50-00005ee80efd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/08/xolzsec-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/08/xolzsec-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--322ac6e3-de82-8634-a6d9-000019c9927b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/899916577252028416","pattern":"[url:value = 'https://twitter.com/struppigel/status/899916577252028416']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c16217d8-8a9e-99f1-ed01-0000d1d3a505","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/899537940539478016","pattern":"[url:value = 'https://twitter.com/struppigel/status/899537940539478016']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92cd1582-e9e3-e11d-4a8f-0000c4a7d2cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvM552WsAAuDbi[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvM552WsAAuDbi[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34b7f789-e628-4d5c-3867-0000146a34c0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/899528477824700416","pattern":"[url:value = 'https://twitter.com/struppigel/status/899528477824700416']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--274e58d0-2ca1-4a04-4eb3-00009af9cb72","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvDae7XoAE9usO[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvDae7XoAE9usO[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5077e66a-ea0d-eb2c-caad-00007773bbfd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/08/cyron-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/08/cyron-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5dcbf15-5261-dcab-0eda-000002a30848","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/899524853426008064","pattern":"[url:value = 'https://twitter.com/struppigel/status/899524853426008064']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa9ba4cb-93de-1103-5665-0000c43a0fd4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvA8CDWAAIR5er.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvA8CDWAAIR5er.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fd4942d-25c9-44a9-02a5-00005070c941","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-fileless-code-injecting-sorebrect-ransomware/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-fileless-code-injecting-sorebrect-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21754a25-9d81-05f2-90ee-0000e009e3b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/files/2017/06/SOREBRECT-3.jpg","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/files/2017/06/SOREBRECT-3.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08d35106-283c-d781-324c-00004c81d66f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/05/uiwix-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/05/uiwix-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--858d3cbe-4275-7bab-a7ec-0000db4c1053","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/uiwix-ransomware-using-eternalblue-smb-exploit-to-infect-victims/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/uiwix-ransomware-using-eternalblue-smb-exploit-to-infect-victims/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b7379e9-8da4-28de-34c4-000065b44c33","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/jaff-ransomware-infected-over-100000-computers-in-just-a-few-days/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/jaff-ransomware-infected-over-100000-computers-in-just-a-few-days/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ab10046-9b27-0cd1-512d-00003c0737cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2017/05/jaff-ransomware-analysis/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2017/05/jaff-ransomware-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2fca6df-2fe6-8524-61f9-00003ef59239","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.symantec.com/connect/blogs/jaff-new-ransomware-spread-necurs-botnet","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/jaff-new-ransomware-spread-necurs-botnet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a84a1c0-87d1-8c63-9659-000038101915","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/jaff","pattern":"[url:value = 'https://www.ransomlook.io/group/jaff']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e72939c6-f2bd-25ae-a6d7-00002d62ba6d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/05/jaff-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/05/jaff-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77a6b0c6-9f29-a39c-cdd3-0000ba24074e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/jaff-ransomware-distributed-via-necurs-malspam-and-asking-for-a-3-700-ransom/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/jaff-ransomware-distributed-via-necurs-malspam-and-asking-for-a-3-700-ransom/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--485b2b6a-5868-ee43-2982-00003bff7e05","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.talosintelligence.com/2017/05/jaff-ransomware.html","pattern":"[url:value = 'http://blog.talosintelligence.com/2017/05/jaff-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1364e69d-2940-e2c9-fe11-000043469f35","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://rktazuzi7hbln7sy.onion/","pattern":"[url:value = 'http://rktazuzi7hbln7sy.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f233e86-e6fe-f81c-c0e1-0000f26c488c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/01/vxlock-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/01/vxlock-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--579a6cee-72d9-b533-c82c-00008e98e6a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/zyklon-locker-ransomware-windows-250.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/zyklon-locker-ransomware-windows-250.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f712767d-a848-df96-1c92-000022831162","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/zorro-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/zorro-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7c9e54a-9541-3627-3638-000048ca30a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/844538370323812353","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/844538370323812353']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72cbd698-955f-a853-f0ef-0000dca2d535","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/zimbra-ransomware-aes-optzimbrastore.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/zimbra-ransomware-aes-optzimbrastore.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01c8be75-4bb9-28e4-803a-000049b526a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/617874/zimbra-ransomware-written-in-python-help-and-support-topic-crypto-howtotxt/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/617874/zimbra-ransomware-written-in-python-help-and-support-topic-crypto-howtotxt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34fe02f6-1114-a1bf-e43e-00005b799bb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: how.txt","pattern":"[domain-name:value = 'how.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--874220f6-63c2-483c-fc86-000070c456b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: priest.com","pattern":"[domain-name:value = 'priest.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec024d89-6392-35fd-6845-0000b14b3529","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/zcrypt-ransomware-rsa-2048-email.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/zcrypt-ransomware-rsa-2048-email.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--742f51ff-3045-b25a-1f75-0000429f207b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.technet.microsoft.com/mmpc/2016/05/26/link-lnk-to-ransom/","pattern":"[url:value = 'https://blogs.technet.microsoft.com/mmpc/2016/05/26/link-lnk-to-ransom/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9a650a5-1da6-9d2e-42ef-0000aecb8175","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/808280549802418181","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/808280549802418181']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c94fda2-9c8d-cace-b6eb-000078fa0491","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/xrtn-ransomware-rsa-1024-gnu-privacy.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/xrtn-ransomware-rsa-1024-gnu-privacy.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ff036ae-7a52-1c92-e964-000013315632","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/1006833669447839745","pattern":"[url:value = 'https://twitter.com/siri_urz/status/1006833669447839745']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84d445a4-3e32-7d61-b333-000026b71d1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/xorist","pattern":"[url:value = 'https://decrypter.emsisoft.com/xorist']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c80f14c-6c7d-8e68-ced3-00006de962ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://support.kaspersky.com/viruses/disinfection/2911","pattern":"[url:value = 'https://support.kaspersky.com/viruses/disinfection/2911']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f5a0861-0a2a-28ca-be1b-0000fe04d674","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/Dfj9H66WkAEHazN.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Dfj9H66WkAEHazN.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22246ccf-40ee-be07-0dc2-00009bce548b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/Dfj9G_2XkAE0ZS2.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Dfj9G_2XkAE0ZS2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0e1e555-846d-72f4-7742-00006a057c42","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/wildfire-locker-ransomware-aes-256-cbc.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/wildfire-locker-ransomware-aes-256-cbc.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa17b882-a2b6-3415-ce3e-0000b9082b9d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.opendns.com/2016/07/13/wildfire-ransomware-gaining-momentum/","pattern":"[url:value = 'https://labs.opendns.com/2016/07/13/wildfire-ransomware-gaining-momentum/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22b2cb39-cece-a1ec-4804-0000d2ad47b6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.nomoreransom.org/en/decryption-tools.html","pattern":"[url:value = 'https://www.nomoreransom.org/en/decryption-tools.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67da1be3-c7bc-9b10-5941-000090e2db60","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/crysis-ransomware/78775/","pattern":"[url:value = 'https://securelist.com/crysis-ransomware/78775/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--321339ae-8dfa-e2a5-3a12-0000adaaf992","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/crysis-ransomware-distributed-through-remote-desktop-services","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/crysis-ransomware-distributed-through-remote-desktop-services']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a67687fb-b270-fd4a-dcb9-0000804303bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/crysis-ransomware-master-decryption-keys-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/crysis-ransomware-master-decryption-keys-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--441956eb-7bfc-76fa-04c6-0000d94b28b9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/crysis","pattern":"[url:value = 'https://www.ransomlook.io/group/crysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7d60ba7-eb0e-f322-88b1-0000a405a086","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/crysis-targeting-businesses-in-australia-new-zealand-via-brute-forced-rdps/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/crysis-targeting-businesses-in-australia-new-zealand-via-brute-forced-rdps/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e75db2ad-ceac-0a11-8c58-0000e6ff6a09","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/virus-encoder.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/virus-encoder.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ef24a8-4685-14ec-d1d4-0000e240570e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://media.kaspersky.com/utilities/VirusUtilities/EN/rakhnidecryptor.zip","pattern":"[url:value = 'http://media.kaspersky.com/utilities/VirusUtilities/EN/rakhnidecryptor.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bd4a646-d197-ae5f-8020-0000f982b925","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.welivesecurity.com/2016/11/24/new-decryption-tool-crysis-ransomware/","pattern":"[url:value = 'http://www.welivesecurity.com/2016/11/24/new-decryption-tool-crysis-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74436ce9-e7c0-bba4-e9c2-00001079f952","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: india.com.xtbl","pattern":"[domain-name:value = 'india.com.xtbl']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b535608e-a3f4-df61-99b8-00002c93dc15","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.welivesecurity.com/2014/12/22/win32virlock-first-self-reproducing-ransomware-also-shape-shifter/","pattern":"[url:value = 'http://www.welivesecurity.com/2014/12/22/win32virlock-first-self-reproducing-ransomware-also-shape-shifter/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0850505a-9533-ddf3-1237-0000448de260","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/Virlock.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/Virlock.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e72af63e-4d44-0d89-23db-000043de023e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/08/venuslocker-ransomware-aes-256.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/08/venuslocker-ransomware-aes-256.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecdf8ba7-7864-522d-470b-0000e65a8062","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/venusLocker.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/venusLocker.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8958afe-c6c0-ae24-69ca-00000a250ca6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2016/08/venus-locker-another-net-ransomware/?utm_source=twitter&utm_medium=social","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2016/08/venus-locker-another-net-ransomware/?utm_source=twitter&utm_medium=social']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39d43d37-f5ee-55d2-0672-00003e04e8f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/817851339078336513","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/817851339078336513']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0da0db1a-c4b0-0d9f-5951-000051dddc39","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/vaultcrypt","pattern":"[url:value = 'https://www.ransomlook.io/group/vaultcrypt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--117e71da-1e98-8437-7367-0000f5f1e1d5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/russianRansom.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/russianRansom.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b15d2484-5d6f-7b71-e02d-0000eb328259","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: VAULT.hta","pattern":"[domain-name:value = 'VAULT.hta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8b98a05-c175-295d-a0a8-0000cbb9a783","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: trun.txt","pattern":"[domain-name:value = 'trun.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e4adddf-b17d-ffb6-622e-00002aa685ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: xort.txt","pattern":"[domain-name:value = 'xort.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6509d577-bbbe-dcb7-52e0-0000c38f951a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: VAULT.txt","pattern":"[domain-name:value = 'VAULT.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a9e542a-47d9-4cf7-8711-000008cca091","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://restoredz4xpmuqr.onion","pattern":"[url:value = 'http://restoredz4xpmuqr.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebc06781-c79b-f92c-99ff-0000a5590b22","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/839771195830648833","pattern":"[url:value = 'https://twitter.com/struppigel/status/839771195830648833']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85adc539-edb8-9d66-3fce-0000c126676a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/02/unlock26-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/02/unlock26-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--755ccb28-b743-7410-a9c0-000088fb41d9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/839038399944224768","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/839038399944224768']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90fa14d9-78a5-c658-6e73-000005e887d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/bitmessage-ransomware-aes-256-25-btc.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/bitmessage-ransomware-aes-256-25-btc.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec6c4c30-4302-472e-c830-0000efd8cd91","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: YOUGOTHACKED.TXT","pattern":"[domain-name:value = 'YOUGOTHACKED.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2491c3fe-f23b-fdc4-c00d-00001c3c9c94","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Hellothere.txt","pattern":"[domain-name:value = 'Hellothere.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29260219-8607-9f1e-93ef-000007ba3a07","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/09/unblockupc-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/09/unblockupc-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c88f1fa-e539-d027-7e73-0000a2e1687a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/627582/unblockupc-ransomware-help-support-topic-files-encryptedtxt/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/627582/unblockupc-ransomware-help-support-topic-files-encryptedtxt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc2c7e2e-600a-f588-3067-000045c11603","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/umbrecrypt-ransomware-aes.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/umbrecrypt-ransomware-aes.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--802e7ae5-2670-856c-0ac3-00005259cbd6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.thewindowsclub.com/emsisoft-decrypter-hydracrypt-umbrecrypt-ransomware","pattern":"[url:value = 'http://www.thewindowsclub.com/emsisoft-decrypter-hydracrypt-umbrecrypt-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01e7b977-32ba-2a85-5ce1-0000aea15950","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/turkishRansom.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/turkishRansom.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b44ebb2-c4d1-f87f-494f-0000fe97c065","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/821991600637313024","pattern":"[url:value = 'https://twitter.com/struppigel/status/821991600637313024']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd95a3e5-a7f4-deb3-9b06-00005e10dfb9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/truecrypter-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/truecrypter-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c58ca939-40f6-6d5e-3bb6-0000440753df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/truecrypter-ransomware-accepts-payment-in-bitcoins-or-amazon-gift-card/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/truecrypter-ransomware-accepts-payment-in-bitcoins-or-amazon-gift-card/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5355f235-d06f-509a-5398-0000eb5d44c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/shade","pattern":"[url:value = 'https://www.ransomlook.io/group/shade']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20025b80-3625-27e1-7d9a-0000a202bbbd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/troldesh-ransomware-email.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/troldesh-ransomware-email.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab75dcc-9672-1f48-3c0e-000036d32fc6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/kelihos-botnet-delivering-shade-troldesh-ransomware-with-no-more-ransom-extension/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/kelihos-botnet-delivering-shade-troldesh-ransomware-with-no-more-ransom-extension/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b9e1fc3-9433-9731-f763-0000bd72dd01","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/Troldesh.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/Troldesh.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ac7d2df-ea5e-900d-fc1d-0000c4adc767","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.nomoreransom.org/uploads/ShadeDecryptor_how-to_guide.pdf","pattern":"[url:value = 'https://www.nomoreransom.org/uploads/ShadeDecryptor_how-to_guide.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba718932-0322-6e19-aa8f-000049a7d671","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: original.txt","pattern":"[domain-name:value = 'original.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25e64c08-0562-0226-45e5-0000efc05377","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://cryptorz76e7vuik.onion","pattern":"[url:value = 'http://cryptorz76e7vuik.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a309dfa1-0705-7209-c1aa-000053b0132e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/12/braincrypt-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/12/braincrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb1bcaad-0c46-3a7d-1848-00009ea67d0e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/PolarToffee/status/811249250285842432","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/811249250285842432']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60d8ab3e-5f1f-46fb-8750-00001f78b290","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/BrainCryptDecrypter.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/BrainCryptDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c054493-3b98-c1d9-4f93-0000ef5c3db5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/toxcrypt-ransomware-aes-crypto-0.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/toxcrypt-ransomware-aes-crypto-0.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f82ad70a-71fd-97dc-77ee-0000ec235a8e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/towerweb-ransonware-100.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/towerweb-ransonware-100.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d19b79d-4390-6a7c-f1ed-0000ce52febf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/618055/towerweb-ransomware-help-support-topic-payment-instructionsjpg/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/618055/towerweb-ransomware-help-support-topic-payment-instructionsjpg/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b08089b5-ddc2-627b-217d-0000301ad9c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.ru/2016/05/torrentlocker-ransomware-aes-cbc-2048.html","pattern":"[url:value = 'http://id-ransomware.blogspot.ru/2016/05/torrentlocker-ransomware-aes-cbc-2048.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43ad6043-7640-0fd8-a17c-00004b30c286","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.talosintelligence.com/2017/03/crypt0l0cker-torrentlocker-old-dog-new.html","pattern":"[url:value = 'http://blog.talosintelligence.com/2017/03/crypt0l0cker-torrentlocker-old-dog-new.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13ffd7d1-5ff4-bdb3-913f-00009b46a6ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/PolarToffee/status/804008236600934403","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/804008236600934403']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ce05b97-8c60-0ae3-bbe1-0000f56f8d20","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/547708/torrentlocker-ransomware-cracked-and-decrypter-has-been-made/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/547708/torrentlocker-ransomware-cracked-and-decrypter-has-been-made/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5f98860-ffea-cbc3-2a88-000042c1e784","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Dateien.txt","pattern":"[domain-name:value = 'Dateien.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de7ed69f-e67e-0c4b-e568-000062e6841f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/teslacrypt-4-2-released-with-quite-a-few-modifications/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/teslacrypt-4-2-released-with-quite-a-few-modifications/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bb07fe8-a3db-f235-9de8-000030411248","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.endgame.com/blog/your-package-has-been-successfully-encrypted-teslacrypt-41a-and-malware-attack-chain","pattern":"[url:value = 'https://www.endgame.com/blog/your-package-has-been-successfully-encrypted-teslacrypt-41a-and-malware-attack-chain']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92edb42a-d5c3-e2c5-c2e4-00003e5b63f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: xeyye.txt","pattern":"[domain-name:value = 'xeyye.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--679ab5f6-9d3d-32be-e147-00002320bf0e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: gwote.txt","pattern":"[domain-name:value = 'gwote.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdab46e2-9ca6-e907-52f2-0000b937d33e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/","pattern":"[url:value = 'https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77def821-10c2-66a3-98c2-000070f7fd68","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-recent-variants-teslacrypt-ransomware/","pattern":"[url:value = 'http://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-recent-variants-teslacrypt-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17c827c4-5cbc-49c9-a0c1-00002daa83c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.talosintel.com/teslacrypt_tool/","pattern":"[url:value = 'http://www.talosintel.com/teslacrypt_tool/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06f8853b-2dbc-087a-20e8-000029da59f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6984424d-14b2-ea92-7ddd-00001361dd53","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: arquivos.txt","pattern":"[domain-name:value = 'arquivos.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5daa669-ddb2-d602-4041-00002d2b9561","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/szflocker-polish-ransomware-email.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/szflocker-polish-ransomware-email.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03b8bf69-5cef-801e-fae1-000015973ccb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://now.avg.com/dont-pay-the-ransom-avg-releases-six-free-decryption-tools-to-retrieve-your-files/","pattern":"[url:value = 'http://now.avg.com/dont-pay-the-ransom-avg-releases-six-free-decryption-tools-to-retrieve-your-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4985adc8-f2ce-b20c-4a31-0000edb13714","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08871656-5f67-266b-a8d3-0000ec4348f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ThxForYurTyme.txt","pattern":"[domain-name:value = 'ThxForYurTyme.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fd9c00c-eaac-906a-cf11-0000c99901cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/surprise-ransomware-aes-256.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/surprise-ransomware-aes-256.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29541b80-2f0d-9f00-82ab-0000ddda49da","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: HOWTO.Notepad","pattern":"[domain-name:value = 'HOWTO.Notepad']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acd875c8-0191-5670-5d3e-0000b18a55af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/Strictor.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/Strictor.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91dc1ca7-10a2-50fd-689e-00004153cd78","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/stampado-ransomware-1.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/stampado-ransomware-1.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6645d07a-30fa-fb1f-c48a-00002a9ed84e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/the-economics-behind-ransomware-prices/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/the-economics-behind-ransomware-prices/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--771d56dd-10d0-8929-749f-0000fec075b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://cdn.streamable.com/video/mp4/kfh3.mp4","pattern":"[url:value = 'https://cdn.streamable.com/video/mp4/kfh3.mp4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11b14451-a5df-c11c-b015-0000b17b0823","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/stampado","pattern":"[url:value = 'https://decrypter.emsisoft.com/stampado']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cac02d7-2950-fee8-d6e3-000091e6eb46","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/stampado-ransomware-campaign-decrypted-before-it-started/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/stampado-ransomware-campaign-decrypted-before-it-started/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcc75908-de02-a977-ca31-0000941ca5a4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/sns-locker-ransomware-aes-256-066.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/sns-locker-ransomware-aes-256-066.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fa54a5c-9c5f-4f9a-22ec-00003dfa62bd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nyxbone.com/images/articulos/malware/snslocker/16.png","pattern":"[url:value = 'http://nyxbone.com/images/articulos/malware/snslocker/16.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d92af5c2-c6f5-0f3d-75c7-0000d42ddb77","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nyxbone.com/malware/SNSLocker.html","pattern":"[url:value = 'http://nyxbone.com/malware/SNSLocker.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f4b4a04-63e8-c8ee-7fa4-000018e7d2ba","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/08/smrss32-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/08/smrss32-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35e4182f-3e24-2ffb-5f93-0000e21bfa7e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/smash-ransomware-is-cute-rather-than-dangerous/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/smash-ransomware-is-cute-rather-than-dangerous/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e58afac2-ceb2-086d-e8b6-00008563646c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/pompous-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/pompous-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f766c3b2-9d4a-e8b0-9d64-000076aa2fc7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/SkidLocker.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/SkidLocker.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9d14894-49a2-1af2-9cac-0000c7187234","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/pompous-ransomware-dev-gets-defeated-by-backdoor/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/pompous-ransomware-dev-gets-defeated-by-backdoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19907911-36b3-2740-2df0-0000e760dd0b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/tilde-ransomware-aes-08.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/tilde-ransomware-aes-08.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a848680-7993-cd4a-9283-0000924f26a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/chinese-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/chinese-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e6ff35c-dfb5-baec-4cf8-0000734c5c83","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/chinese-language-ransomware-makes-appearance/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/chinese-language-ransomware-makes-appearance/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0a4ee0f-2d73-10fc-50f9-0000ee6cbbf0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/chineseRansom.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/chineseRansom.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14b4d92b-ed92-47c2-86a6-00005c98e578","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/08/shinolocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/08/shinolocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44685319-f127-d434-4e72-0000357e3ae8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-educational-shinolocker-ransomware-project-released/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-educational-shinolocker-ransomware-project-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--097f05ee-da65-281f-d714-0000eac720e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/760560147131408384","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/760560147131408384']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a72e17dd-1731-7e58-9a0f-0000a8726a33","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/shark-ransomware-rebrands-as-atom-for-a-fresh-start/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/shark-ransomware-rebrands-as-atom-for-a-fresh-start/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f21be531-0735-4a8c-d522-000078b304be","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb717253-9362-70ad-cac6-0000a0878f72","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/08/serpico-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/08/serpico-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8de34f79-2018-48de-44b6-0000e1b4f6f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/Serpico.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/Serpico.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb3b3585-8514-691b-3c53-000000b2b7ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://securelist.com/blog/research/69481/a-flawed-ransomware-encryptor/","pattern":"[url:value = 'http://securelist.com/blog/research/69481/a-flawed-ransomware-encryptor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e2b5958-0a7b-19d8-8bf3-0000511c25c5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/satana-ransomware-0.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/satana-ransomware-0.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee0d93a1-d878-1d41-f527-00000811d773","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.kaspersky.com/satana-ransomware/12558/","pattern":"[url:value = 'https://blog.kaspersky.com/satana-ransomware/12558/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95ac2aed-00ab-5c68-0ca8-0000e5472523","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2016/06/satana-ransomware/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2016/06/satana-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05bd2d6a-6853-6702-6023-0000de448d2e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ausi.com","pattern":"[domain-name:value = 'ausi.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef9ba4df-75ce-4acc-116f-0000df15046d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/835955409953357825","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/835955409953357825']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7505ca7e-a60b-aef4-4ef2-0000eb66cbca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/sanctions-2017-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/sanctions-2017-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9f7e619-f895-85a0-9327-0000cc7cee3d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sanctions-ransomware-makes-fun-of-usa-sanctions-against-russia/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sanctions-ransomware-makes-fun-of-usa-sanctions-against-russia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--223616a4-4668-05f3-405f-0000f925907e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/sanction-ransomware-3.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/sanction-ransomware-3.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d22ce81-264d-2031-4ff7-000094988fb0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/samsam","pattern":"[url:value = 'https://www.ransomlook.io/group/samsam']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0e1f754-e2f7-e70f-ecc5-000013336696","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/03/samsam.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/03/samsam.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f172296-1c8f-c04f-15aa-000029894214","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf","pattern":"[url:value = 'https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fe0acd5-f2fd-61a2-d631-0000dd8ca3e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/samsam-ransomware-crew-made-nearly-6-million-from-ransom-payments/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/samsam-ransomware-crew-made-nearly-6-million-from-ransom-payments/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dddfe401-cc14-4412-555a-0000d9cad6e9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-samsam-variant-requires-special-password-before-infection/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-samsam-variant-requires-special-password-before-infection/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b891789-14ba-fa77-e152-00008b75da98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.intelsecurity.com/advanced-threat-research/content/Analysis_SamSa_Ransomware.pdf","pattern":"[url:value = 'http://www.intelsecurity.com/advanced-threat-research/content/Analysis_SamSa_Ransomware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caa1f84c-643d-6645-bfbd-0000f042c90b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.talosintel.com/2016/03/samsam-ransomware.html","pattern":"[url:value = 'http://blog.talosintel.com/2016/03/samsam-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7227c58-8c43-1010-6d09-0000c0334d0f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/SamSamStringDecrypter.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/SamSamStringDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6ae352e-beca-1d8e-d0a2-000055fa62fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malwarebreakdown.com/2017/03/10/finding-a-good-man/","pattern":"[url:value = 'https://malwarebreakdown.com/2017/03/10/finding-a-good-man/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f885c6b8-9970-47c7-cd73-00003f49ed99","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://malwarebreakdown.com/2017/03/16/sage-2-2-ransomware-from-good-man-gate","pattern":"[url:value = 'https://malwarebreakdown.com/2017/03/16/sage-2-2-ransomware-from-good-man-gate']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a882f542-96cd-0804-5a0e-0000ed15eb5c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/sadstory-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/sadstory-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--993e48fb-7d1a-1ce3-40bd-0000b42601a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/845356853039190016","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/845356853039190016']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a12071a1-53af-9c49-e772-000021861a27","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/823925410392080385","pattern":"[url:value = 'https://twitter.com/struppigel/status/823925410392080385']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d02edd4-be3c-8716-551b-00007b2834b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/801812325657440256","pattern":"[url:value = 'https://twitter.com/struppigel/status/801812325657440256']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--899cf298-0b99-7312-9a30-0000d845f03f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/02/allyourdocuments-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/02/allyourdocuments-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e274ea6a-fb3f-8d32-71c3-000042cfa5f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/842452104279134209","pattern":"[url:value = 'https://twitter.com/siri_urz/status/842452104279134209']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6326f97c-7edf-2374-c665-0000beee0bf0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/rokku-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/rokku-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8e862ba-2596-6878-e847-0000c5a55daf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.org/threat-analysis/2016/04/rokku-ransomware/","pattern":"[url:value = 'https://blog.malwarebytes.org/threat-analysis/2016/04/rokku-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5452297-bcb9-948e-88de-0000030e5da0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: UNLOCK.TXT","pattern":"[domain-name:value = 'UNLOCK.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6f7d6b8-dbcc-9462-97b7-0000cb80ef96","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/remindme-ransomware-2.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/remindme-ransomware-2.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13ed4c45-ce81-3c7b-8f15-00000050945a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://i.imgur.com/gV6i5SN.jpg","pattern":"[url:value = 'http://i.imgur.com/gV6i5SN.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10f8f139-19bb-03a6-e8e0-0000610d3173","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/RemindMe.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/RemindMe.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f56c0957-03d5-98b3-b4bd-00000843eb54","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/08/rektlocker-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/08/rektlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a952339-16f1-b261-7e86-0000e1008b61","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://support.kaspersky.com/viruses/disinfection/4264","pattern":"[url:value = 'https://support.kaspersky.com/viruses/disinfection/4264']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb6c4297-efca-a62d-8d4d-00008a61ebd4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/08/razy-ransomware-aes.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/08/razy-ransomware-aes.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e87e99c8-3014-f0a1-b30f-00007cf4efd6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nyxbone.com/malware/Razy.html","pattern":"[url:value = 'http://nyxbone.com/malware/Razy.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b80da01-f329-658d-dee6-000063db81a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/Razy(German).html","pattern":"[url:value = 'http://www.nyxbone.com/malware/Razy(German).html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dccd0eb1-e0bd-3ed8-871e-00004bbc42d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/09/rarvault-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/09/rarvault-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15b64503-868e-6693-ce49-0000593c561b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.symantec.com/security_response/writeup.jsp?docid=2009-041513-1400-99&tabid=2","pattern":"[url:value = 'https://www.symantec.com/security_response/writeup.jsp?docid=2009-041513-1400-99&tabid=2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7574b46d-ed7e-5653-710b-000063b8c331","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/ransom32.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/ransom32.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20130c3b-af14-b18d-dcb1-0000f443412d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransoc-ransomware-extorts-users-who-accessed-questionable-content/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransoc-ransomware-extorts-users-who-accessed-questionable-content/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd5d60b2-7ba1-c9d9-e816-0000428b29e3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/ransoc-desktop-locking-ransomware-ransacks-local-files-social-media-profiles","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/ransoc-desktop-locking-ransomware-ransacks-local-files-social-media-profiles']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--803d4f5e-0ba2-da65-0ccc-0000bddd594f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-ranran-ransomware-uses-encryption-tiers-political-messages/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-ranran-ransomware-uses-encryption-tiers-political-messages/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d98c8cfc-f8b8-b866-2f5a-00003b90d78f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2017/03/unit42-targeted-ransomware-attacks-middle-eastern-government-organizations-political-purposes/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2017/03/unit42-targeted-ransomware-attacks-middle-eastern-government-organizations-political-purposes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93c48656-f132-f8bc-9adb-00006d972e5b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/pan-unit42/public_tools/tree/master/ranran_decryption","pattern":"[url:value = 'https://github.com/pan-unit42/public_tools/tree/master/ranran_decryption']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e251f009-ede5-2780-f55f-000011457397","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Agent.iih","pattern":"[domain-name:value = 'Agent.iih']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b29824d-5762-00a9-909b-0000c73339a3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/bandarchor-ransomware-aes-256.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/bandarchor-ransomware-aes-256.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ac3b830-1e52-a69d-4d21-0000fe6c17ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://support.kaspersky.com/us/viruses/disinfection/10556","pattern":"[url:value = 'https://support.kaspersky.com/us/viruses/disinfection/10556']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2587e801-6357-9c4d-eb36-000010cf40db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/radamant-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/radamant-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fa83f5c-8538-4e57-20be-000011039313","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/radamant.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/radamant.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f800461a-9229-b938-bd08-000043e48b73","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-radamant-ransomware-kit-adds-rdm-extension-to-encrypted-files/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-radamant-ransomware-kit-adds-rdm-extension-to-encrypted-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af392530-6058-0025-a739-000067ebf87e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/radamant","pattern":"[url:value = 'https://decrypter.emsisoft.com/radamant']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9504c29d-ed74-6e80-0b70-0000e13e4d61","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: FILES.url","pattern":"[domain-name:value = 'FILES.url']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5712097d-f59a-1174-fef0-00008a2474fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/CryptoInsane/status/846181140025282561","pattern":"[url:value = 'https://twitter.com/CryptoInsane/status/846181140025282561']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce8d91fe-81ac-df49-fcf3-0000b07f5f7c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/raa-ransomware-aes-256-039-250.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/raa-ransomware-aes-256-039-250.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--088141a8-9949-5419-ab88-000050c0848c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/the-new-raa-ransomware-is-created-entirely-using-javascript/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/the-new-raa-ransomware-is-created-entirely-using-javascript/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f9fa1a0-4b89-ce78-44e9-0000faa21b3c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://reaqta.com/2016/06/raa-ransomware-delivering-pony/","pattern":"[url:value = 'https://reaqta.com/2016/06/raa-ransomware-delivering-pony/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b66fc4a-82b4-7aa9-9426-000095a3277f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/07/r980-ransomware-aes-256-rsa4096-05.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/07/r980-ransomware-aes-256-rsa4096-05.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d567502-2f7d-b378-7808-000027b2e8df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://otx.alienvault.com/pulse/57976b52b900fe01376feb01/","pattern":"[url:value = 'https://otx.alienvault.com/pulse/57976b52b900fe01376feb01/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8170942c-4d3e-da10-4db3-000078898bbd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: rtext.txt","pattern":"[domain-name:value = 'rtext.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4455995c-433d-29a2-3bb7-00002a520616","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/r-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/r-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db382a3e-6dde-17b0-2157-00009deaf959","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/846705481741733892","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/846705481741733892']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d02f12b3-5fc3-5350-9787-0000540f316a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Ransomware.txt","pattern":"[domain-name:value = 'Ransomware.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b8b5b0a-4d37-dbf3-693b-0000dac41e24","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/jiriatvirlab/status/803297700175286273","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/803297700175286273']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b961fb1-e26c-5900-6f43-0000e4dce97d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.enigmasoftware.com/prismyourcomputerhasbeenlockedransomware-removal/","pattern":"[url:value = 'http://www.enigmasoftware.com/prismyourcomputerhasbeenlockedransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce2f94f2-d45e-39ef-4f8a-0000fcca9099","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/09/princess-locker-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/09/princess-locker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46c5f802-9b5d-d17d-40f1-0000c099cc0c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2016/11/princess-ransomware/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2016/11/princess-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca87cadd-6037-b8b9-abd0-000033eeca40","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/introducing-her-royal-highness-the-princess-locker-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/introducing-her-royal-highness-the-princess-locker-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a550607-47d3-145c-4fe1-0000bc62519c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://hshrzd.wordpress.com/2016/11/17/princess-locker-decryptor/","pattern":"[url:value = 'https://hshrzd.wordpress.com/2016/11/17/princess-locker-decryptor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9962b6b1-25da-4dd9-6202-00008a559f98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: JJnY.txt","pattern":"[domain-name:value = 'JJnY.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c49b7c9-649f-8dee-ed08-0000ce8c29b6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/powerware-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/powerware-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3454f24-6776-898f-813b-0000ba654df4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fc8d62e-0503-e01c-c157-0000847806d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/","pattern":"[url:value = 'https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--860d37e9-f714-600c-c7b8-0000bcf3728e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/PowerLockyDecrypter.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/PowerLockyDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--745e5f7d-fe48-d8df-542a-000019af83b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/pan-unit42/public_tools/blob/master/powerware/powerware_decrypt.py","pattern":"[url:value = 'https://github.com/pan-unit42/public_tools/blob/master/powerware/powerware_decrypt.py']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d640b4a8-31c7-997c-7063-0000d568638c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/blog/research/76182/polyglot-the-fake-ctb-locker/","pattern":"[url:value = 'https://securelist.com/blog/research/76182/polyglot-the-fake-ctb-locker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9141b81-e96e-6883-1ffd-0000a76d2b37","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://support.kaspersky.com/8547","pattern":"[url:value = 'https://support.kaspersky.com/8547']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fad1d99-4950-b33e-7401-000051bf75d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/08/pokemongo-ransomware-aes-256.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/08/pokemongo-ransomware-aes-256.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62b33043-9765-c3e1-0483-00000b84a290","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/pokemongo-ransomware-installs-backdoor-accounts-and-spreads-to-other-drives/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/pokemongo-ransomware-installs-backdoor-accounts-and-spreads-to-other-drives/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78e00722-dc0e-dfd7-ed8e-000020f4a3e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/pokemonGO.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/pokemonGO.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c04d6871-9543-e1f4-9841-0000040c9b8b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/pizzacrypts-ransomware-1.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/pizzacrypts-ransomware-1.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfc47cfe-40f3-cc84-fd46-000054af2b98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://download.bleepingcomputer.com/BloodDolly/JuicyLemonDecoder.zip","pattern":"[url:value = 'http://download.bleepingcomputer.com/BloodDolly/JuicyLemonDecoder.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6e24c20-88a6-03d7-8d3b-0000d452cd34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: pizzacrypts.info","pattern":"[domain-name:value = 'pizzacrypts.info']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80d5f927-de99-d4c5-4cb3-0000fab369e4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.ru/2016/09/philadelphia-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.ru/2016/09/philadelphia-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e418927-824e-097c-e3b9-000028c0eb34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: www.bleepingcomputer.com","pattern":"[domain-name:value = 'www.bleepingcomputer.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a872f1c4-90d1-c215-f208-0000d17cbb76","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/philadelphia","pattern":"[url:value = 'https://decrypter.emsisoft.com/philadelphia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--047399a6-25b7-86fd-d580-0000400c75ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/petya","pattern":"[url:value = 'https://www.ransomlook.io/group/petya']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bef200e-4e77-c0f5-b02c-00005bd9b384","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.org/threat-analysis/2016/04/petya-ransomware/","pattern":"[url:value = 'https://blog.malwarebytes.org/threat-analysis/2016/04/petya-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ead4e680-e8b7-02c6-fe6d-00009cd91c63","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=mSqxFjZq_z4","pattern":"[url:value = 'https://www.youtube.com/watch?v=mSqxFjZq_z4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--425870ac-e01d-8134-65e3-00006e9b41d8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.thewindowsclub.com/petya-ransomware-decrypt-tool-password-generator","pattern":"[url:value = 'http://www.thewindowsclub.com/petya-ransomware-decrypt-tool-password-generator']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e092a1f6-8eb5-1645-e8b6-0000ec2235ec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://petya5koahtsf7sv.onion","pattern":"[url:value = 'http://petya5koahtsf7sv.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecb059e4-c539-b0a5-07a1-0000fa8568af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://petya37h5tbhyvki.onion","pattern":"[url:value = 'http://petya37h5tbhyvki.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--725a9373-5fc9-df9f-8fad-00007313f2e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-macos-patcher-ransomware-locks-data-for-good-no-way-to-recover-your-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-macos-patcher-ransomware-locks-data-for-good-no-way-to-recover-your-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afcb8176-5d9e-3e6b-beec-00008a24e3d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/cybercrime/2017/02/decrypting-after-a-findzip-ransomware-infection/","pattern":"[url:value = 'https://blog.malwarebytes.com/cybercrime/2017/02/decrypting-after-a-findzip-ransomware-infection/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b830b7d3-1bbf-dce4-579c-0000f6e4c6ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/811635075158839296","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/811635075158839296']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d6b89d9-6f7d-2a4a-252b-0000460fd0de","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/padcrypt-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/padcrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c851d13d-47bc-b1b6-044f-00005c8aa699","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/798141978810732544","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/798141978810732544']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3320bfc9-f70d-339b-5411-0000323b7aed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/padcrypt-the-first-ransomware-with-live-support-chat-and-an-uninstaller/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/padcrypt-the-first-ransomware-with-live-support-chat-and-an-uninstaller/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd6882ff-de2a-985f-87b1-00000032625d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/10/cryptowire-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/10/cryptowire-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b68a1503-a841-bf06-e856-0000cce8776b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/842342996775448576","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/842342996775448576']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a051b167-b037-1f1c-a6c0-0000353635ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: log.txt","pattern":"[domain-name:value = 'log.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0fc11a3-19db-603a-3866-000038befc26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: file.encrypted","pattern":"[domain-name:value = 'file.encrypted']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fcddf5a-d368-e72c-1a62-00007628899a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://news.thewindowsclub.com/operation-global-iii-ransomware-decryption-tool-released-70341/","pattern":"[url:value = 'http://news.thewindowsclub.com/operation-global-iii-ransomware-decryption-tool-released-70341/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82c87661-51ac-01d4-70a9-000051b970c9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://arxiv.org/pdf/2102.06249.pdf","pattern":"[url:value = 'https://arxiv.org/pdf/2102.06249.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b387909-c000-c6e4-fa7a-0000ac9be952","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: data.txt","pattern":"[domain-name:value = 'data.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52a87fdf-67fc-8618-3aeb-000002097912","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.digital.nhs.uk/cyber-alerts/2018/cc-2542","pattern":"[url:value = 'https://www.digital.nhs.uk/cyber-alerts/2018/cc-2542']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b8d8eca-1d2e-7fcf-11ee-00005e471c1b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/free-decryption-tool-released-for-cryakl-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/free-decryption-tool-released-for-cryakl-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39752cf8-e4fb-2d8a-1dfc-000056ff89e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/the-return-of-fantomas-or-how-we-deciphered-cryakl/86511","pattern":"[url:value = 'https://securelist.com/the-return-of-fantomas-or-how-we-deciphered-cryakl/86511']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae8f1b54-3ac5-1a13-3725-00004bf29647","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.pcrisk.com/removal-guides/11220-cryakl-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/11220-cryakl-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4854e82-1a3e-d2ab-c30e-0000e5ef9f80","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/cryakl","pattern":"[url:value = 'https://www.ransomlook.io/group/cryakl']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--653b2a3d-3391-819f-036d-000006a51604","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://bartblaze.blogspot.com.co/2016/02/vipasana-ransomware-new-ransom-on-block.html","pattern":"[url:value = 'http://bartblaze.blogspot.com.co/2016/02/vipasana-ransomware-new-ransom-on-block.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c932c8f-043e-130b-ba0e-00004e28b02f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/odcodc-ransomware-rsa-2048.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/odcodc-ransomware-rsa-2048.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--369900be-2644-5164-1966-0000b265bd62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/images/articulos/malware/odcodc/1c.png","pattern":"[url:value = 'http://www.nyxbone.com/images/articulos/malware/odcodc/1c.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66d8cee6-e353-b126-be27-0000846849fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/PolarToffee/status/813762510302183424","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/813762510302183424']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74baef47-0a21-e825-6153-000073f16b2e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/odcodc.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/odcodc.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--076c807d-8d90-6c16-5d06-0000d7d80b92","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://download.bleepingcomputer.com/BloodDolly/ODCODCDecoder.zip","pattern":"[url:value = 'http://download.bleepingcomputer.com/BloodDolly/ODCODCDecoder.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b35f44e9-c038-b9f9-da87-00006fe7f575","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ARCHIVO.ext","pattern":"[domain-name:value = 'ARCHIVO.ext']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f06c8384-2192-250a-1400-000046e010f9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/08/nullbyte-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/08/nullbyte-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09b74fa4-a41e-bc63-1bde-000008e3c5fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-nullbyte-ransomware-pretends-to-be-the-necrobot-pokemon-go-application/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-nullbyte-ransomware-pretends-to-be-the-necrobot-pokemon-go-application/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a98ca3e8-38c5-bbf6-d781-000032a3e43e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/NullByteDecrypter.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/NullByteDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86aefd02-7901-76bf-9809-0000678e8059","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/10/nuke-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/10/nuke-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14e6f154-9958-9db6-99bb-0000db0d5467","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/noobcrypt-ransomare-250-nzd.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/noobcrypt-ransomare-250-nzd.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48466a6a-7a14-1a10-7640-0000b19b6c98","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/noobcrypt-ransomware-dev-shows-noobness-by-using-same-password-for-everyone/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/noobcrypt-ransomware-dev-shows-noobness-by-using-same-password-for-everyone/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81ced76d-3a82-c167-258e-000006dca133","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/757267550346641408","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/757267550346641408']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a7af4c9-a16e-b6eb-9dff-00006d38a9e4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: id-ransomware.blogspot.com","pattern":"[domain-name:value = 'id-ransomware.blogspot.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71305c51-38bb-b025-980b-0000a9df23ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/fwosar/status/803682662481174528","pattern":"[url:value = 'https://twitter.com/fwosar/status/803682662481174528']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e07b650-b83d-4203-f8b1-0000b431f7cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/nmoreira","pattern":"[url:value = 'https://decrypter.emsisoft.com/nmoreira']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4352cfd4-efde-e25b-926c-0000b7f12358","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/nhtnwcuf-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/nhtnwcuf-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99541581-6799-0d46-19f0-00004f324779","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/839221457360195589","pattern":"[url:value = 'https://twitter.com/demonslay335/status/839221457360195589']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58ab5f53-275f-cfe1-1f50-00006f35dd44","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: PLEASE.txt","pattern":"[domain-name:value = 'PLEASE.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c151b13-6250-6dc1-38b6-00002efd77aa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/01/netflix-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/01/netflix-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e3e1e8b-62a5-7554-16a1-00000c3693e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/nemucod-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/nemucod-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--135fbb36-6903-d7f6-e9de-00002875e789","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.cisecurity.org/malware-analysis-report-nemucod-ransomware/","pattern":"[url:value = 'https://blog.cisecurity.org/malware-analysis-report-nemucod-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cca90730-0a43-26ea-5bb0-000030562d79","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/decryptor-released-for-the-nemucod-trojans-crypted-ransomware/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/decryptor-released-for-the-nemucod-trojans-crypted-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bed5148d-857b-7a2a-2958-0000c58c3ccd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/Antelox/NemucodFR","pattern":"[url:value = 'https://github.com/Antelox/NemucodFR']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a118f374-68d2-ccb2-541a-00008b73afab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/nemucod","pattern":"[url:value = 'https://decrypter.emsisoft.com/nemucod']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--865c0223-ebc7-df4f-2504-00003832eddb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Decrypted.txt","pattern":"[domain-name:value = 'Decrypted.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ebed16d-c3cd-4362-9e46-000000837716","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/nanolocker-ransomware-aes-256-rsa-01.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/nanolocker-ransomware-aes-256-rsa-01.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d6a367d-1fe4-07ca-e54a-00008c24a7b3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://github.com/Cyberclues/nanolocker-decryptor","pattern":"[url:value = 'http://github.com/Cyberclues/nanolocker-decryptor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81391829-07cc-aaae-84e7-0000ba4e502a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ATTENTION.RTF","pattern":"[domain-name:value = 'ATTENTION.RTF']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0eaf9e9c-9567-8997-ac56-0000a9d41dd9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/09/n1n1n1-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/09/n1n1n1-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a62a5a2-30f3-768a-6636-00005e468442","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/831891344897482754","pattern":"[url:value = 'https://twitter.com/demonslay335/status/831891344897482754']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e07fcb6a-06ca-9ba5-a459-000059826990","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/790608484303712256","pattern":"[url:value = 'https://twitter.com/demonslay335/status/790608484303712256']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--778e4fe8-899f-f628-18b7-00002e66392c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=dAVMgX8Zti4&feature=youtu.be&list=UU_TMZYaLIgjsdJMwurHAi4Q","pattern":"[url:value = 'https://www.youtube.com/watch?v=dAVMgX8Zti4&feature=youtu.be&list=UU_TMZYaLIgjsdJMwurHAi4Q']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ff69c4d-b475-3d2e-bf14-0000051ec91d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/815961663644008448","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/815961663644008448']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5749eacf-a4f5-27c6-9d31-0000c51476d6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/844826339186135040","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/844826339186135040']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0159c003-5ff3-6291-db5e-00002f7dc5e8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/mobef-yakes-ransomware-4-bitcoins-2000.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/mobef-yakes-ransomware-4-bitcoins-2000.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2312a3b8-70eb-c732-14b7-000049a87447","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nyxbone.com/images/articulos/malware/mobef/0.png","pattern":"[url:value = 'http://nyxbone.com/images/articulos/malware/mobef/0.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d930116-789b-4f8d-3f7f-00009cc0698e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/07/unit42-cryptobit-another-ransomware-family-gets-an-update/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/07/unit42-cryptobit-another-ransomware-family-gets-an-update/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--368d4f47-1128-ff1b-7853-0000654b728a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nyxbone.com/malware/Mobef.html","pattern":"[url:value = 'http://nyxbone.com/malware/Mobef.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07f5d3f8-95af-9976-47b4-000024ca70e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: 4-14-2016-INFECTION.TXT","pattern":"[domain-name:value = '4-14-2016-INFECTION.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6353b416-2702-c92b-518e-00000448846c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: IMPORTANT.README","pattern":"[domain-name:value = 'IMPORTANT.README']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d5b7090-1e83-d13e-d828-0000dae30cc9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/mm-locker-ransomware-aes-2256-1.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/mm-locker-ransomware-aes-2256-1.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5930e590-7145-d900-463d-00000cb5ca02","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/05/petya-mischa-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/05/petya-mischa-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a18921f6-f48b-813d-c2dd-00005dc4640a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/petya-is-back-and-with-a-friend-named-mischa-ransomware/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/petya-is-back-and-with-a-friend-named-mischa-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36fb0eb9-cbe6-e983-9a5e-00008a15861d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/mireware-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/mireware-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94a8bd8e-45be-9dbb-cf6d-000096bb889f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/mircop-ransomware-4848.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/mircop-ransomware-4848.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34e53553-94b1-92c4-3c6a-0000e8dd0132","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/Mircop.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/Mircop.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f59c32e-d48c-ac30-3fee-000034c543f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/instruction-less-ransomware-mircop-channels-guy-fawkes/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/instruction-less-ransomware-mircop-channels-guy-fawkes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b25aabb8-511c-ba10-dcaf-0000f976377c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.avast.com/ransomware-decryption-tools#!","pattern":"[url:value = 'https://www.avast.com/ransomware-decryption-tools#!']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f29e6146-1107-c177-94bc-0000eb30508b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/618457/microcop-ransomware-help-support-lock-mircop/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/618457/microcop-ransomware-help-support-lock-mircop/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--815901e8-80ad-e144-c0a3-0000582b1c26","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/meteoritan-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/meteoritan-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e030077a-6ef7-bce4-9198-0000c4880ea3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/844614889620561924","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/844614889620561924']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8de2555-412f-4296-f2a7-000017998639","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/840913419024945152","pattern":"[url:value = 'https://twitter.com/siri_urz/status/840913419024945152']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23d4007a-d0b0-a53e-ce0c-00002caebec6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/09/jokefrommars-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/09/jokefrommars-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8af075d2-6205-cc5a-c98a-0000958edbd5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/MarsJoke-Ransomware-Mimics-CTB-Locker","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/MarsJoke-Ransomware-Mimics-CTB-Locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa132838-8f3b-3e0a-ae50-000007ed1e58","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.ru/blog/issledovaniya/29376/polyglot-the-fake-ctb-locker/","pattern":"[url:value = 'https://securelist.ru/blog/issledovaniya/29376/polyglot-the-fake-ctb-locker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b55b6c0-09cd-3afc-871a-0000cc477f20","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/maktub-locker-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/maktub-locker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a61426fd-674e-ef48-394f-0000906ef2d2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.org/threat-analysis/2016/03/maktub-locker-beautiful-and-dangerous/","pattern":"[url:value = 'https://blog.malwarebytes.org/threat-analysis/2016/03/maktub-locker-beautiful-and-dangerous/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36e96600-a573-e197-abb2-00001e07d365","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/magic-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/magic-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7ba262d-23eb-c4de-e701-0000e0c4942c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ReadMe1.TXT","pattern":"[domain-name:value = 'ReadMe1.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a1a4527-7ee5-25c7-2061-0000b918576b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/macandchess-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/macandchess-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a578c01-179d-f143-69c2-0000978d3cc3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=9nJv_PN2m1Y","pattern":"[url:value = 'https://www.youtube.com/watch?v=9nJv_PN2m1Y']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0425bf26-6d06-d7cb-5b17-0000e0ef19c8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/12/m4n1f3sto-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/12/m4n1f3sto-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e679eff-a29a-3e9e-e3f9-000076fa2262","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/jiriatvirlab/status/808015275367002113","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/808015275367002113']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c6b40db-e288-7c6f-7a45-00005fb368f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/lowlevel04-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/lowlevel04-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2c9d383-842d-5b1b-16bd-00005fa80c5d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/lortok-ransomware-aes-256-5.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/lortok-ransomware-aes-256-5.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc2f5e31-b102-a664-bc99-00005e368736","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/locky","pattern":"[url:value = 'https://www.ransomlook.io/group/locky']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--271a6222-47cc-86b2-2c15-000065162758","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/02/locky.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/02/locky.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc587f7f-454e-9457-26a5-000066ccd6f0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-egyptian-mythology-with-the-osiris-extension/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-egyptian-mythology-with-the-osiris-extension/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0afb239-ab8e-c272-16a1-00004f56e902","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://nakedsecurity.sophos.com/2016/10/06/odin-ransomware-takes-over-from-zepto-and-locky/","pattern":"[url:value = 'https://nakedsecurity.sophos.com/2016/10/06/odin-ransomware-takes-over-from-zepto-and-locky/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78bf6005-0f18-dfe6-5d7b-0000cc9e4287","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/new-locky-ransomware-spotted-in-the-brazilian-underground-market-uses-windows-script-files/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/new-locky-ransomware-spotted-in-the-brazilian-underground-market-uses-windows-script-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a495139-dccd-ecd1-e0b2-0000736c0e0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-locky-version-adds-the-zepto-extension-to-encrypted-files/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-locky-version-adds-the-zepto-extension-to-encrypted-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc9578e6-368a-b3d9-9f8b-00003e9a7d75","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://i3ezlvkoi7fwyood.onion","pattern":"[url:value = 'http://i3ezlvkoi7fwyood.onion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da7c7b28-51a6-6781-aa38-00005750cf06","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://6dtxgqam4crv6rr6.onion/","pattern":"[url:value = 'http://6dtxgqam4crv6rr6.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a82aba3-3794-e27b-2e18-0000610d2183","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/09/locklock-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/09/locklock-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eaf24002-cc04-5060-d029-000054384d1f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/626750/locklock-ransomware-locklock-help-support/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/626750/locklock-ransomware-locklock-help-support/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a14245e1-23fc-36ce-a72e-0000498a6464","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/locker-ransomware-2015.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/locker-ransomware-2015.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ad16260-15e5-25ad-19f5-00001abe65c3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/577246/locker-ransomware-support-and-help-topic/page-32#entry3721545","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/577246/locker-ransomware-support-and-help-topic/page-32#entry3721545']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdc27742-a647-b868-4f19-0000927c5010","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/lltp-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/lltp-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0c208b9-15f1-f589-9f5d-0000834aa905","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-lltp-ransomware-appears-to-be-a-rewritten-venus-locker/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-lltp-ransomware-appears-to-be-a-rewritten-venus-locker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dde0c628-a229-0213-4791-0000792d6370","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: LEAME.txt","pattern":"[domain-name:value = 'LEAME.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b0f81f4-58b2-9e2a-50e7-0000f49c2a32","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/lk-encryption-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/lk-encryption-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e3d58c3-11c4-ffea-6764-00004d95f664","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/845183290873044994","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/845183290873044994']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58b8e832-2065-ec99-11e0-00004cd62dce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Linux.Encoder","pattern":"[domain-name:value = 'Linux.Encoder']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bad94d4f-ccac-e3c0-6213-00003568d4d1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/","pattern":"[url:value = 'https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a0055d9-f5b2-16b9-03bb-0000b1e2e22a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.2-spyware.com/remove-lick-ransomware-virus.html","pattern":"[url:value = 'https://www.2-spyware.com/remove-lick-ransomware-virus.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f8593d4-2698-0f2a-07a3-0000b948761b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/842404866614038529","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/842404866614038529']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f21d655-2ab8-1a7e-e4ec-0000050adb6d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/lechiffre-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/lechiffre-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e2e5347-8e1e-9b8b-6c73-0000cce3ddbd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.org/threat-analysis/2016/01/lechiffre-a-manually-run-ransomware/","pattern":"[url:value = 'https://blog.malwarebytes.org/threat-analysis/2016/01/lechiffre-a-manually-run-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb52e3cb-52ab-9bbd-b736-000099baac03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/lechiffre","pattern":"[url:value = 'https://decrypter.emsisoft.com/lechiffre']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ef4e244-e0d4-72fa-8e20-0000557dc7b7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/lanran-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/lanran-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c57402c9-ff64-4208-135e-00000f563f03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/847689644854595584","pattern":"[url:value = 'https://twitter.com/struppigel/status/847689644854595584']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59fff86b-b22c-1038-b759-00004193e50e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/kryptolocker-ransomware-aes-256.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/kryptolocker-ransomware-aes-256.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb81c917-b3c4-d8a5-1869-00006d982f01","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/kratoscrypt-ransomware-aes-256-0.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/kratoscrypt-ransomware-aes-256-0.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d31ae7b7-663a-7960-02f2-0000d83a31b9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/746090483722686465","pattern":"[url:value = 'https://twitter.com/demonslay335/status/746090483722686465']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2de4b5d-a0ee-e9b3-dc45-0000e2f491e2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/kozy.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/kozy.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75e3c597-af1f-7b46-674e-000083a47b67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/617802/kozyjozy-ransomware-help-support-wjpg-31392e30362e32303136-num-lsbj1/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/617802/kozyjozy-ransomware-help-support-wjpg-31392e30362e32303136-num-lsbj1/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f299730f-e395-8be1-affd-000072eb03b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/KozyJozy.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/KozyJozy.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0293857-bf5c-18d9-45e3-00006be6a3f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: kozy.jozy","pattern":"[domain-name:value = 'kozy.jozy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9b6870a-2ef6-0f93-734d-000087f808f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: selectedkozy.jozy","pattern":"[domain-name:value = 'selectedkozy.jozy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56f178ec-a36d-3798-ca0c-000079d25d48","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/08/korean-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/08/korean-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--376d3535-250f-3a55-c7ba-000047e4bdb1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/koreanRansom.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/koreanRansom.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edd5cd07-ad37-ff4c-3d51-000079d4dc9e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/kimcilware-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/kimcilware-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06df5e70-0e15-d5d5-891a-000092d39267","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/the-kimcilware-ransomware-targets-web-sites-running-the-magento-platform/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/the-kimcilware-ransomware-targets-web-sites-running-the-magento-platform/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12badfad-16d2-520a-38fd-000008c208cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.fortinet.com/post/kimcilware-ransomware-how-to-decrypt-encrypted-files-and-who-is-behind-it","pattern":"[url:value = 'https://blog.fortinet.com/post/kimcilware-ransomware-how-to-decrypt-encrypted-files-and-who-is-behind-it']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cee05de-f737-b89c-28d3-000049a466c2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/10/killerlocker-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/10/killerlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccc842de-db53-dd39-0244-000024913a5d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/782232299840634881","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/782232299840634881']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8292ddf-97de-cffa-e37f-0000103bf588","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/keyholder-ransomware-xor-cfb-cipher.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/keyholder-ransomware-xor-cfb-cipher.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24ae76cb-c1fa-ed4a-c626-000021876cb4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/559463/keyholder-ransomware-support-and-help-topic-how-decryptgifhow-decrypthtml","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/559463/keyholder-ransomware-support-and-help-topic-how-decryptgifhow-decrypthtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aefe0816-e689-ad77-2167-0000f709a5b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: READ.txt","pattern":"[domain-name:value = 'READ.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62cb866e-626d-19c8-9f1b-0000d7508713","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/03/keranger-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/03/keranger-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb08bc64-f573-effd-8271-0000fd034f3f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.welivesecurity.com/2016/03/07/new-mac-ransomware-appears-keranger-spread-via-transmission-app/","pattern":"[url:value = 'http://www.welivesecurity.com/2016/03/07/new-mac-ransomware-appears-keranger-spread-via-transmission-app/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--248f8571-c68c-1728-0362-00009ab6b552","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://news.drweb.com/show/?i=9877&lng=en&c=5","pattern":"[url:value = 'http://news.drweb.com/show/?i=9877&lng=en&c=5']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17a94a44-c273-6a33-9700-00002679dc66","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/09/kawaiilocker-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/09/kawaiilocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac9fb9e6-ec66-e270-5ac4-00000cae7234","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://safezone.cc/resources/kawaii-decryptor.195/","pattern":"[url:value = 'https://safezone.cc/resources/kawaii-decryptor.195/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--185e6f7d-86ca-dfa3-4580-0000c6e9b52e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/04/johnycryptor-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/04/johnycryptor-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--587a0643-8eaf-d547-dfd3-0000602049cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/jobcrypter-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/jobcrypter-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65b0c55d-0ec4-a8a9-56a4-0000edfe68af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/828914052973858816","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/828914052973858816']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6d57ce0-6bf0-3ffd-6f5e-000028a78579","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://forum.malekal.com/jobcrypter-geniesanstravaille-extension-locked-crypto-ransomware-t54381.html","pattern":"[url:value = 'http://forum.malekal.com/jobcrypter-geniesanstravaille-extension-locked-crypto-ransomware-t54381.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a73460bd-c08b-a1fc-7e71-00007db9b758","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/jobcrypter.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/jobcrypter.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07618ba8-9370-e4cf-b236-000012058ae8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: fichiers.txt","pattern":"[domain-name:value = 'fichiers.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f35357cb-bb47-7b2a-410e-00006e14f721","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/jigsaw-ransomware-makes-victims-play-a-game","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/jigsaw-ransomware-makes-victims-play-a-game']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6aa78d0-bca8-c73c-a06e-0000a81ac950","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.symantec.com/connect/blogs/jigsaw-ransomware-saw-movie-deletes-files-hour","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/jigsaw-ransomware-saw-movie-deletes-files-hour']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ee68a2c-7f5a-31ae-0fb7-00004d24cd28","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-jigsaw-ransomware-decrypted/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-jigsaw-ransomware-decrypted/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b54cf0d-f9f9-8d2a-17b6-0000dcca889a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/jigsaw","pattern":"[url:value = 'https://www.ransomlook.io/group/jigsaw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47c39a36-110f-ea19-0224-00005d532d51","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/jigsaw-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/jigsaw-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a1a946b-87cc-b60e-0e9a-000058bbd741","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/795819556166139905","pattern":"[url:value = 'https://twitter.com/demonslay335/status/795819556166139905']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d8d3fcc-0e08-607e-7a60-0000a714ffa6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.helpnetsecurity.com/2016/04/20/jigsaw-crypto-ransomware/","pattern":"[url:value = 'https://www.helpnetsecurity.com/2016/04/20/jigsaw-crypto-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee6218c1-ba77-1f1b-83e6-000045bc211a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/jigsaw-ransomware-decrypted-will-delete-your-files-until-you-pay-the-ransom/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/jigsaw-ransomware-decrypted-will-delete-your-files-until-you-pay-the-ransom/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e78032c0-5f82-6333-83dc-00002c549b47","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: nemo-hacks.at.sigaint.org","pattern":"[domain-name:value = 'nemo-hacks.at.sigaint.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47f14700-06b5-c16b-3ca8-000081f45ea1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/822509105487245317","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/822509105487245317']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7d5436d-23c4-3f78-a1b2-0000999427f7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/DoNotOpenDecrypter.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/DoNotOpenDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c0dc4a0-a715-700f-4513-0000fc297605","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/the-rise-and-fall-of-encryptor-raas/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/the-rise-and-fall-of-encryptor-raas/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a2a534f-e4f9-fc41-18e2-0000c59d4828","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/RaaS.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/RaaS.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78d7166f-e0c0-98b9-7174-000050ca796e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: raas.txt","pattern":"[domain-name:value = 'raas.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d3b7063-9b08-b1d5-c1b3-000020d3a098","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/757873976047697920","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/757873976047697920']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cac90c01-c587-60a3-72d5-0000bbb91a4b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/11/iransom-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/11/iransom-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--011461c2-0499-7212-26c7-00000061891a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/796134264744083460","pattern":"[url:value = 'https://twitter.com/demonslay335/status/796134264744083460']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69a81719-63c6-2d05-9b5c-00003a0f7274","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://download.bleepingcomputer.com/Nathan/StopPirates_Decrypter.exe","pattern":"[url:value = 'http://download.bleepingcomputer.com/Nathan/StopPirates_Decrypter.exe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29f64f71-db52-8a8f-dc66-0000827a4303","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/817085367144873985","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/817085367144873985']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c6580bf-60b4-b29c-ee06-00003c2ff133","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/hydracrypt-ransomware-aes-256-cbc-rsa.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/hydracrypt-ransomware-aes-256-cbc-rsa.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6397a1f0-60c0-5747-2140-000098c5bd52","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.malware-traffic-analysis.net/2016/02/03/index2.html","pattern":"[url:value = 'http://www.malware-traffic-analysis.net/2016/02/03/index2.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2025e4bb-5109-fdc7-f77a-00004c6bb6d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/803288396814839808","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/803288396814839808']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db5be709-b294-a74e-f958-0000162193ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/holycrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/holycrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--555d8934-eb20-c05b-b25b-0000288f06fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-python-ransomware-called-holycrypt-discovered/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-python-ransomware-called-holycrypt-discovered/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a35f648-b2fd-27da-fb71-00009eaa1b84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/08/hitler-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/08/hitler-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fdcd549-fe45-25ed-5b26-0000f8175c2b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/jiriatvirlab/status/825310545800740864","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/825310545800740864']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96713f05-6daa-5330-0267-00008d61ec45","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/development-version-of-the-hitler-ransomware-discovered/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/development-version-of-the-hitler-ransomware-discovered/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1465fa8c-167e-8563-ea3d-0000cfd23bbe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.ru/2016/05/hi-buddy-ransomware-aes-256-0.html","pattern":"[url:value = 'http://id-ransomware.blogspot.ru/2016/05/hi-buddy-ransomware-aes-256-0.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--045641ca-3e9c-4969-6217-00000324dcb9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/hibuddy.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/hibuddy.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4716791a-dfac-9fbe-313a-0000efee14a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/herbst-autumn-ransomware-aes-256-01.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/herbst-autumn-ransomware-aes-256-01.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83c57c7b-8084-3131-7faf-0000c456c259","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.fortinet.com/2016/06/03/cooking-up-autumn-herbst-ransomware","pattern":"[url:value = 'https://blog.fortinet.com/2016/06/03/cooking-up-autumn-herbst-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--311a5ffd-f4ad-28aa-8b16-0000892b1dfd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/09/helpdcfile-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/09/helpdcfile-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbbdb851-b610-4cb0-8fc8-00002e08ca1a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: dcfile.txt","pattern":"[domain-name:value = 'dcfile.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b6b618f-df47-4256-1cb0-0000b899fb1e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/11/heimdall-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/11/heimdall-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f18a34b6-7af4-67fd-588e-000083e25e34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/heimdall-open-source-php-ransomware-targets-web-servers/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/heimdall-open-source-php-ransomware-targets-web-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3c1bc62-032a-6c97-ca29-00001b364981","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/09/hddcryptor-ransomware-mbr.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/09/hddcryptor-ransomware-mbr.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--371b2433-89ec-c2cb-667b-0000b73ac147","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: blog.trendmicro.com","pattern":"[domain-name:value = 'blog.trendmicro.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cda6de3-4118-ca63-fe63-0000e987052b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.linkedin.com/pulse/mamba-new-full-disk-encryption-ransomware-family-member-marinho","pattern":"[url:value = 'https://www.linkedin.com/pulse/mamba-new-full-disk-encryption-ransomware-family-member-marinho']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac770346-1cab-350e-f0c4-0000652d032c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://diskcryptor.net","pattern":"[url:value = 'https://diskcryptor.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--491a70da-3053-a24f-cf62-0000a635758d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2017/03/happydayzz-blackjocker-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2017/03/happydayzz-blackjocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b787e778-ee59-168b-e986-0000cc770f59","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/847114064224497666","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/847114064224497666']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b714c67-06b3-707d-5a25-0000c220d9d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/12/hackedlocker-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/12/hackedlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24e95839-a636-96bf-d5bc-000074781615","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/806878803507101696","pattern":"[url:value = 'https://twitter.com/demonslay335/status/806878803507101696']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1a10e56-b59e-232d-f809-0000a315a9ad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/angler-shift-ek-landscape-new-crytpo-ransomware-activity/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/angler-shift-ek-landscape-new-crytpo-ransomware-activity/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0848c5f-f12e-51d2-ef8e-0000ee75bc9d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.com/2016/05/gomasom-ransonware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.com/2016/05/gomasom-ransonware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--beb1da00-97ef-95ba-00fc-000033c7eb9f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://id-ransomware.blogspot.ru/2016/05/gnl-locker-ransomware-gnl-locker-ip.html","pattern":"[url:value = 'http://id-ransomware.blogspot.ru/2016/05/gnl-locker-ransomware-gnl-locker-ip.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07e879d0-b06b-9961-0f33-000029d3d86c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/611342/gnl-locker-support-and-help-topic-locked-and-unlock-files-instructionshtml/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/611342/gnl-locker-support-and-help-topic-locked-and-unlock-files-instructionshtml/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97fa9b97-67aa-57db-13b1-0000c3f7a39f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/07/purge-kind-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/07/purge-kind-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3413f77-a4b7-1673-04bd-0000fccd6092","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/the-globe-ransomware-wants-to-purge-your-files/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/the-globe-ransomware-wants-to-purge-your-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a1eb63e-cc02-07e1-3cca-00009213b963","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/ni_fi_70/status/796353782699425792","pattern":"[url:value = 'https://twitter.com/ni_fi_70/status/796353782699425792']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f360be64-6c02-9854-956f-00008c5cc4cf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/05/ghostcrypt-ransomware-aes-256-2-bitcoins.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/05/ghostcrypt-ransomware-aes-256-2-bitcoins.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d353dd5-5a12-90e4-7f38-0000436f3ec5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/614197/ghostcrypt-z81928819-help-support-topic-read-this-filetxt/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/614197/ghostcrypt-z81928819-help-support-topic-read-this-filetxt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf58626d-60e2-c58b-3d94-00008602cdf1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/GhostCryptDecrypter.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/GhostCryptDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--725a5f2b-a68d-48c1-e459-000076f315ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://socradar.io/dark-web-profile-fsociety-flocker-ransomware/","pattern":"[url:value = 'https://socradar.io/dark-web-profile-fsociety-flocker-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40e3f080-8f30-3ec9-f17c-000038fc0c11","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyberint.com/blog/research/fsociety-funksec-collaborate-on-future-attacks/","pattern":"[url:value = 'https://www.cyberint.com/blog/research/fsociety-funksec-collaborate-on-future-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f82517c-959d-b328-6201-0000098b5adc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/fsociety","pattern":"[url:value = 'https://www.ransomlook.io/group/fsociety']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d51b1a7-ec43-18b2-0ac6-0000c9f3f09d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/08/fsociety-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/08/fsociety-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcf0d31b-aba0-1757-9b0b-0000f3ad6d43","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/siri_urz/status/795969998707720193","pattern":"[url:value = 'https://twitter.com/siri_urz/status/795969998707720193']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04a4e5ef-d929-e953-a715-0000a47ab26f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-fsociety-ransomware-pays-homage-to-mr-robot/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-fsociety-ransomware-pays-homage-to-mr-robot/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faf24c84-9e5b-6ee6-bea8-00001d356531","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/628199/fs0ciety-locker-ransomware-help-support-fs0cietyhtml/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/628199/fs0ciety-locker-ransomware-help-support-fs0cietyhtml/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db2b8bac-a16c-4d4d-9f8b-000050df59b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://flock4cvoeqm4c62gyohvmncx6ck2e7ugvyqgyxqtrumklhd5ptwzpqd.onion/","pattern":"[url:value = 'http://flock4cvoeqm4c62gyohvmncx6ck2e7ugvyqgyxqtrumklhd5ptwzpqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2546fc65-f892-504d-6117-00009ddc0654","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/12/roga-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/12/roga-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--011f9867-4119-2d83-abd5-00008d7e95ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/812135608374226944","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/812135608374226944']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--778019fd-008f-0583-e2f5-00003fd28f62","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/842302481774321664","pattern":"[url:value = 'https://twitter.com/struppigel/status/842302481774321664']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faa60bb6-373f-be4e-967e-0000ccb96fad","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: pronk.txt","pattern":"[domain-name:value = 'pronk.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--137b68a4-3832-b95e-dc6b-00002e384bcb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: help-file-decrypt.enc","pattern":"[domain-name:value = 'help-file-decrypt.enc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b04232b4-3ce0-44c9-1c0c-00004383671f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/09/flyper-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/09/flyper-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7b7d702-472a-dd36-b529-00006c8ee4d0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/773771485643149312","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/773771485643149312']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a9be101-5fe2-aa70-929d-0000d50ca7b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/01/bleedgreen-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/01/bleedgreen-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ec6a5a5-86e1-42c4-40cf-00008ab2f532","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/jiriatvirlab/status/836616468775251968","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/836616468775251968']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b8ef8ff-0f1a-8bc1-da21-00009c8bb45a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/03/filefrozr-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/03/filefrozr-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cf82de0-00de-985d-d91c-0000ced8b593","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/rommeljoven17/status/846973265650335744","pattern":"[url:value = 'https://twitter.com/rommeljoven17/status/846973265650335744']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36291396-7dc5-03ce-5219-00002eb55824","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/09/fenixlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/09/fenixlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3197f2ed-88ec-c624-642e-00001dad83b4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/fwosar/status/777197255057084416","pattern":"[url:value = 'https://twitter.com/fwosar/status/777197255057084416']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a606afc8-9ae6-0071-4c06-0000ab3687e3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/fenixlocker","pattern":"[url:value = 'https://decrypter.emsisoft.com/fenixlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b8215cf-f0ba-8c0a-2678-00005a869080","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/fantom-ransomware-encrypts-your-files-while-pretending-to-be-windows-update/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/fantom-ransomware-encrypts-your-files-while-pretending-to-be-windows-update/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ed37dad-9150-ea9f-8727-0000a09d0fc6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/PolarToffee/status/812312402779836416","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/812312402779836416']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a4ecd94-21e3-d9a7-fc35-0000e15c907c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/fakben-team-ransomware-aes-256-1505.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/fakben-team-ransomware-aes-256-1505.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc03f949-3044-0d1d-a936-0000d74af813","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.fortinet.com/post/fakben-team-ransomware-uses-open-source-hidden-tear-code","pattern":"[url:value = 'https://blog.fortinet.com/post/fakben-team-ransomware-uses-open-source-hidden-tear-code']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--056e92e7-e3fe-089e-6343-0000b1a62749","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-fairware-ransomware-targeting-linux-computers/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-fairware-ransomware-targeting-linux-computers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a24d4ca9-ea3e-61c3-d430-0000767e1ec7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/839022018230112256","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/839022018230112256']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a7d57fd-cebe-3281-86af-000092246355","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/05/enigma-ransomware-aes-128-0.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/05/enigma-ransomware-aes-128-0.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97910408-6204-ce8f-aeaa-000019017257","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/the-enigma-ransomware-targets-russian-speaking-users/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/the-enigma-ransomware-targets-russian-speaking-users/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8849d60f-1c6c-9c36-6180-000059707ba8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: encr.txt","pattern":"[domain-name:value = 'encr.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6a7d95f-3d40-fc8d-b7a9-0000d3ddb96f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: enigma.hta","pattern":"[domain-name:value = 'enigma.hta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80592526-8dec-bcf2-8810-000032f246cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/11/encryptojjs-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/11/encryptojjs-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e385f5c6-d048-6651-8c44-000091ef147f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: recover.enc","pattern":"[domain-name:value = 'recover.enc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90d80170-b10a-e6f6-dac2-00008f1813fc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Encoder.xxxx","pattern":"[domain-name:value = 'Encoder.xxxx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01c42994-4c76-a953-8773-0000d623ccc1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://vms.drweb.ru/virus/?_is=1&i=8747343","pattern":"[url:value = 'http://vms.drweb.ru/virus/?_is=1&i=8747343']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24c6c0f0-e5f9-538f-8320-0000f84f8691","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/el-polocker-ransomware-aes-450-aud.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/el-polocker-ransomware-aes-450-aud.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a78b9b91-fe05-5933-cf86-0000e0789eb7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/845652520202616832","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/845652520202616832']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08263f68-4fa9-7e0a-0043-0000386170ff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BroadAnalysis/status/845688819533930497","pattern":"[url:value = 'https://twitter.com/BroadAnalysis/status/845688819533930497']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8036a9d7-cc16-fb81-4da2-0000cccff4a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/747031171347910656","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/747031171347910656']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b0543a0-890d-ef17-834e-00008630f00c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.filedropper.com/decrypter_1","pattern":"[url:value = 'http://www.filedropper.com/decrypter_1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceec357b-b792-d28d-c690-0000a75fae34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/hiddentear-2.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/hiddentear-2.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--981327ed-fa00-5607-d89b-00000b37f57e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.utkusen.com/blog/dealing-with-script-kiddies-cryptear-b-incident.html","pattern":"[url:value = 'http://www.utkusen.com/blog/dealing-with-script-kiddies-cryptear-b-incident.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fe50fbc-ba9a-8605-2ce0-00006fca48cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/09/dxxd-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/09/dxxd-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37abceab-f1a1-f796-ca55-0000352677b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-dxxd-ransomware-displays-legal-notice-before-users-login/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-dxxd-ransomware-displays-legal-notice-before-users-login/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0754a4ef-4202-b4d6-c003-0000f0a53e34","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/627831/dxxd-ransomware-dxxd-help-support-readmetxt/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/627831/dxxd-ransomware-dxxd-help-support-readmetxt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79c68e03-8680-c4c2-8fc4-0000213729ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/794108322932785158","pattern":"[url:value = 'https://twitter.com/struppigel/status/794108322932785158']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1ad6af9-11ab-15d4-a875-000079165178","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/03/donotchange-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/03/donotchange-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--360bda0c-bd39-d21f-a107-0000116948e1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/643330/donotchange-ransomware-id-7es642406cry-do-not-change-the-file-namecryp/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/643330/donotchange-ransomware-id-7es642406cry-do-not-change-the-file-namecryp/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1088f34e-350b-d93a-7d2d-0000a9a4623e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: id-7ES642406.cry","pattern":"[domain-name:value = 'id-7ES642406.cry']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff3bb35a-3d4f-20b7-3549-0000ebbefa68","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/08/domino-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/08/domino-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62ce0fa9-8fdd-4179-ada7-0000d99bd05b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/the-curious-case-of-the-domino-ransomware-a-windows-crack-and-a-cow/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/the-curious-case-of-the-domino-ransomware-a-windows-crack-and-a-cow/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4f85103-e392-1b40-527b-0000e6f6ed38","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/Domino.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/Domino.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cbd0bdc-59bf-da02-e1cb-000026c19f9c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/822500056511213568","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/822500056511213568']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--153a35b7-b019-d6bc-3039-0000505ab62a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-strikes-back/","pattern":"[url:value = 'https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-strikes-back/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3265b6a5-bf7b-34d9-7904-0000a48246fe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/","pattern":"[url:value = 'https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79b27b76-754e-e38e-a692-00004dae23a8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg","pattern":"[url:value = 'https://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9422b374-8462-f451-0408-0000bd063929","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/hasherezade/dma_unlocker","pattern":"[url:value = 'https://github.com/hasherezade/dma_unlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3df871a-f4a6-7823-235f-0000ebfcd2a2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: start.txt","pattern":"[domain-name:value = 'start.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8282584-9897-17b0-d23f-0000cdb50be8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: decrypting.txt","pattern":"[domain-name:value = 'decrypting.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d82c4ae7-5fb9-4dcb-8caf-0000d7d501d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: cryptinfo.txt","pattern":"[domain-name:value = 'cryptinfo.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f68330cd-c3d1-bf01-f3d0-0000c6f6a422","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/revoyem-dirtydecrypt-ransomware-doc.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/revoyem-dirtydecrypt-ransomware-doc.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b4bc501-871d-ba2b-0a93-0000a2379481","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/752586334527709184","pattern":"[url:value = 'https://twitter.com/demonslay335/status/752586334527709184']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ecffcac-4a14-f186-4759-000097c69074","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/PolarToffee/status/829727052316160000","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/829727052316160000']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3c0748b-0f2f-7dc5-149e-0000260ed970","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Readme0.txt","pattern":"[domain-name:value = 'Readme0.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29a6c3b0-27d3-7cb3-ee06-0000ee4a39c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/08/detoxcrypto-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/08/detoxcrypto-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5f0172-75e1-7392-dc43-000041cc8489","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-detoxcrypto-ransomware-pretends-to-be-pokemongo-or-uploads-a-picture-of-your-screen/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-detoxcrypto-ransomware-pretends-to-be-pokemongo-or-uploads-a-picture-of-your-screen/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6d9bb8f-8ea9-ceb8-3698-0000e62104e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/10/cryptodemo-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/10/cryptodemo-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf4e5014-fc86-ca0f-0044-0000c4867f0e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/798573300779745281","pattern":"[url:value = 'https://twitter.com/struppigel/status/798573300779745281']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--682aa8b9-a807-8168-b280-0000839c7f6e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/dedcryptor-ransomware-aes-256rsa-2.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/dedcryptor-ransomware-aes-256rsa-2.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--720bf48b-233f-a5d9-52ff-0000fe144c8c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/DEDCryptor.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/DEDCryptor.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9daaa1eb-5475-c1c6-a435-0000d0debd2c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/617395/dedcryptor-ded-help-support-topic/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/617395/dedcryptor-ded-help-support-topic/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9345f3f-b0f0-499f-4213-0000c7d65294","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.malwareremovalguides.info/decrypt-files-with-decrypt_mblblock-exe-decrypt-protect/","pattern":"[url:value = 'http://www.malwareremovalguides.info/decrypt-files-with-decrypt_mblblock-exe-decrypt-protect/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fef2194f-7b2e-d00b-6803-00004703b585","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JaromirHorejsi/status/815555258478981121","pattern":"[url:value = 'https://twitter.com/JaromirHorejsi/status/815555258478981121']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc89703a-7afe-29f9-2ba8-000066d16766","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/09/cyber-splitter-vbs-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/09/cyber-splitter-vbs-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59830ea0-24a5-ce86-586e-0000c73ce783","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/806758133720698881","pattern":"[url:value = 'https://twitter.com/struppigel/status/806758133720698881']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e49f41f-e185-2797-b896-00009cdc7c00","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/778871886616862720","pattern":"[url:value = 'https://twitter.com/struppigel/status/778871886616862720']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca75f93a-12d6-6262-4b8a-0000389bfa65","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/aaaddress1/my-Little-Ransomware","pattern":"[url:value = 'https://github.com/aaaddress1/my-Little-Ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60c1d3e2-6382-5ee0-b36a-0000186625fa","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/aaaddress1/my-Little-Ransomware/tree/master/decryptoTool","pattern":"[url:value = 'https://github.com/aaaddress1/my-Little-Ransomware/tree/master/decryptoTool']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71aaeaa3-11c0-7733-e4b0-0000bddaf776","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/ctb-locker-for-websites-04.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/ctb-locker-for-websites-04.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de09426e-165c-bde9-432a-00000dac3679","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/eyecatchup/Critroni-php","pattern":"[url:value = 'https://github.com/eyecatchup/Critroni-php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3c1847c-771e-02b4-909b-00001a117b00","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://thisissecurity.net/2016/02/26/a-lockpicking-exercise/","pattern":"[url:value = 'https://thisissecurity.net/2016/02/26/a-lockpicking-exercise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5431b923-8860-9c54-79cc-0000aaa4a888","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/ctb-faker-ransomware-008.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/ctb-faker-ransomware-008.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b83b73b-b53b-a7dc-84e1-0000037da561","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/09/crypy-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/09/crypy-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0329713b-7e6a-a8da-bc5d-0000a8de9f07","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/ctb-faker-ransomware-does-a-poor-job-imitating-ctb-locker/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/ctb-faker-ransomware-does-a-poor-job-imitating-ctb-locker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e50243d7-7e54-c809-a70b-000049ea1b14","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/cryptxxx-ransomware-learns-samba-other-new-tricks-with-version3100","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/cryptxxx-ransomware-learns-samba-other-new-tricks-with-version3100']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5591c38a-8802-7052-64b7-00007f0bfcf2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/cryptxxx-updated-to-version-3-0-decryptors-no-longer-work/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/cryptxxx-updated-to-version-3-0-decryptors-no-longer-work/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c0d6afb-3156-ce8d-bf43-0000ac442623","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blogs.cisco.com/security/cryptxxx-technical-deep-dive","pattern":"[url:value = 'http://blogs.cisco.com/security/cryptxxx-technical-deep-dive']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a0e6c51-494f-58f6-8e81-0000b7f8080f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/cryptxxx2-ransomware-authors-strike-back-against-free-decryption-tool","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/cryptxxx2-ransomware-authors-strike-back-against-free-decryption-tool']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--720208e5-fda4-4f93-e513-00007d88bcb3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.symantec.com/connect/blogs/cryptxxx-ransomware-evolves-v30","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/cryptxxx-ransomware-evolves-v30']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f71eb5f-e6bf-98f0-56ed-0000091e47c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.com/threat-spotlight/2016/05/cryptxxx-ransomware-now-steals-more/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-spotlight/2016/05/cryptxxx-ransomware-now-steals-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fffe7514-330d-6bc2-b68d-0000e7141c55","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-cryptxxx-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-cryptxxx-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fea07c98-d74e-aab9-b19e-0000522a390a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://securelist.com/cryptxxx-unveiled/74731/","pattern":"[url:value = 'https://securelist.com/cryptxxx-unveiled/74731/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ee59883-4c5f-09da-f014-00007efdf6bc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.ransomlook.io/group/cryptxxx","pattern":"[url:value = 'https://www.ransomlook.io/group/cryptxxx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43e12f53-934a-df81-579f-00005f9d3f87","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f4cba20-c950-fdc8-8824-0000ad7b4898","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/virus-removal/cryptxxx-ransomware-help-information","pattern":"[url:value = 'http://www.bleepingcomputer.com/virus-removal/cryptxxx-ransomware-help-information']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ca6e29f-1354-005a-754d-000051c42dec","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://apvc24autvavxuc6.onion/","pattern":"[url:value = 'http://apvc24autvavxuc6.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85afa05e-11cb-6411-926e-00007a3a4401","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.virustotal.com/en/file/45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d/analysis/","pattern":"[url:value = 'https://www.virustotal.com/en/file/45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d/analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--020a1332-0123-4416-e403-000052a3dcde","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blogs.technet.microsoft.com/mmpc/2015/01/13/crowti-update-cryptowall-3-0/","pattern":"[url:value = 'https://blogs.technet.microsoft.com/mmpc/2015/01/13/crowti-update-cryptowall-3-0/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b5630f3-33f3-2a25-9a2a-00004ff03445","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: TOR.URL","pattern":"[domain-name:value = 'TOR.URL']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36fa745f-532d-1394-07ca-00009f1e8dc7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: INSTRUCTION.URL","pattern":"[domain-name:value = 'INSTRUCTION.URL']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--351330f9-d0c2-0b82-8e1d-0000159b7ae9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://news.softpedia.com/news/new-open-source-linux-ransomware-shows-infosec-community-divide-508669.shtml","pattern":"[url:value = 'http://news.softpedia.com/news/new-open-source-linux-ransomware-shows-infosec-community-divide-508669.shtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a06ef3b3-901c-4a9a-4dfc-0000a6f5fb66","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/cryptotorlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/cryptotorlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6ed1dc7-8e93-85ee-bc23-000041413764","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/565020/new-cryptotorlocker2015-ransomware-discovered-and-easily-decrypted/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/565020/new-cryptotorlocker2015-ransomware-discovered-and-easily-decrypted/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--598c183e-3b5e-38b2-fe9b-0000bc96da3f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/cryptoshocker-ransomware-aes-200.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/cryptoshocker-ransomware-aes-200.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a026832-c72e-84a7-c418-000090b3f4a9","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/617601/cryptoshocker-ransomware-help-and-support-topic-locked-attentionurl/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/617601/cryptoshocker-ransomware-help-and-support-topic-locked-attentionurl/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a45e02be-7478-9e03-b7fa-0000080ab243","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ATTENTION.url","pattern":"[domain-name:value = 'ATTENTION.url']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed7faf1d-d780-a139-a23c-000009adb9eb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/821992610164277248","pattern":"[url:value = 'https://twitter.com/struppigel/status/821992610164277248']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69687486-c718-f9ea-63cf-0000da868082","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: INMEDIATAMENTE.txt","pattern":"[domain-name:value = 'INMEDIATAMENTE.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cd5289b-b91a-c34e-901b-0000aed49a72","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/cryptoroger-aes-256-0.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/cryptoroger-aes-256-0.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5374116d-9215-43a7-0fff-0000b0c88bbb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-ransomware-called-cryptoroger-that-appends-crptrgr-to-encrypted-files/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-ransomware-called-cryptoroger-that-appends-crptrgr-to-encrypted-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--206cb373-66dc-eb3b-08dd-0000292d438f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/817672617658347521","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/817672617658347521']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d947c6a-99f5-eabd-8316-0000c5de6ac2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/cryptomix-ransomware-exploits-sick-children-to-coerce-payments/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/cryptomix-ransomware-exploits-sick-children-to-coerce-payments/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c29fae8-eded-16a7-b556-0000ff665581","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.coveware.com/blog/cryptomix-ransomware-exploits-cancer-crowdfunding","pattern":"[url:value = 'https://www.coveware.com/blog/cryptomix-ransomware-exploits-cancer-crowdfunding']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ac11d3b-278f-65c2-7f1c-0000cf47d1af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/demonslay335/status/1072227523755470848","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1072227523755470848']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19e825c7-c35f-8b6f-73fd-000026b47fdf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-backup-cryptomix-ransomware-variant-actively-infecting-users/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-backup-cryptomix-ransomware-variant-actively-infecting-users/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbb0eb38-2dd6-3e4d-819d-0000a8e568f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/mole66-cryptomix-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/mole66-cryptomix-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39a74d31-2a9f-b2d6-9200-0000dcbacd33","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/system-cryptomix-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/system-cryptomix-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4186870a-94fd-695e-7f52-000089f8e8a0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/work-cryptomix-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/work-cryptomix-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--849546da-a885-1aeb-4582-0000522e7a84","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/test-cryptomix-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/test-cryptomix-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2d92730-29f0-de1e-4bfc-0000f5d77899","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/xzzx-cryptomix-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/xzzx-cryptomix-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77fd3909-d487-d5da-9cfc-0000362f7d4d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/0000-cryptomix-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/0000-cryptomix-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35b9f555-93a0-28c5-4ae7-00004577b710","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-empty-cryptomix-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-empty-cryptomix-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4df13544-638c-a046-e1ad-0000eb6e60c3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/804009831518572544","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/804009831518572544']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b594fe5-16f5-eed9-b526-00003e09ed74","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/","pattern":"[url:value = 'https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49410140-47ef-b79e-9d71-00009c2c8860","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/CryptoMix.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/CryptoMix.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d863668-a711-b06d-7fa1-00003f75680b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://pbs.twimg.com/media/DuFQ4FdWoAMy7Hg.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DuFQ4FdWoAMy7Hg.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--debb6eb4-743a-6881-cf6b-00004d9457e5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: INSTRUCTION.TXT","pattern":"[domain-name:value = 'INSTRUCTION.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49d24df3-2b0b-64f6-9c66-000067da2e19","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: techie.com","pattern":"[domain-name:value = 'techie.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5731ba4f-ae26-b210-f188-000022b411f6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: keemail.me","pattern":"[domain-name:value = 'keemail.me']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e47d5c31-58ee-61e7-9b3b-0000a2d2e8f4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: consultant.com","pattern":"[domain-name:value = 'consultant.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3497caf8-e1ee-573f-dc4e-0000fe38e154","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: yahooweb.co","pattern":"[domain-name:value = 'yahooweb.co']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a8780da-7d8c-8e1b-41f7-000039c68104","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: techmail.info","pattern":"[domain-name:value = 'techmail.info']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee728c6c-e130-0fa4-27df-0000cec31904","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: post.com","pattern":"[domain-name:value = 'post.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7aaf98b9-6b6b-c117-30e2-00003774d4b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: dr.com","pattern":"[domain-name:value = 'dr.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7af2b6ca-1e4c-7ddd-a681-00008962cc4c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/782890104947867649","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/782890104947867649']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bfbb048-8807-a940-362e-000044551cc1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/839747940122001408","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/839747940122001408']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd535a5e-bb30-58ea-e577-00002062f349","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://reaqta.com/2016/04/uncovering-ransomware-distribution-operation-part-2/","pattern":"[url:value = 'https://reaqta.com/2016/04/uncovering-ransomware-distribution-operation-part-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7b928ef-426f-23bd-c388-0000b9287766","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.fireeye.com/blog/executive-perspective/2014/08/your-locker-of-information-for-cryptolocker-decryption.html","pattern":"[url:value = 'https://www.fireeye.com/blog/executive-perspective/2014/08/your-locker-of-information-for-cryptolocker-decryption.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0ca9aef-d40f-3b82-8166-0000a6d79bed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2017/07/cryptojoker-2017-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2017/07/cryptojoker-2017-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed6e7149-f5ab-dfdd-779f-0000318f4f13","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: GetYouFiles.txt","pattern":"[domain-name:value = 'GetYouFiles.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6989b67-5f5d-a2c3-b01b-0000d58fd00a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/cryptohost-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/cryptohost-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e9ed393-52cb-be0f-d8a2-0000b6816b86","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/cryptohost-decrypted-locks-files-in-a-password-protected-rar-file/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/cryptohost-decrypted-locks-files-in-a-password-protected-rar-file/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e93ce16-2088-f0d8-3664-0000d0a2a2dc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/05/cryptofortress-ransomware-aes-256-1.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/05/cryptofortress-ransomware-aes-256-1.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fcca829-0196-f53f-2344-000037e68094","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/search?q=CryptoFinancial","pattern":"[url:value = 'https://id-ransomware.blogspot.com/search?q=CryptoFinancial']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13910a1a-a6f1-744d-4ef4-000098202843","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://nakedsecurity.sophos.com/2016/07/13/ransomware-that-demands-money-and-gives-you-back-nothing/","pattern":"[url:value = 'https://nakedsecurity.sophos.com/2016/07/13/ransomware-that-demands-money-and-gives-you-back-nothing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2f5101d-28bd-3e63-c477-0000679d61ed","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.talosintel.com/2016/07/ranscam.html","pattern":"[url:value = 'http://blog.talosintel.com/2016/07/ranscam.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19d430e7-5ef4-8253-a83c-00000623a3ac","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/cryptodefense-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/cryptodefense-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fb417bf-083e-ed55-506a-00003ff42c29","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: DECRYPT.URL","pattern":"[domain-name:value = 'DECRYPT.URL']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bdb05f1-db41-6192-a97d-00002c06a34b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/cryptobit-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/cryptobit-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9ef9653-1949-318b-ac24-00008d2207fb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://news.softpedia.com/news/new-cryptobit-ransomware-could-be-decryptable-503239.shtml","pattern":"[url:value = 'http://news.softpedia.com/news/new-cryptobit-ransomware-could-be-decryptable-503239.shtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a39475fc-dc70-d2ba-6a1a-0000ed821557","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.pandasecurity.com/mediacenter/panda-security/cryptobit/","pattern":"[url:value = 'http://www.pandasecurity.com/mediacenter/panda-security/cryptobit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--868e3d37-eb0d-5834-59a1-00000f59f313","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: OKSOWATHAPPENDTOYOURFILES.TXT","pattern":"[domain-name:value = 'OKSOWATHAPPENDTOYOURFILES.TXT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a966869-1310-2396-04d6-0000073862d5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/cryptfile2-ransomware-rsa-email.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/cryptfile2-ransomware-rsa-email.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60b8d75d-96f8-8350-a4d1-0000bc7d0b3e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: usa.com.scl","pattern":"[domain-name:value = 'usa.com.scl']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edb2ce29-55fd-b4e8-08d5-0000b3fc104c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/jiriatvirlab/status/802554159564062722","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/802554159564062722']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9ccf56b-70ff-2414-aaa5-00004bedfac5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/regist-crypt38-ransomware-aes-1000-15.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/regist-crypt38-ransomware-aes-1000-15.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--860d6871-459b-58a4-a4d5-000072d0da5d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.fortinet.com/2016/06/17/buggy-russian-ransomware-inadvertently-allows-free-decryption","pattern":"[url:value = 'https://blog.fortinet.com/2016/06/17/buggy-russian-ransomware-inadvertently-allows-free-decryption']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c551be78-bd6a-26cc-c194-0000c8be9ed7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/Crypt38Keygen.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/Crypt38Keygen.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--685c2d32-1b04-be22-5660-0000916e3308","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/images/articulos/malware/crypren/0.png","pattern":"[url:value = 'http://www.nyxbone.com/images/articulos/malware/crypren/0.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--778b43d8-1728-1c07-69d4-0000d6d2673f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/Crypren.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/Crypren.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72f49082-af38-d170-b5fb-0000dd56362d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/pekeinfo/DecryptCrypren","pattern":"[url:value = 'https://github.com/pekeinfo/DecryptCrypren']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4403617f-59dc-be75-6fca-00004e3461db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/crypmic-ransomware-aes-256.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/crypmic-ransomware-aes-256.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d09d018-8de2-20b8-acad-00001ea7cab0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/crypmic-ransomware-wants-to-follow-cryptxxx/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/crypmic-ransomware-wants-to-follow-cryptxxx/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ce1ef79-3a5b-9ed2-561c-0000a1bd2be0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/the-crylocker-ransomware-communicates-using-udp-and-stores-data-on-imgur-com/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/the-crylocker-ransomware-communicates-using-udp-and-stores-data-on-imgur-com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b381c131-5e55-8601-98dd-000099819f03","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/cryfile-ransomware-100.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/cryfile-ransomware-100.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84873cd8-4bf6-9904-0b49-0000aba7e810","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Instructionaga.txt","pattern":"[domain-name:value = 'Instructionaga.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--238273b3-e5c7-5649-243c-0000f8de63c6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: SHTODELATVAM.txt","pattern":"[domain-name:value = 'SHTODELATVAM.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6a7df75-8417-3165-54c4-0000e85e0058","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://virusinfo.info/showthread.php?t=185396","pattern":"[url:value = 'http://virusinfo.info/showthread.php?t=185396']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e33b93c-7f87-b70d-dd85-000053d02d23","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://support.kaspersky.com/viruses/disinfection/8547","pattern":"[url:value = 'https://support.kaspersky.com/viruses/disinfection/8547']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d85ad94c-740d-19db-49d0-000056b2f76e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/04/coverton-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/04/coverton-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6546a90a-e07a-41a3-06f3-0000199b2318","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/paying-the-coverton-ransomware-may-not-get-your-data-back/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/paying-the-coverton-ransomware-may-not-get-your-data-back/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0588886d-7b95-5c56-bda6-0000a4400489","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/794956809866018816","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/794956809866018816']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4ef7c65-acfb-7a22-a944-000009558592","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.org/threat-analysis/2015/12/inside-chimera-ransomware-the-first-doxingware-in-wild/","pattern":"[url:value = 'https://blog.malwarebytes.org/threat-analysis/2015/12/inside-chimera-ransomware-the-first-doxingware-in-wild/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f156895d-3952-32dd-27b3-0000f85b2f7f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/chimera-ransomware-decryption-keys-released-by-petya-devs/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/chimera-ransomware-decryption-keys-released-by-petya-devs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--134a7324-bc7d-ada5-1a10-00005929293a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/cerber-renames-itself-as-crbr-encryptor-to-be-a-pita/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/cerber-renames-itself-as-crbr-encryptor-to-be-a-pita/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc04ea5e-053f-abb2-aff0-000031a89997","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://community.rsa.com/community/products/netwitness/blog/2016/11/04/the-evolution-of-cerber-v410","pattern":"[url:value = 'https://community.rsa.com/community/products/netwitness/blog/2016/11/04/the-evolution-of-cerber-v410']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--079d0e36-09a6-2e6b-80b4-0000c4ad1efc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.malwarebytes.org/threat-analysis/2016/03/cerber-ransomware-new-but-mature/","pattern":"[url:value = 'https://blog.malwarebytes.org/threat-analysis/2016/03/cerber-ransomware-new-but-mature/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb078a70-9d43-12d7-f3ab-000057f0fae1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: README.hta","pattern":"[domain-name:value = 'README.hta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfa55ecb-5c3e-c8e8-51b2-0000eb081b6d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/09/cry-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/09/cry-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cefc97f5-9430-17c7-92d2-0000cd7256b1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/625820/central-security-treatment-organization-ransomware-help-topic-cry-extension/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/625820/central-security-treatment-organization-ransomware-help-topic-cry-extension/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cded5fd-5123-995e-7731-0000d44e6b38","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/05/buyunlockcode-ransomware-rsa-1024.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/05/buyunlockcode-ransomware-rsa-1024.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--053eedec-2ebc-a995-f4e9-000000548be5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: BUYUNLOCKCODE.txt","pattern":"[domain-name:value = 'BUYUNLOCKCODE.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7789fe1b-f41a-a45c-1aad-0000fa5efeff","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/05/bucbi-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/05/bucbi-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2499b719-af7b-d0a0-ef94-0000c5d6ceea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2016/05/unit42-bucbi-ransomware-is-back-with-a-ukrainian-makeover/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2016/05/unit42-bucbi-ransomware-is-back-with-a-ukrainian-makeover/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb87fc77-ce97-75a5-5153-00006e1d83f2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/845199679340011520","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/845199679340011520']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55ba4720-261e-5ef6-b8d6-000058b7804b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba72a492-a1fc-fae4-d678-00007e814077","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/821831437884211201","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/821831437884211201']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e32c0463-9328-6884-a892-0000e85399d3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/images/articulos/malware/brazilianRansom/0.png","pattern":"[url:value = 'http://www.nyxbone.com/images/articulos/malware/brazilianRansom/0.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a21e87e9-22eb-a472-7b1e-0000dc889dcc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/brazilianRansom.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/brazilianRansom.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--815c5f85-cbdb-9231-b588-000032bb02d7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: MENSAGEM.txt","pattern":"[domain-name:value = 'MENSAGEM.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d7b72e4-f997-2863-424e-000080438e2f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/05/booyah-ransomware-1-2-btc.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/05/booyah-ransomware-1-2-btc.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--208dbc7f-c39c-34b8-cef6-000070a274ca","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/614456/bloccato-ransomware-bloccato-help-support-leggi-questo-filetxt/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/614456/bloccato-ransomware-bloccato-help-support-leggi-questo-filetxt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5048751-7f03-039f-5afb-0000eaa7cb49","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/06/silentshade-ransomware-blackshades.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/06/silentshade-ransomware-blackshades.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0819da41-42d2-7fe2-f8e4-00009a922704","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nyxbone.com/malware/BlackShades.html","pattern":"[url:value = 'http://nyxbone.com/malware/BlackShades.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ca92e00-70a4-8ba4-4658-00001d329875","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: YourID.txt","pattern":"[domain-name:value = 'YourID.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d87706e-e887-7039-5363-0000eadccc9c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/ransomware-007867.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/ransomware-007867.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--914c8130-42b7-c917-f673-00008def041e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/BitStakDecrypter.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/BitStakDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee32eeb2-3f5a-c80b-1bd0-00003a86e0dc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.com/2016/05/bitcryptor-ransomware-aes-256-1-btc.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/05/bitcryptor-ransomware-aes-256-1-btc.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f439723e-b078-91f1-25b4-0000988f1ebc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://noransom.kaspersky.com/","pattern":"[url:value = 'https://noransom.kaspersky.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00983fea-f5bd-ced5-717f-0000f6092192","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/New-Bart-Ransomware-from-Threat-Actors-Spreading-Dridex-and-Locky","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/New-Bart-Ransomware-from-Threat-Actors-Spreading-Dridex-and-Locky']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5d6e3d0-971e-696f-01ba-0000631ca7b5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://phishme.com/rockloader-downloading-new-ransomware-bart/","pattern":"[url:value = 'http://phishme.com/rockloader-downloading-new-ransomware-bart/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d717f202-49b8-35fb-1d0b-000052ab97ef","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://now.avg.com/barts-shenanigans-are-no-match-for-avg/","pattern":"[url:value = 'http://now.avg.com/barts-shenanigans-are-no-match-for-avg/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--612a0c91-2f50-9c96-fbfb-000032f9d8a1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: recover.txt","pattern":"[domain-name:value = 'recover.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d62c270-ccc5-700a-5e04-0000faf7983b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-bandarchor-ransomware-variant-spreads-via-malvertising-on-adult-sites/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-bandarchor-ransomware-variant-spreads-via-malvertising-on-adult-sites/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e91edf57-e7b5-d5a9-e496-0000612a99c1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://reaqta.com/2016/03/bandarchor-ransomware-still-active/","pattern":"[url:value = 'https://reaqta.com/2016/03/bandarchor-ransomware-still-active/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79c58fc9-9000-47e7-ab6a-0000b84b3bdf","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: decryptservice.info","pattern":"[domain-name:value = 'decryptservice.info']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f7750e6-e512-abd4-bca3-00002dc35058","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://0xc1r3ng.wordpress.com/2016/06/24/bakso-crypt-simple-ransomware/","pattern":"[url:value = 'https://0xc1r3ng.wordpress.com/2016/06/24/bakso-crypt-simple-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8055be44-b233-d20f-0d01-0000e2a2467f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/JakubKroustek/status/760482299007922176","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/760482299007922176']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b79488a0-4e94-143b-f8cd-000029365d67","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/images/articulos/malware/badblock/5.png","pattern":"[url:value = 'http://www.nyxbone.com/images/articulos/malware/badblock/5.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd1dbd5f-248e-1241-1313-0000a1fb90b2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/BadBlock.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/BadBlock.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ea6571c-3915-10d5-ded3-00002b05d2ea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/badblock","pattern":"[url:value = 'https://decrypter.emsisoft.com/badblock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d575e4e-f819-1bd7-0984-00005f4551c4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/828902907668000770","pattern":"[url:value = 'https://twitter.com/struppigel/status/828902907668000770']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5f85009-2fde-4ee0-6e31-0000f27a59ae","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/autolocky","pattern":"[url:value = 'https://decrypter.emsisoft.com/autolocky']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b12e13c-2695-bb16-d5a9-00006ddbeab4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://decrypter.emsisoft.com/download/apocalypsevm","pattern":"[url:value = 'http://decrypter.emsisoft.com/download/apocalypsevm']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fa367b5-cd5c-3616-100f-000052807638","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://blog.emsisoft.com/2016/06/29/apocalypse-ransomware-which-targets-companies-through-insecure-rdp/","pattern":"[url:value = 'http://blog.emsisoft.com/2016/06/29/apocalypse-ransomware-which-targets-companies-through-insecure-rdp/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14134206-d639-dbd0-2990-0000b60a5551","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/apocalypse","pattern":"[url:value = 'https://decrypter.emsisoft.com/apocalypse']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f1354b2-7c02-bab0-606d-000068eed942","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: dr.compress","pattern":"[domain-name:value = 'dr.compress']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e91b971-023e-49f2-a5ef-000094571a41","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ransomware.attack","pattern":"[domain-name:value = 'ransomware.attack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caaf7fbf-94f9-652f-e911-0000d4ba2709","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/struppigel/status/842047409446387714","pattern":"[url:value = 'https://twitter.com/struppigel/status/842047409446387714']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44296062-3d9c-a9f3-36a6-0000986aa96f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/BleepinComputer/status/844531418474708993","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/844531418474708993']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c093c00e-b736-8e96-f3fd-00005c147dd4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.enigmasoftware.com/ambaransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/ambaransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8086196b-3e9d-97e4-5f44-00002f2feee2","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/benkow_/status/747813034006020096","pattern":"[url:value = 'https://twitter.com/benkow_/status/747813034006020096']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5dc9740-d47b-bdbc-df3d-0000145a587d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: riseup.net","pattern":"[domain-name:value = 'riseup.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--992d7b44-fe34-b6a8-3b6a-00000af19c63","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwarebread/status/804714048499621888","pattern":"[url:value = 'https://twitter.com/malwarebread/status/804714048499621888']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00565246-c590-feb8-7d66-00008ae47fcb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/decrypted-alpha-ransomware-accepts-itunes-gift-cards-as-payment/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/decrypted-alpha-ransomware-accepts-itunes-gift-cards-as-payment/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f73a0ac-7c8c-96d2-b051-0000431f7dea","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://download.bleepingcomputer.com/demonslay335/AlphaDecrypter.zip","pattern":"[url:value = 'http://download.bleepingcomputer.com/demonslay335/AlphaDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fe8087c-6ab2-7c16-c03a-0000cf9534e7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-alma-locker-ransomware-being-distributed-via-the-rig-exploit-kit/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-alma-locker-ransomware-being-distributed-via-the-rig-exploit-kit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--649c0c9d-7dd5-c814-5490-000054b1fe0a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://info.phishlabs.com/blog/alma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter","pattern":"[url:value = 'https://info.phishlabs.com/blog/alma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c756c6e-1c45-456a-dc6a-00005f1802b0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://news.softpedia.com/news/cerber-devs-create-new-ransomware-called-alfa-506165.shtml","pattern":"[url:value = 'https://news.softpedia.com/news/cerber-devs-create-new-ransomware-called-alfa-506165.shtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--553daceb-26d4-b3ae-fa67-00000b1bc54e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/new-alfa-or-alpha-ransomware-from-the-same-devs-as-cerber/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/new-alfa-or-alpha-ransomware-from-the-same-devs-as-cerber/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38e37004-59a0-8965-ff4f-0000e543277e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/al-namrood","pattern":"[url:value = 'https://decrypter.emsisoft.com/al-namrood']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d70025e-333d-a3bd-dc10-0000f0675587","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/PolarToffee/status/796079699478900736","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/796079699478900736']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd02856c-ed45-dec7-0f68-00001d417a05","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/forums/t/614025/8lock8-help-support-topic-8lock8-read-ittxt/","pattern":"[url:value = 'http://www.bleepingcomputer.com/forums/t/614025/8lock8-help-support-topic-8lock8-read-ittxt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f79dcd56-e504-dfcd-2f66-0000935a85a7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: IT.txt","pattern":"[domain-name:value = 'IT.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--900e4e2f-3947-bad3-f755-00004e250b6f","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/7ev3n-HONE$T.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/7ev3n-HONE$T.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--476d685a-8b94-e12d-d5b5-00000b7a12c5","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=RDNbH5HDO1E&feature=youtu.be","pattern":"[url:value = 'https://www.youtube.com/watch?v=RDNbH5HDO1E&feature=youtu.be']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bb60c65-484f-527d-9689-000034dd15cb","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/hasherezade/malware_analysis/tree/master/7ev3n","pattern":"[url:value = 'https://github.com/hasherezade/malware_analysis/tree/master/7ev3n']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9922bf4-24b3-17e7-a185-00002ec19911","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: BACK.txt","pattern":"[domain-name:value = 'BACK.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02e82455-e2ca-e59a-d03d-0000c138221b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://decrypter.emsisoft.com/777","pattern":"[url:value = 'https://decrypter.emsisoft.com/777']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15ff4e5f-ed55-0382-3fc0-0000795a256b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ninja.gaiver","pattern":"[domain-name:value = 'ninja.gaiver']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--883e5ece-6c11-e56a-c26e-00008a1e931d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.nyxbone.com/malware/CryptoHasYou.html","pattern":"[url:value = 'http://www.nyxbone.com/malware/CryptoHasYou.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6449c0f-9987-4e25-51a6-0000df7be027","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: LOCKED.txt","pattern":"[domain-name:value = 'LOCKED.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66b214f9-0c66-27dd-17fb-000045a20862","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168","pattern":"[url:value = 'https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9d346e5-94cb-2e2c-6e0b-0000e2a63ca1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/09/erebus-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/09/erebus-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4175b55a-9125-68a8-9839-00002c8031c7","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-E9WbSxLgaYs/WGn8gC6EfvI/AAAAAAAAC8A/bzd7uP9fcxU6Fyq1n6-9ZbUUGWlls9lrwCLcB/s1600/note-txt_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-E9WbSxLgaYs/WGn8gC6EfvI/AAAAAAAAC8A/bzd7uP9fcxU6Fyq1n6-9ZbUUGWlls9lrwCLcB/s1600/note-txt_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6e10679-9aca-9172-542f-00002e0163af","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/fs0ciety-locker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/fs0ciety-locker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac179f13-58fb-3801-d8ba-00009f1c4b39","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-nskzYgbg7Ac/V_jpJ3GApqI/AAAAAAAABos/EbG_-BLDPqA9bRVOWdzHjPnDWFiHYlsJwCLcB/s1600/ransom-note.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-nskzYgbg7Ac/V_jpJ3GApqI/AAAAAAAABos/EbG_-BLDPqA9bRVOWdzHjPnDWFiHYlsJwCLcB/s1600/ransom-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46bfd7b8-1720-89b8-22a0-0000aa9c1785","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42181914-8a91-08e4-ef96-000067357f0e","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/kostya-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/kostya-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bd280f1-3f34-5b56-8d30-0000132e77f1","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://2.bp.blogspot.com/-4YmIkWfYfRA/V_lAALhfSvI/AAAAAAAABpE/Dj35aroKXSwbLXrSPqGCzbvhsTNHdsbAgCLcB/s1600/kostya.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-4YmIkWfYfRA/V_lAALhfSvI/AAAAAAAABpE/Dj35aroKXSwbLXrSPqGCzbvhsTNHdsbAgCLcB/s1600/kostya.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9da792c-702a-1241-9b88-00005dda03e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://2.bp.blogspot.com/-E_MI2fT33J0/V_k_9Gjkj4I/AAAAAAAABpA/-30UT5HhPAAR9YtVkFwgrYqLIdWPprZ9gCLcB/s1600/lock-screen.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-E_MI2fT33J0/V_k_9Gjkj4I/AAAAAAAABpA/-30UT5HhPAAR9YtVkFwgrYqLIdWPprZ9gCLcB/s1600/lock-screen.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc0263fc-01c2-f689-77ae-0000e87696ee","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221","pattern":"[url:value = 'https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a5d0a3f-fc8b-2a27-f251-00003474228a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/globe2-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/globe2-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f87a71e8-ff83-a595-8d26-0000d57314db","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://3.bp.blogspot.com/-MYI30xhrcZU/V_qcDyASJsI/AAAAAAAABpU/Pej5jDk_baYBByLx1cXwFL8LBiT8Vj3xgCLcB/s1600/note22.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-MYI30xhrcZU/V_qcDyASJsI/AAAAAAAABpU/Pej5jDk_baYBByLx1cXwFL8LBiT8Vj3xgCLcB/s1600/note22.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77b497a7-55cd-f50e-e85b-0000da4d6574","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/comrade-circle-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/comrade-circle-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa5be883-a2ee-28fe-987f-00007d1b1115","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-PdYtm6sRHAI/WAEngHQBg_I/AAAAAAAABsA/nh8m7__b0wgviTEBahyNYK4HFhF1v7rOQCLcB/s1600/icon-stalin-2.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-PdYtm6sRHAI/WAEngHQBg_I/AAAAAAAABsA/nh8m7__b0wgviTEBahyNYK4HFhF1v7rOQCLcB/s1600/icon-stalin-2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--138d4b6d-e37a-fbea-12eb-000034fd749d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-hRoC-UFr-7o/V__tAEFuZWI/AAAAAAAABrQ/xDawlulx8Bg4uEtX4bU2ezPMY-x6iFiuQCLcB/s1600/note-1ch.JPG","pattern":"[url:value = 'https://4.bp.blogspot.com/-hRoC-UFr-7o/V__tAEFuZWI/AAAAAAAABrQ/xDawlulx8Bg4uEtX4bU2ezPMY-x6iFiuQCLcB/s1600/note-1ch.JPG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f2e31a9-2187-d68b-e8f6-000038542913","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://3.bp.blogspot.com/-MmzOC__9qPA/V__t2kNX-SI/AAAAAAAABrc/t8ypPa1jCIUbPfvR7UGbdGzdvKrbAv_DgCLcB/s1600/wallpaper.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-MmzOC__9qPA/V__t2kNX-SI/AAAAAAAABrc/t8ypPa1jCIUbPfvR7UGbdGzdvKrbAv_DgCLcB/s1600/wallpaper.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ea41ec5-ef60-7b82-2855-000066e84915","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/malwrhunterteam/status/785533373007728640","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/785533373007728640']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5de604e0-5718-6102-12ab-00007091171a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/deadly-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/deadly-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--518e66d6-4004-660e-79ca-000044d56e7b","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-XZiiaCYM9Bk/WAUsUkrCJEI/AAAAAAAABtk/z-sMHflz3Q8_aWc-K9PD0N5TGkSGwwQnACLcB/s1600/note-html.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-XZiiaCYM9Bk/WAUsUkrCJEI/AAAAAAAABtk/z-sMHflz3Q8_aWc-K9PD0N5TGkSGwwQnACLcB/s1600/note-html.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63a44490-de15-8e80-fc1f-00004ccb10cd","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/enigma-2-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/enigma-2-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a972a640-467d-d092-9e9f-0000c2bac3b8","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://kf2uimw5omtgveu6.onion/","pattern":"[url:value = 'http://kf2uimw5omtgveu6.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c29dba6-fa7a-e2fb-0cdc-00005ecf1810","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: A.RSA","pattern":"[domain-name:value = 'A.RSA']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d9f721d-bd42-6228-7cc4-00009d31e001","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.torproject.org/","pattern":"[url:value = 'http://www.torproject.org/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e34e082-2e2c-c6a2-314f-0000690d8d37","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://ru.wikipedia.org/wiki/Advanced_Encryption_Standard)","pattern":"[url:value = 'https://ru.wikipedia.org/wiki/Advanced_Encryption_Standard)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4797c6aa-bc69-2be2-8d40-0000d352eb70","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://pastebin.com/HuK99Xmj","pattern":"[url:value = 'http://pastebin.com/HuK99Xmj']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2c50486-d13b-8b08-3912-00009eacd105","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/Antelox/status/785849412635521024","pattern":"[url:value = 'https://twitter.com/Antelox/status/785849412635521024']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--257e9e51-7f93-de31-8c00-0000c177faa3","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/venis-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/venis-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d762a9d-32e0-3d8f-e2e5-0000d7b07621","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://3.bp.blogspot.com/-IFEOWjw-aaQ/WAXTu9oEN4I/AAAAAAAABuY/APqBiaHn3pAX8404Noyuj7tnFJDf2m_XACLcB/s1600/note1.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-IFEOWjw-aaQ/WAXTu9oEN4I/AAAAAAAABuY/APqBiaHn3pAX8404Noyuj7tnFJDf2m_XACLcB/s1600/note1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--772a257c-17a2-91e1-713a-00009ad5cddc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/ncrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/ncrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e53392f3-0d48-3361-c0c4-0000bf53014c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://2.bp.blogspot.com/-k7T79DnBk8w/WBc67QXyjWI/AAAAAAAAB3w/QbA-E9lYdSMOg3PcG9Vz8fTc_OhmACObACLcB/s1600/note-html.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-k7T79DnBk8w/WBc67QXyjWI/AAAAAAAAB3w/QbA-E9lYdSMOg3PcG9Vz8fTc_OhmACObACLcB/s1600/note-html.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb34be65-842d-f7f7-f1fc-00008a996620","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Trojan.Encoder","pattern":"[domain-name:value = 'Trojan.Encoder']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cbccb45-888e-aa45-cca2-000068fefbab","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyber.nj.gov/threat-profiles/ransomware-variants/apt-ransomware-v2","pattern":"[url:value = 'https://www.cyber.nj.gov/threat-profiles/ransomware-variants/apt-ransomware-v2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--404c1918-56ae-5bfd-e56f-000002291385","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/ws-go-ransonware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/ws-go-ransonware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57f29e4f-3031-2793-49d9-000033c1bba0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://2.bp.blogspot.com/-NfRePJbfjbY/WAe5LHFsWaI/AAAAAAAABwE/1Pk116TDqAYEDYvnu2vzim1l-H5seW9mQCLcB/s1600/note.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-NfRePJbfjbY/WAe5LHFsWaI/AAAAAAAABwE/1Pk116TDqAYEDYvnu2vzim1l-H5seW9mQCLcB/s1600/note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a78f1e1f-5bb9-2554-6407-00004a4a002a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/apt-ransomware-2.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/apt-ransomware-2.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41be2b49-129a-1e00-9007-0000d1949042","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://2.bp.blogspot.com/-VTUhk_Py2FA/WAVCO1Yn69I/AAAAAAAABuI/N71wo2ViOE0UjrIdbeulBRTJukHtA2TdACLcB/s1600/ransom-note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-VTUhk_Py2FA/WAVCO1Yn69I/AAAAAAAABuI/N71wo2ViOE0UjrIdbeulBRTJukHtA2TdACLcB/s1600/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62c6ab31-5550-b047-e8a0-0000ee2bc8cc","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/exotic-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/exotic-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78ba9e3d-6bc6-ca9f-7db8-00001cb3ce13","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyber.nj.gov/threat-profiles/ransomware-variants/exotic-ransomware","pattern":"[url:value = 'https://www.cyber.nj.gov/threat-profiles/ransomware-variants/exotic-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--455c367b-5787-dac2-6c99-000047134ef0","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb15af8a-cad1-ac22-29c9-00005c969ffe","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.bleepingcomputer.com/news/security/eviltwins-exotic-ransomware-targets-executable-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/eviltwins-exotic-ransomware-targets-executable-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2732cd74-2b2e-2a42-c2f6-0000110d7d86","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://3.bp.blogspot.com/-SMXOoWiGkxw/WAaGOMdecrI/AAAAAAAABu8/S-YjlWlPKbItSN_fe8030tMDHWzouHsIgCLcB/s1600/note2.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-SMXOoWiGkxw/WAaGOMdecrI/AAAAAAAABu8/S-YjlWlPKbItSN_fe8030tMDHWzouHsIgCLcB/s1600/note2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--735d929b-5da7-b90b-3df1-0000539dd71d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-2QxJ3KCRimI/WAaCcWcE2uI/AAAAAAAABus/9SGRY5iQT-ITfG_JrY7mn6-PUpQrSKg7gCLcB/s1600/note1-2.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-2QxJ3KCRimI/WAaCcWcE2uI/AAAAAAAABus/9SGRY5iQT-ITfG_JrY7mn6-PUpQrSKg7gCLcB/s1600/note1-2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--822fbd33-37c7-069d-bf9e-000028e1f349","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-WJYR7LkWHWY/WAaCYScljOI/AAAAAAAABuo/j18AGhzv7WUPb2r4HWkYm4TPgYw9S5PUwCLcB/s1600/note1-1.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-WJYR7LkWHWY/WAaCYScljOI/AAAAAAAABuo/j18AGhzv7WUPb2r4HWkYm4TPgYw9S5PUwCLcB/s1600/note1-1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a91fdf2-e7b9-0080-4159-00007f717702","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: random.exotic","pattern":"[domain-name:value = 'random.exotic']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfac5021-c0e2-d477-1d29-0000a822db31","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/xtplocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/xtplocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75afdd66-89e4-d28a-17a2-00004f53ea4c","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: gmx.com","pattern":"[domain-name:value = 'gmx.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--088182f9-c224-861d-f955-000005e435ce","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: www.coinbase.com","pattern":"[domain-name:value = 'www.coinbase.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8fcc36a-db94-910e-3f6a-0000e5ea313a","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://nyxbone.com/malware/Anubis.html","pattern":"[url:value = 'http://nyxbone.com/malware/Anubis.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ada28d64-58c4-010b-f9e8-00000d5d023d","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/anubis-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/anubis-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b843fe05-0e34-989f-0a2d-000097575be4","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://4.bp.blogspot.com/-0YMsPH5WuTk/WAepI4BnqZI/AAAAAAAABv0/yXt4tdrmmAIf-N9KUmehY6mK1kTV-eFFQCLcB/s1600/note-wal2.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-0YMsPH5WuTk/WAepI4BnqZI/AAAAAAAABv0/yXt4tdrmmAIf-N9KUmehY6mK1kTV-eFFQCLcB/s1600/note-wal2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88c3a65b-4ce8-4749-987a-00006eaf0c12","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.fortinet.com/2016/10/19/japanlocker-an-excavation-to-its-indonesian-roots","pattern":"[url:value = 'https://blog.fortinet.com/2016/10/19/japanlocker-an-excavation-to-its-indonesian-roots']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b7921b8-f953-5f55-b8d8-00009a7d36e6","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://github.com/fortiguard-lion/schRansomwareDecryptor/blob/master/schRansomwarev1_decryptor.php","pattern":"[url:value = 'https://github.com/fortiguard-lion/schRansomwareDecryptor/blob/master/schRansomwarev1_decryptor.php']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b1033c2-7154-007c-ae55-00008f8172df","created":"2026-08-06T13:13:01-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cyber.nj.gov/threat-profiles/ransomware-variants/japanlocker","pattern":"[url:value = 'https://www.cyber.nj.gov/threat-profiles/ransomware-variants/japanlocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:01-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5d254bb-f241-9f9c-023f-00008b777f52","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/japanlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/japanlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5dc078b6-352d-faed-76bd-00004927f61f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-sdlDK4OIuPA/WAehWZYHaMI/AAAAAAAABvc/TcAcLG2lw10aOFY3FbP1A5EuLjL6LR62ACLcB/s1600/note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-sdlDK4OIuPA/WAehWZYHaMI/AAAAAAAABvc/TcAcLG2lw10aOFY3FbP1A5EuLjL6LR62ACLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acee14de-f135-d3ec-4951-00001a7d4512","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=Xe30kV4ip8w","pattern":"[url:value = 'https://www.youtube.com/watch?v=Xe30kV4ip8w']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d51c50aa-9e36-3a73-b0d5-00008e239cd6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/click-me-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/click-me-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02c8ecfa-bfa2-376a-f47b-00002b5145c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-1zgO3-bBazs/WAkPYqXuayI/AAAAAAAABxI/DO3vycRW-TozneSfRTdeKyXGNEtJSMehgCLcB/s1600/all-images.gif","pattern":"[url:value = 'https://3.bp.blogspot.com/-1zgO3-bBazs/WAkPYqXuayI/AAAAAAAABxI/DO3vycRW-TozneSfRTdeKyXGNEtJSMehgCLcB/s1600/all-images.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3202ea9a-0310-7b22-2df9-00004e6d02f0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://malwarebreakdown.com/2017/03/02/rig-ek-at-92-53-105-43-drops-asn1-ransomware/","pattern":"[url:value = 'https://malwarebreakdown.com/2017/03/02/rig-ek-at-92-53-105-43-drops-asn1-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7dcead1-4034-bdc3-7719-000053c99f87","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/asn1-encoder-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/asn1-encoder-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1888b4fc-3049-74ef-6201-00002b62afac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-5gZpxeEWqZg/WBeNnEP9GzI/AAAAAAAAB4g/ELCCp88whLMI6CzpGTjlxbmXBMFIKhwtwCLcB/s1600/onion-site.JPG","pattern":"[url:value = 'https://2.bp.blogspot.com/-5gZpxeEWqZg/WBeNnEP9GzI/AAAAAAAAB4g/ELCCp88whLMI6CzpGTjlxbmXBMFIKhwtwCLcB/s1600/onion-site.JPG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da816251-26a3-7fb0-91be-0000547cbb60","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/789882488365678592","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/789882488365678592']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b37c3d9b-8371-807e-792a-0000366b67a5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/lock93-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/lock93-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9091c943-c044-bfa0-d447-00001b9ab972","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-S6M83oFxSdM/WA4_ak9WATI/AAAAAAAABx0/3FL3q21FdxMQvAgrr2FORQIaNtq2-P2jACLcB/s1600/note2.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-S6M83oFxSdM/WA4_ak9WATI/AAAAAAAABx0/3FL3q21FdxMQvAgrr2FORQIaNtq2-P2jACLcB/s1600/note2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebfe2f69-7620-ca70-298d-0000fb69529c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-WuD2qaaNIb0/WA4_g_FnIfI/AAAAAAAABx4/pn6VNqMXMzI_ryvKUruY3ctYtzomT1I4gCLcB/s1600/note3.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-WuD2qaaNIb0/WA4_g_FnIfI/AAAAAAAABx4/pn6VNqMXMzI_ryvKUruY3ctYtzomT1I4gCLcB/s1600/note3.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3934190a-1d0f-40ba-2ad2-000043559dec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/790334746488365057","pattern":"[url:value = 'https://twitter.com/demonslay335/status/790334746488365057']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccd1ee59-992b-4803-3110-0000a6326c7d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/angryduck-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/angryduck-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cb1f78d-2c9f-69f4-2611-0000fa003931","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-k3s85Fx9N_E/WBIfuUNTMmI/AAAAAAAAByM/rQ10tKuXTlEJfLTOoBwJPo7rhhaiK2OoQCLcB/s1600/screen-lock.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-k3s85Fx9N_E/WBIfuUNTMmI/AAAAAAAAByM/rQ10tKuXTlEJfLTOoBwJPo7rhhaiK2OoQCLcB/s1600/screen-lock.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cae0860-edff-47a5-f267-000045168af5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/PolarToffee/status/811940037638111232","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/811940037638111232']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5ff19ac-f2ee-89c2-7536-00009216a7da","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/winnix-cryptor-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/winnix-cryptor-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91dd6134-07bd-3ee1-a452-0000b4ffb6ce","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: HowToBuyBitcoins.info","pattern":"[domain-name:value = 'HowToBuyBitcoins.info']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--122ca1f0-7bad-d599-0461-00000a3ad6ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: CoinMama.com","pattern":"[domain-name:value = 'CoinMama.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--458a0098-5b4e-7391-bdfe-0000a2299351","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: BTCDirect.eu","pattern":"[domain-name:value = 'BTCDirect.eu']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98e1e5c1-2610-6c45-08c7-000000ea54a0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: CoinCafe.com","pattern":"[domain-name:value = 'CoinCafe.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d3ca579-dcf4-5430-8d97-0000f1fc0b6e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: LocalBitcoins.com","pattern":"[domain-name:value = 'LocalBitcoins.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e947f2d-612d-fd25-2ce4-00009b26a257","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/846241982347427840","pattern":"[url:value = 'https://twitter.com/struppigel/status/846241982347427840']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43eabf24-10e1-ac14-ba6e-0000e8b012c0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.avast.com/hucky-ransomware-a-hungarian-locky-wannabe","pattern":"[url:value = 'https://blog.avast.com/hucky-ransomware-a-hungarian-locky-wannabe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f563ca4-9450-72bd-fa4c-0000dbfc3da3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/hucky-ransomware-hungarian-locky.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/hucky-ransomware-hungarian-locky.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ec2d35d-95bb-c0ff-b69f-00004f6dcd83","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-lLZZBScC27U/WBmkDQzl9FI/AAAAAAAAB5Y/gozOy17Yv0EWNCQVSOXn-PkTccYZuMmPQCLcB/s1600/note-bmp_2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-lLZZBScC27U/WBmkDQzl9FI/AAAAAAAAB5Y/gozOy17Yv0EWNCQVSOXn-PkTccYZuMmPQCLcB/s1600/note-bmp_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0659f495-0b25-1906-e127-0000e53e53fc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: instructions.txt","pattern":"[domain-name:value = 'instructions.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4aad411-1d65-7d1a-22d5-00009f6b97b1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: utasitasok.txt","pattern":"[domain-name:value = 'utasitasok.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5b2d69a-e668-006a-44f8-0000690f1b3d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: mail2tor.com","pattern":"[domain-name:value = 'mail2tor.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66bbf7ee-9363-6157-da1e-00005044a51c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: Https://hu.wikipedia.org/wiki/Advanced_Encryption_Standard","pattern":"[url:value = 'Https://hu.wikipedia.org/wiki/Advanced_Encryption_Standard']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c25297e7-987d-7792-0137-0000e3beaf4c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: Https://hu.wikipedia.org/wiki/RSA-elj\u00e1r\u00e1s","pattern":"[url:value = 'Https://hu.wikipedia.org/wiki/RSA-elj\u00e1r\u00e1s']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da1213fd-2ddd-e96c-d8bb-0000db3c952d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/-proof-of-concept-cryptowire-ransomware-spawns-lomix-and-ultralocker-families/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/-proof-of-concept-cryptowire-ransomware-spawns-lomix-and-ultralocker-families/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8aaa912-788d-eb44-3d71-0000a2127f0e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/791554654664552448","pattern":"[url:value = 'https://twitter.com/struppigel/status/791554654664552448']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62294d0e-0309-b85d-2907-0000f98dc1e2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/cryptowire-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/cryptowire-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a91b39b-1021-a66b-91df-00004dd04c4c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-b0QiEQec0Pg/WBMf2HG6hjI/AAAAAAAABz8/BtN2-INZ2KQ4W2_iPqvDZTtlA0Aq_4gVACLcB/s1600/Screenshot_2.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-b0QiEQec0Pg/WBMf2HG6hjI/AAAAAAAABz8/BtN2-INZ2KQ4W2_iPqvDZTtlA0Aq_4gVACLcB/s1600/Screenshot_2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88f4907d-f26e-abaf-ef7e-000063ce023a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-vIMgkn8WVJM/WBJAxkbya7I/AAAAAAAABys/tCpaTOxfGDw8A611gudDh46mhZT70dURwCLcB/s1600/lock-screen.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-vIMgkn8WVJM/WBJAxkbya7I/AAAAAAAABys/tCpaTOxfGDw8A611gudDh46mhZT70dURwCLcB/s1600/lock-screen.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ded8f0d8-d704-89f7-7505-0000eb589aa3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1e6d3b6-82f3-bfa7-c2c3-0000d6d9162c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/fileice-ransomware-survey.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/fileice-ransomware-survey.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f44eebb-8a3d-c31f-6509-00008c310fcb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-GAPCc3ITdQY/WBMTmJ4NaRI/AAAAAAAABzM/XPbPZvZ8vbUrOWxtwPmfHFJiNT_2gfaOgCLcB/s1600/fileice-source.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-GAPCc3ITdQY/WBMTmJ4NaRI/AAAAAAAABzM/XPbPZvZ8vbUrOWxtwPmfHFJiNT_2gfaOgCLcB/s1600/fileice-source.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b0ab6cb-66ea-f3a0-3926-00003bc6dc24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-2AlvtcvdyUY/WBMVptG_V5I/AAAAAAAABzc/1KvAMeDmY2w9BN9vkqZO8LWkBu7T9mvDACLcB/s1600/ThxForYurTyme.JPG","pattern":"[url:value = 'https://1.bp.blogspot.com/-2AlvtcvdyUY/WBMVptG_V5I/AAAAAAAABzc/1KvAMeDmY2w9BN9vkqZO8LWkBu7T9mvDACLcB/s1600/ThxForYurTyme.JPG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc01b946-603a-d30d-4e77-0000c2619167","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-72ECd1vsUdE/WBMSzPQEgzI/AAAAAAAABzA/i8V-Kg8Gstcn_7-YZK__PDC2VgafWcfDgCLcB/s1600/survey-screen.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-72ECd1vsUdE/WBMSzPQEgzI/AAAAAAAABzA/i8V-Kg8Gstcn_7-YZK__PDC2VgafWcfDgCLcB/s1600/survey-screen.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26817da1-96b3-bac8-be2b-00002ce2c6d2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/encryptile-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/encryptile-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--222128cb-7186-ca39-97fb-000078b882d9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-_jxt6kCRnwM/WBNf7mi92nI/AAAAAAAAB0g/homx8Ly379oUKAOIhZU6MxCiWX1gA_TkACLcB/s1600/wallp.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-_jxt6kCRnwM/WBNf7mi92nI/AAAAAAAAB0g/homx8Ly379oUKAOIhZU6MxCiWX1gA_TkACLcB/s1600/wallp.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b90e81d-71f9-80a3-dfaf-000086209f56","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/630835/esmeralda-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/630835/esmeralda-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--384dd0f7-63df-e79e-e632-0000cda8d8f1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/esmeralda-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/esmeralda-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--438191a2-6c48-2005-0fb2-0000dc6fc40e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-vaWu8OjSiXE/WBzkLBdB8DI/AAAAAAAAB_Y/k8vvtYEIdTkFJhruRJ6qDNAujAn4Ph-xACLcB/s1600/esmeralda-lock_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-vaWu8OjSiXE/WBzkLBdB8DI/AAAAAAAAB_Y/k8vvtYEIdTkFJhruRJ6qDNAujAn4Ph-xACLcB/s1600/esmeralda-lock_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ba6417d-6230-bddc-f4c7-00007e88c60f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/PolarToffee/status/792796055020642304","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/792796055020642304']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a614cc7-f959-a937-d779-000006ef9426","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/alcatraz-locker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/alcatraz-locker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fae7dca1-09a4-136d-4bf5-00003f2f8fcb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-y5a6QnjAiv0/WBcMKV0zDDI/AAAAAAAAB3c/ytOQHJgmy30H_jEWPcfht7RRsh4NhcrvACLcB/s1600/Screenshot_2.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-y5a6QnjAiv0/WBcMKV0zDDI/AAAAAAAAB3c/ytOQHJgmy30H_jEWPcfht7RRsh4NhcrvACLcB/s1600/Screenshot_2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01aecfba-7cf2-9c15-8c67-000041b37b07","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-b0-Uvnz703Q/WBcMGkZqtwI/AAAAAAAAB3Y/a6clIjdp_tI2T-OE_ykyjvB2qNY3gqWdQCLcB/s1600/Screenshot_1.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-b0-Uvnz703Q/WBcMGkZqtwI/AAAAAAAAB3Y/a6clIjdp_tI2T-OE_ykyjvB2qNY3gqWdQCLcB/s1600/Screenshot_1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bab5c662-58e9-c095-76a0-0000998e6d91","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/791576159960072192","pattern":"[url:value = 'https://twitter.com/struppigel/status/791576159960072192']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e46cee8-f5a1-e400-951d-00009941dabd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/ifn643-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/ifn643-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea9d141c-8f22-b6b4-0a15-0000415a27fc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-JuBZKpEHV0Q/WBYNHFlW7pI/AAAAAAAAB20/z0DPYA_8l6U8tB6pbgo8ZwyIJRcrIVy2ACLcB/s1600/Note1.JPG","pattern":"[url:value = 'https://4.bp.blogspot.com/-JuBZKpEHV0Q/WBYNHFlW7pI/AAAAAAAAB20/z0DPYA_8l6U8tB6pbgo8ZwyIJRcrIVy2ACLcB/s1600/Note1.JPG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbe6ab6b-37c8-4537-351c-0000b46e43bb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/791557636164558848","pattern":"[url:value = 'https://twitter.com/struppigel/status/791557636164558848']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dae0e96-95dc-cec5-80ec-0000a20522e0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/onyx-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/onyx-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a9bcbd9-0527-db70-f340-000039fd0f62","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-cukkC4KAhZE/WBY1jJbcQoI/AAAAAAAAB3I/p8p-iNQRnQwnP6c6H77h_SHMQNAlkJ1CgCLcB/s1600/onyx.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-cukkC4KAhZE/WBY1jJbcQoI/AAAAAAAAB3I/p8p-iNQRnQwnP6c6H77h_SHMQNAlkJ1CgCLcB/s1600/onyx.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09604945-1f35-e0e2-ccb8-000099287360","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: Jack.Pot","pattern":"[domain-name:value = 'Jack.Pot']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2bd0800-7f1c-eb14-b8a1-0000897f0075","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-28-2016-locky-angry-duck-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-28-2016-locky-angry-duck-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2ce7bf0-2e1d-752c-a902-0000f1a57916","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/791639214152617985","pattern":"[url:value = 'https://twitter.com/struppigel/status/791639214152617985']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d543f2d-acb4-6205-63d6-0000f03b2fd1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/jackpot-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/jackpot-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8cfc171-6769-59f1-50e7-0000787f7e2f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-oaElZvUqbfo/WBUOGdD8unI/AAAAAAAAB1w/Ya1_qq0gfa09AhRddUITQNRxKloXgD_BwCLcB/s1600/wallp.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-oaElZvUqbfo/WBUOGdD8unI/AAAAAAAAB1w/Ya1_qq0gfa09AhRddUITQNRxKloXgD_BwCLcB/s1600/wallp.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99eb3ae1-148f-a105-a9cb-00004e271a29","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/791943837874651136","pattern":"[url:value = 'https://twitter.com/struppigel/status/791943837874651136']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13b2bb1c-9d62-3fd1-2be0-0000c314ba7a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/masterbuster-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/masterbuster-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ee947f3-72c7-868d-4feb-0000251a0b47","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-gqEyoqXbZnE/WBXoF5bPZZI/AAAAAAAAB2U/YGpgIdjXyQQeDnwc9PlJs37YWtWTnH_wgCLcB/s1600/note.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-gqEyoqXbZnE/WBXoF5bPZZI/AAAAAAAAB2U/YGpgIdjXyQQeDnwc9PlJs37YWtWTnH_wgCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a008c00a-96a1-4f4e-3130-0000f3eba039","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: CreatesReadThisFileImportant.txt","pattern":"[domain-name:value = 'CreatesReadThisFileImportant.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4ee1b3b-35e2-25ad-0dce-000032cc4bce","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://goo.gl/forms/VftoBRppkJ","pattern":"[url:value = 'http://goo.gl/forms/VftoBRppkJ']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf2acf05-9360-cb85-40d1-0000656485ad","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/ishtar-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/ishtar-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--476e7071-04ee-977a-1819-000030293bd5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: ISHTAR.DATA","pattern":"[domain-name:value = 'ISHTAR.DATA']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab6be09a-bc45-bbba-7afb-000080ec331f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://bitmsg.me/","pattern":"[url:value = 'https://bitmsg.me/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--319f71c7-4ffc-52a2-9760-000036020338","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1050117756094476289","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1050117756094476289']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a001c12a-20b2-b611-c0ac-0000644a50a1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/rotorcrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/rotorcrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7fd7038-5239-2e72-d936-00006ef3735b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: INFO.txt","pattern":"[domain-name:value = 'INFO.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c5a2562-c393-f46c-5fb3-0000bb0dbe7c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: TUTAMAIL.COM","pattern":"[domain-name:value = 'TUTAMAIL.COM']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3d7232c-bf74-3653-4c55-0000633fca8f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/zerocrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/zerocrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d06ee1cb-2763-1a9a-734b-000084e3b22d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-0AGEY4vAlA0/WBi_oChzFNI/AAAAAAAAB4w/8PrPRfFU30YFWCwHzqnsx4bYISVNFyesQCLcB/s1600/note.PNG","pattern":"[url:value = 'https://1.bp.blogspot.com/-0AGEY4vAlA0/WBi_oChzFNI/AAAAAAAAB4w/8PrPRfFU30YFWCwHzqnsx4bYISVNFyesQCLcB/s1600/note.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f8fe6e4-643a-c52e-04b3-00002fbef786","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/russian-globe-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/russian-globe-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64f659c2-a4d6-879d-7dd6-000059fab6d0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/winrarer-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/winrarer-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f437f907-ef26-ddeb-6b1f-00008cfaac24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-zb0TP0wza7I/WBpShN0tCMI/AAAAAAAAB64/oTkSFwKFVx8hY1rEs5FQU6F7oaBW-LqHwCLcB/s1600/note_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-zb0TP0wza7I/WBpShN0tCMI/AAAAAAAAB64/oTkSFwKFVx8hY1rEs5FQU6F7oaBW-LqHwCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd0637d2-7776-7823-6ea5-0000031fa10c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/encryptss77-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/encryptss77-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c992f6ac-de31-a357-32e6-000078f35530","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://virusinfo.info/showthread.php?t=201710","pattern":"[url:value = 'http://virusinfo.info/showthread.php?t=201710']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0267a6c8-37a2-a8ee-c45f-000040416dc0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/dummyencrypter-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/dummyencrypter-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4c4f961-dfe0-fcdc-5427-0000e414b850","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-2rS0Yq27wp0/WBtKfupZ2sI/AAAAAAAAB8I/0MR-9Xx0n-0zV_NBSScDCiYTp1KH-edtACLcB/s1600/Lockscreen_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-2rS0Yq27wp0/WBtKfupZ2sI/AAAAAAAAB8I/0MR-9Xx0n-0zV_NBSScDCiYTp1KH-edtACLcB/s1600/Lockscreen_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a7e19e1-8cc8-18e4-6177-000070eb0a70","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-kangaroo-ransomware-not-only-encrypts-your-data-but-tries-to-lock-you-out-of-windows/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-kangaroo-ransomware-not-only-encrypts-your-data-but-tries-to-lock-you-out-of-windows/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7182ad11-4f67-c668-8499-0000f18dac30","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/kangaroo-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/kangaroo-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c12e760-bb12-c0f2-e9c6-00005e279ac1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-1jyI1HoqJag/WBzj9SLvipI/AAAAAAAAB_U/_sp8TglWEPQphG8neqrztfUUIjcBbVhDwCLcB/s1600/kangaroo-lock_2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-1jyI1HoqJag/WBzj9SLvipI/AAAAAAAAB_U/_sp8TglWEPQphG8neqrztfUUIjcBbVhDwCLcB/s1600/kangaroo-lock_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--911e42fb-fa38-a1d0-713a-0000b6d80e93","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: Recovery.txt","pattern":"[domain-name:value = 'Recovery.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b7b28bd-136a-1012-3ec0-0000786af4f9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: filename.Instructions","pattern":"[domain-name:value = 'filename.Instructions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22cd6695-0f34-e77e-d390-0000d9dc4dbb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/btclocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/btclocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faacdaa4-b189-dd9c-3de0-00008eb072be","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/--7M0dtKhOio/WBxJx1PflYI/AAAAAAAAB-g/DSdMjLDLnVwwaMBW4H_98SzSJupLYm9WgCLcB/s1600/note_2.PNG","pattern":"[url:value = 'https://4.bp.blogspot.com/--7M0dtKhOio/WBxJx1PflYI/AAAAAAAAB-g/DSdMjLDLnVwwaMBW4H_98SzSJupLYm9WgCLcB/s1600/note_2.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--103df062-7f95-37d7-f92b-0000f3f1f75c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/hollycrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/hollycrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e063a281-83ed-78d7-5f53-00005c0bda70","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-PdtXGwSTn24/WBxIoomzF4I/AAAAAAAAB-U/lxTwKWc7T9MJhUtcRMh1mn9m_Ftjox9XwCLcB/s1600/note_2.PNG","pattern":"[url:value = 'https://1.bp.blogspot.com/-PdtXGwSTn24/WBxIoomzF4I/AAAAAAAAB-U/lxTwKWc7T9MJhUtcRMh1mn9m_Ftjox9XwCLcB/s1600/note_2.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d678069d-5329-dafa-0d67-000009393053","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/794444032286060544","pattern":"[url:value = 'https://twitter.com/struppigel/status/794444032286060544']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a152ec42-0bde-5e96-5cc9-0000f0c69099","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/gremit-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/gremit-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a711e633-aad0-3cfa-2f9d-0000b0cf6a58","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepstatic.com/images/news/columns/week-in-ransomware/11-4-16/CwZubUHW8AAE4qi[1].jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/columns/week-in-ransomware/11-4-16/CwZubUHW8AAE4qi[1].jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b3f154f-0922-0bbf-05cc-00000e634471","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/794077145349967872","pattern":"[url:value = 'https://twitter.com/struppigel/status/794077145349967872']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98b8bb39-f1df-2043-5745-00001d47d7e4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/zscreenlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/zscreenlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5b5836a-55ac-0c3a-0ef4-00001a938736","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/new-serpent-ransomware-targets-danish-speakers","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/new-serpent-ransomware-targets-danish-speakers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5635b726-dec1-995d-162a-0000358183f6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-4th-2016-cerber-paydos-alcatraz-locker-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-4th-2016-cerber-paydos-alcatraz-locker-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4569675-0830-1b39-e672-0000035f36fc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ransomware-goes-retro-with-paydos-and-serpent-written-as-batch-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ransomware-goes-retro-with-paydos-and-serpent-written-as-batch-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caa6ae96-f479-c291-2462-000002d9169c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/paydos-ransomware-serpent.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/paydos-ransomware-serpent.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a098fa91-33d5-7ebe-bb6e-000018208588","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/fucksociety-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/fucksociety-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed5cd1ed-c124-5630-ce81-0000afb2ef31","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.ru/2016/05/remindme-ransomware-2.html\\","pattern":"[url:value = 'https://id-ransomware.blogspot.ru/2016/05/remindme-ransomware-2.html\\\\']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96140c03-6db8-4712-abb5-0000405f6010","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/795630452128227333","pattern":"[url:value = 'https://twitter.com/struppigel/status/795630452128227333']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e64783-81b3-be0a-5c1f-0000e1547e0d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/november-2016-month-ransomware/","pattern":"[url:value = 'https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/november-2016-month-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72402039-ebac-c8eb-e341-00003c94fef1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/cerbertear-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/cerbertear-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--202902ef-75a1-2532-b31e-0000264c28fd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-ftA6aPEXwPM/WCDY3IiSq6I/AAAAAAAACCU/lnH25navXDkNccw5eQL9fkztRAeIqDYdQCLcB/s1600/note111.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-ftA6aPEXwPM/WCDY3IiSq6I/AAAAAAAACCU/lnH25navXDkNccw5eQL9fkztRAeIqDYdQCLcB/s1600/note111.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d4122a2-109d-91c6-1145-000088e3fb0b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/blog/research/76558/the-first-cryptor-to-exploit-telegram/","pattern":"[url:value = 'https://securelist.com/blog/research/76558/the-first-cryptor-to-exploit-telegram/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b557481-f286-fa36-1fb2-000044d32d0b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--912a4ec2-c554-8d1a-2d79-0000d31cac4c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://malwarebytes.app.box.com/s/kkxwgzbpwe7oh59xqfwcz97uk0q05kp3","pattern":"[url:value = 'https://malwarebytes.app.box.com/s/kkxwgzbpwe7oh59xqfwcz97uk0q05kp3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69d2a974-9359-8339-a3ba-0000b0963113","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.securityweek.com/telecrypt-ransomwares-encryption-cracked","pattern":"[url:value = 'http://www.securityweek.com/telecrypt-ransomwares-encryption-cracked']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f1584ad-93a4-b603-7df4-000017e432b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/telecrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/telecrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4729416e-b759-6520-6af3-00001def45eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-UFksnOoE4Ss/WCRUNbQuqyI/AAAAAAAACFI/Gs3Gkby335UmiddlYWJDkw8O-BBLt-BlQCLcB/s1600/telegram_rans.gif","pattern":"[url:value = 'https://4.bp.blogspot.com/-UFksnOoE4Ss/WCRUNbQuqyI/AAAAAAAACFI/Gs3Gkby335UmiddlYWJDkw8O-BBLt-BlQCLcB/s1600/telegram_rans.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d91af1ae-183e-9af0-71d2-0000d7551c9b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/796083768155078656","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/796083768155078656']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b91793c7-e103-724a-0c9e-0000b92999cc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/paysafegen-german-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/paysafegen-german-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8cebe0a-0d54-85c7-f8d4-0000ff7bac01","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-r2kaNLjBcEk/WCNCqrpHPZI/AAAAAAAACEE/eFSWuu4mUZoDV5AnduGR4KxHlFM--uIzACLcB/s1600/lock-screen.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-r2kaNLjBcEk/WCNCqrpHPZI/AAAAAAAACEE/eFSWuu4mUZoDV5AnduGR4KxHlFM--uIzACLcB/s1600/lock-screen.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17fe2ae4-9328-84b2-5990-00006ff32ef6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://forum.drweb.com/index.php?showtopic=315142","pattern":"[url:value = 'https://forum.drweb.com/index.php?showtopic=315142']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7481d0f1-e898-63e6-5f73-00005bf72a94","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/kolobo-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/kolobo-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24faf841-1962-4895-084c-00000423d2ca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ransomware.wiki/tag/kolobo/","pattern":"[url:value = 'https://www.ransomware.wiki/tag/kolobo/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e78416f-573e-a0c9-9ba7-000000414ec7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decrypter.emsisoft.com/","pattern":"[url:value = 'https://decrypter.emsisoft.com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29cca306-1034-0c5f-5402-0000e7035884","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://researchcenter.paloaltonetworks.com/2015/09/updated-pclock-ransomware-still-comes-up-short/","pattern":"[url:value = 'http://researchcenter.paloaltonetworks.com/2015/09/updated-pclock-ransomware-still-comes-up-short/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--071349be-cf8b-1f01-7f44-00009eb32321","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/suppteam-ransomware-sysras.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/suppteam-ransomware-sysras.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d747cf3e-456c-8c53-523b-00007e599251","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/old-cryptolocker-copycat-named-pclock-resurfaces-with-new-attacks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/old-cryptolocker-copycat-named-pclock-resurfaces-with-new-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba27b47e-e748-3bca-1850-00008fbade99","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/wickedlocker-ht-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/wickedlocker-ht-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcd48c70-84e6-7dcf-be22-0000b60feca8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-CTLT300bjNk/WCg9mrJArSI/AAAAAAAACGk/weWSqTMVS9AXdxJh_SA06SOH4kh2VGW1gCLcB/s1600/note_2.PNG.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-CTLT300bjNk/WCg9mrJArSI/AAAAAAAACGk/weWSqTMVS9AXdxJh_SA06SOH4kh2VGW1gCLcB/s1600/note_2.PNG.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--176dab2d-92cb-9919-f307-0000ba13e8cd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-18th-2016-crysis-cryptoluck-chip-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-18th-2016-crysis-cryptoluck-chip-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e397f11-ba8d-5be4-d943-00001e3061c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/researcher-finds-the-karma-ransomware-being-distributed-via-pay-per-install-network/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/researcher-finds-the-karma-ransomware-being-distributed-via-pay-per-install-network/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--289bf6b2-aaba-d312-5a79-00001797630f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/karma-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/karma-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21405bdd-6194-0887-3b5b-00005eb426e3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/k/karma-ransomware/ransom-note.png","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/k/karma-ransomware/ransom-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12185b32-9282-4318-7925-000099ba688b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ransomlook.io/group/nemesis","pattern":"[url:value = 'https://www.ransomlook.io/group/nemesis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ca21571-4da1-3323-c978-0000ae286325","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/829353444632825856","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/829353444632825856']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f93702e8-45f1-d654-b88c-0000d90c03c2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/crypton-ransomware-is-here-and-its-not-so-bad-/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/crypton-ransomware-is-here-and-its-not-so-bad-/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--851e3d0c-94d7-74ed-bc82-00006d8bc992","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decrypter.emsisoft.com/crypton","pattern":"[url:value = 'https://decrypter.emsisoft.com/crypton']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27e980ac-d0ff-19c3-d790-0000c641231a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/crypton-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/crypton-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bc71177-ea1c-14c6-cd93-0000f3114f53","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-2fAMkigwn4E/WCs1vKiB9UI/AAAAAAAACIs/_kgk8U9wfisV0MTYInIbArwL8zgLyBDIgCLcB/s1600/note-eng.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-2fAMkigwn4E/WCs1vKiB9UI/AAAAAAAACIs/_kgk8U9wfisV0MTYInIbArwL8zgLyBDIgCLcB/s1600/note-eng.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--803ba835-ae81-53eb-badf-00000103bd90","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://k7kzrgcoxsjm7fujj5votltw44vhidneye2dkzcnrw7k7gihhpxmctqd.onion/","pattern":"[url:value = 'http://k7kzrgcoxsjm7fujj5votltw44vhidneye2dkzcnrw7k7gihhpxmctqd.onion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c5864c0-563e-1acf-ce67-0000dd500f1b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: maria.lopez","pattern":"[domain-name:value = 'maria.lopez']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--662300ac-de24-1ee1-cb3e-000037aa78dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: tom.cruz","pattern":"[domain-name:value = 'tom.cruz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a539142-7e2a-da13-b0fd-0000f91b7bc6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: julia.crown","pattern":"[domain-name:value = 'julia.crown']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a836af3-e5bd-9af1-520b-0000a857d90a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwareforme/status/798258032115322880","pattern":"[url:value = 'https://twitter.com/malwareforme/status/798258032115322880']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a49e308-644b-720e-15aa-000080364d57","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.bleepingcomputer.com/news/security/cryptoluck-ransomware-being-malvertised-via-rig-e-exploit-kits/","pattern":"[url:value = 'http://www.bleepingcomputer.com/news/security/cryptoluck-ransomware-being-malvertised-via-rig-e-exploit-kits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c276b94c-0459-21cc-e023-00000197f030","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/cryptoluck-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/cryptoluck-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb76aba6-9005-7964-80ff-0000dd16d5ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-tCYSY5fpE5Q/WDLLZssImkI/AAAAAAAACMg/7TmWPW3k4jQuGIYZN_dCxcSGcY_c4po9wCLcB/s1600/note3_2.PNG","pattern":"[url:value = 'https://4.bp.blogspot.com/-tCYSY5fpE5Q/WDLLZssImkI/AAAAAAAACMg/7TmWPW3k4jQuGIYZN_dCxcSGcY_c4po9wCLcB/s1600/note3_2.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abb0b300-ce34-dc9a-abb6-0000f0ff0bf2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-skwh_-RY50s/WDK2XLhtt3I/AAAAAAAACL0/CaZ0A_fl2Zk-YZYU9g4QCQZkODpicbXpQCLcB/s1600/note_2.PNG","pattern":"[url:value = 'https://2.bp.blogspot.com/-skwh_-RY50s/WDK2XLhtt3I/AAAAAAAACL0/CaZ0A_fl2Zk-YZYU9g4QCQZkODpicbXpQCLcB/s1600/note_2.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d410117d-1b2e-26b3-15d0-0000e6318d0d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/798268218364358656","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/798268218364358656']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8185c310-627d-abad-e749-00009555157d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/angela-merkel-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/angela-merkel-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2f94b26-5635-03e6-1b05-00001f5aa368","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-QaJ-Z27tL7s/WDCvwYY2UVI/AAAAAAAACKg/swpf1eKf1Y8oYIK5U8gbfi1H9AQ3Q3r8QCLcB/s1600/angela-merkel.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-QaJ-Z27tL7s/WDCvwYY2UVI/AAAAAAAACKg/swpf1eKf1Y8oYIK5U8gbfi1H9AQ3Q3r8QCLcB/s1600/angela-merkel.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d804f29c-be5b-7920-c8c3-0000219843c4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/GrujaRS/status/1072139616910757888","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1072139616910757888']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fca0361d-4b15-f404-4613-0000bf4247ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=qjoYtwLx2TI","pattern":"[url:value = 'https://www.youtube.com/watch?v=qjoYtwLx2TI']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0a6fa51-37a5-d948-6f96-000048ee0e23","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--842cca1a-a515-e30a-f155-0000e60a30ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/1064061275863425025","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/1064061275863425025']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--798bc202-b428-5645-8316-000074547edd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/1060825783197933568","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/1060825783197933568']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6a81c4e-1540-5e05-c45c-0000b0089315","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1059940414147489792","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1059940414147489792']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31f5725a-2c3e-62fa-c009-00004583f31e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1059521042383814657","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1059521042383814657']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f06596b1-40bf-02f8-c058-00002a296932","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/1038680437508501504","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/1038680437508501504']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aec89e6-6a28-1cbc-c439-00001ae464a7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1049313390097813504","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1049313390097813504']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59d77254-661a-982f-d0fe-00009a7d9f98","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-bip-dharma-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-bip-dharma-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f443f074-9a6c-eda8-2f8f-00005ce77441","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-cmb-dharma-ransomware-variant-released/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-cmb-dharma-ransomware-variant-released/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--017a6a5b-74ec-8f64-3ca6-0000bb5d9ff1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-the-dharma-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-the-dharma-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e49fbf8f-e3d8-945c-deb6-00001df22555","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/dharma-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/dharma-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0342c640-765d-5677-b30e-0000819e9819","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pbs.twimg.com/media/DuEBIMBW0AANnGW.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DuEBIMBW0AANnGW.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--551084ff-82d2-7fab-7e02-000008b63c3d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pbs.twimg.com/media/DrWqLWzXgAc4SlG.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DrWqLWzXgAc4SlG.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71bd99b3-7473-95c9-a7d0-0000263dfbf4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pbs.twimg.com/media/Dmof_FyXsAEJmgQ.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Dmof_FyXsAEJmgQ.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0bbcf57-6c73-8ece-5e02-00008d54dcde","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pbs.twimg.com/media/Dmof_FiXsAAAvTN.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Dmof_FiXsAAAvTN.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab091760-67fe-cde5-9a8d-0000c0feb217","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/d/dharma/cmb/hta-ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/d/dharma/cmb/hta-ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89ffdb0c-b34f-4adf-1028-00001eafb6c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ENCRYPTED.txt","pattern":"[domain-name:value = 'ENCRYPTED.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a799265-5317-b7ab-a54d-00006b9d7bc2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:02-04:00","name":"domain: Info.hta","pattern":"[domain-name:value = 'Info.hta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--029c809e-5942-9779-5dcb-0000c1c19772","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://localbitcoins.com/buy_bitcoins","pattern":"[url:value = 'https://localbitcoins.com/buy_bitcoins']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad6bab3b-c8dc-05d5-9d60-00004bdb9280","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.coindesk.com/information/how-can-i-buy-bitcoins/\\nAttention!\\nDo","pattern":"[url:value = 'http://www.coindesk.com/information/how-can-i-buy-bitcoins/\\\\nAttention!\\\\nDo']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--356eb630-3436-f6fe-9755-0000c888e56a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://localbitcoins.com/buy_bitcoins\\nAlso","pattern":"[url:value = 'https://localbitcoins.com/buy_bitcoins\\\\nAlso']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c26db773-85d7-d712-bc59-0000d39fd890","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: 420blaze.it","pattern":"[domain-name:value = '420blaze.it']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dce94890-bda3-daf8-5abb-0000fda8d926","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: firemail.cc","pattern":"[domain-name:value = 'firemail.cc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ccb9034-b143-a9de-2b6c-0000aae3994c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/rig-e-exploit-kit-now-distributing-new-chip-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/rig-e-exploit-kit-now-distributing-new-chip-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70d05645-6896-7d4b-e2f0-0000e81522f3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://malware-traffic-analysis.net/2016/11/17/index.html","pattern":"[url:value = 'http://malware-traffic-analysis.net/2016/11/17/index.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcdf4f28-c330-d29b-2426-0000a3a5ce85","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/chip-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/chip-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6983f5bc-673a-a924-8194-0000254885d1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-OvB9TMJoimE/WC9QXRPFNwI/AAAAAAAACJU/iYcCC9tKvGIu4jH2bd6xLvmO7KMVVCLdgCLcB/s1600/note_2.PNG","pattern":"[url:value = 'https://2.bp.blogspot.com/-OvB9TMJoimE/WC9QXRPFNwI/AAAAAAAACJU/iYcCC9tKvGIu4jH2bd6xLvmO7KMVVCLdgCLcB/s1600/note_2.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cc933a1-68c6-1813-3297-00003a1f6dd1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/799388289337671680","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/799388289337671680']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5702899e-5bff-1862-700e-000007b4922d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/shelllocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/shelllocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13947199-0a8d-09d0-6002-0000c7f2d928","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-0N1ZUh4WcxQ/WDCfENY1eyI/AAAAAAAACKE/_RVIxRCwedMrD0Tj9o6-ew8u3pL0Y5w8QCLcB/s1600/lock-note2.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-0N1ZUh4WcxQ/WDCfENY1eyI/AAAAAAAACKE/_RVIxRCwedMrD0Tj9o6-ew8u3pL0Y5w8QCLcB/s1600/lock-note2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--800a02cd-f7b1-91cb-9b6c-0000bfe2cba1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-nagini-ransomware-sics-voldemort-on-your-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-nagini-ransomware-sics-voldemort-on-your-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec4b1044-da27-2d61-2e30-00002829ea17","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://id-ransomware.blogspot.co.il/2016/09/nagini-voldemort-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.co.il/2016/09/nagini-voldemort-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8aeac05e-1691-406f-f859-000019719ab6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-qJHhbtoL1Y4/V-lOClxieEI/AAAAAAAABis/IbnVAY8hnmEfU8_iU1CgQ3FWeX4YZOkBACLcB/s1600/Nagini.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-qJHhbtoL1Y4/V-lOClxieEI/AAAAAAAABis/IbnVAY8hnmEfU8_iU1CgQ3FWeX4YZOkBACLcB/s1600/Nagini.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ae5c3cf-0583-2a83-35a9-0000750e997d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: voldemort.horcrux","pattern":"[domain-name:value = 'voldemort.horcrux']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8d11c7c-0cb9-a47b-3ed0-0000be3e6b2d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-donald-trump-ransomware-tries-to-build-walls-around-your-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-donald-trump-ransomware-tries-to-build-walls-around-your-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9735be40-254a-1b34-70c5-0000a8198fec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-RwJ6R-uvYg0/V-qfeRPz7GI/AAAAAAAABi8/7x4MxRP7Jp8edbTJqz4iuEye0q1u5k3pQCLcB/s1600/donald-trump-ransomware.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-RwJ6R-uvYg0/V-qfeRPz7GI/AAAAAAAABi8/7x4MxRP7Jp8edbTJqz4iuEye0q1u5k3pQCLcB/s1600/donald-trump-ransomware.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fefc964-cf74-11ac-f3c5-00009125b5a3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://id-ransomware.blogspot.co.il/2016/09/donald-trump-ransomware.html","pattern":"[url:value = 'http://id-ransomware.blogspot.co.il/2016/09/donald-trump-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9f6c6ac-f972-185b-68e7-0000ed6ac6e2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/vindowslocker-ransomware-mimics-tech-support-scam-not-the-other-way-around/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/vindowslocker-ransomware-mimics-tech-support-scam-not-the-other-way-around/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11f7c9bd-9a9d-9e9a-2728-000000112344","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/800729944112427008","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/800729944112427008']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--296043dd-cbef-2ed1-803a-0000e7c19e7a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://rol.im/VindowsUnlocker.zip","pattern":"[url:value = 'https://rol.im/VindowsUnlocker.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1247c7f-d574-9ff7-d1db-00001452b859","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://malwarebytes.app.box.com/s/gdu18hr17mwqszj3hjw5m3sw84k8hlph","pattern":"[url:value = 'https://malwarebytes.app.box.com/s/gdu18hr17mwqszj3hjw5m3sw84k8hlph']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac8b77fa-08ac-731d-3590-00005631069d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/vindowslocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/vindowslocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f4bfb6b-8b07-860b-2b70-0000a6b2c11e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-61DcGSFljUk/WDM2UpFZ02I/AAAAAAAACMw/smvauQCvG3IPHOtEjPP4ocGKmBhVRBv-wCLcB/s1600/lock-note.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-61DcGSFljUk/WDM2UpFZ02I/AAAAAAAACMw/smvauQCvG3IPHOtEjPP4ocGKmBhVRBv-wCLcB/s1600/lock-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c259eb2-4e73-634e-9b22-0000966a1c3f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/10/airacrop-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/10/airacrop-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23df65cf-3950-6993-3a31-00006063c457","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/nmoreira-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/nmoreira-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51de142b-df9c-9ad7-4aa7-00008fabc478","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-4HNc9S8SY4I/WBMkpdKyDsI/AAAAAAAAB0I/udESgro7YB4pF98Dv2KrrecyymFGsvV2QCLcB/s1600/note.JPG","pattern":"[url:value = 'https://2.bp.blogspot.com/-4HNc9S8SY4I/WBMkpdKyDsI/AAAAAAAAB0I/udESgro7YB4pF98Dv2KrrecyymFGsvV2QCLcB/s1600/note.JPG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d17dc8c-1e0d-4336-d663-0000b207a8e3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-_i9AjhlvjB8/WDVuLKBnmlI/AAAAAAAACOA/xISXMTBLMbEH4PBS35DQ416woPpkuiVvQCLcB/s1600/note-2.PNG","pattern":"[url:value = 'https://4.bp.blogspot.com/-_i9AjhlvjB8/WDVuLKBnmlI/AAAAAAAACOA/xISXMTBLMbEH4PBS35DQ416woPpkuiVvQCLcB/s1600/note-2.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3757185b-2c24-afb5-b24f-0000e38bd8c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/virus-removal/threat/ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/virus-removal/threat/ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05864c2e-633f-94e0-1ef9-00009eb2085d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/crypute-ransomware-m0on.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/crypute-ransomware-m0on.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30a5183c-9d08-aba3-e33e-0000fda09654","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-8-8X7Nd1MYs/WDSZN6NIT1I/AAAAAAAACNg/ltc7ppfZZL0vWn8BV3Mk9BVrdmJbcEnpgCLcB/s1600/222.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-8-8X7Nd1MYs/WDSZN6NIT1I/AAAAAAAACNg/ltc7ppfZZL0vWn8BV3Mk9BVrdmJbcEnpgCLcB/s1600/222.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ba254ab-a218-b22e-aa88-0000c754ad30","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/801503401867673603","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/801503401867673603']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ce7b0be-414f-f6f2-dbc0-0000e11d4fcb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decrypter.emsisoft.com/ozozalocker","pattern":"[url:value = 'https://decrypter.emsisoft.com/ozozalocker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd001ff5-a9ea-dbc4-2270-00008a23faf6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/ozozalocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/ozozalocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5eb7c0dd-053f-12a8-2c33-0000efd812f2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-r-vBnl-wLwo/WDg7fHph9BI/AAAAAAAACRc/VuMxWa1nUPIGHCzhCf2AyL_uc7Z9iB6MACLcB/s1600/note_2.PNG","pattern":"[url:value = 'https://2.bp.blogspot.com/-r-vBnl-wLwo/WDg7fHph9BI/AAAAAAAACRc/VuMxWa1nUPIGHCzhCf2AyL_uc7Z9iB6MACLcB/s1600/note_2.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a97cb1f-b25f-f2ad-2e44-0000a569a91b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/--jubfYRaRmw/WDaOyZXkAaI/AAAAAAAACQE/E63a4FnaOfACZ07s1xUiv_haxy8cp5YCACLcB/s1600/ozoza2.png","pattern":"[url:value = 'https://3.bp.blogspot.com/--jubfYRaRmw/WDaOyZXkAaI/AAAAAAAACQE/E63a4FnaOfACZ07s1xUiv_haxy8cp5YCACLcB/s1600/ozoza2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51395c61-985c-4922-df60-0000f4687eb8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/siri_urz/status/801815087082274816","pattern":"[url:value = 'https://twitter.com/siri_urz/status/801815087082274816']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75165cef-aa00-e707-b705-0000b412754f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/lomix-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/lomix-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae9bf4e3-384d-a7c4-73e4-000048df458c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-nXv88GxxOvQ/WE1gqeD3ViI/AAAAAAAACf4/wcVwQ9Pi_JEP2iWNHoBGmeXKJFsfwmwtwCLcB/s1600/Lomix.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-nXv88GxxOvQ/WE1gqeD3ViI/AAAAAAAACf4/wcVwQ9Pi_JEP2iWNHoBGmeXKJFsfwmwtwCLcB/s1600/Lomix.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf7d2e9f-f9ff-feb3-9a4c-0000278abe01","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/jiriatvirlab/status/801910919739674624","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/801910919739674624']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66053360-8e4e-f371-c310-000038a01f57","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/cockblocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/cockblocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5363bb9d-70dd-691e-6262-0000d23729cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/--45C2Cr8sXc/WDiWLTvW-ZI/AAAAAAAACSA/JnJNRr8Kti0YqSnfhPQBF2rsFf-au1g9ACLcB/s1600/Cockblocke.gif","pattern":"[url:value = 'https://1.bp.blogspot.com/--45C2Cr8sXc/WDiWLTvW-ZI/AAAAAAAACSA/JnJNRr8Kti0YqSnfhPQBF2rsFf-au1g9ACLcB/s1600/Cockblocke.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dee7da2-80f3-428e-7b05-0000f3a90409","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/801486420368093184","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/801486420368093184']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e9dd356-2f2e-3095-ac54-0000b8ec6ec7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/07/stampado-ransomware-1.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/07/stampado-ransomware-1.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1015c207-dbe6-a805-12f8-00006528021c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/thanksgiving-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/thanksgiving-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a50593d-7816-43ec-a0b9-0000d8d784fe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-2dC_gQTed4o/WDxRSh_R-MI/AAAAAAAACT4/yWxzCcMqN_8GLjd8dOPf6Mw16mkbfALawCLcB/s1600/lblMain.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-2dC_gQTed4o/WDxRSh_R-MI/AAAAAAAACT4/yWxzCcMqN_8GLjd8dOPf6Mw16mkbfALawCLcB/s1600/lblMain.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f025380-faed-35f3-f053-00006adb318a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/renlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/renlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--428e7e77-fc0f-272a-91b4-00001e74c166","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-281TI8xvMLo/WDw2Nl72OsI/AAAAAAAACTk/nT_rL0z-Exo93FzoOXnyaFgQ7wPe0r7IgCLcB/s1600/Crypter1.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-281TI8xvMLo/WDw2Nl72OsI/AAAAAAAACTk/nT_rL0z-Exo93FzoOXnyaFgQ7wPe0r7IgCLcB/s1600/Crypter1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fb2b04f-fb3c-6e6b-851b-00004e1af374","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/chartwig-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/chartwig-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cbec938-6168-930f-701d-0000e8ef0336","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/807169774098796544","pattern":"[url:value = 'https://twitter.com/struppigel/status/807169774098796544']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--081fdc89-696e-4975-aa95-0000ba17e24f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/634754/locked-in-ransomware-help-support-restore-corupted-fileshtml/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/634754/locked-in-ransomware-help-support-restore-corupted-fileshtml/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08454952-7920-4095-ed10-0000bc43fe2b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/novalid-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/novalid-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4da3d20e-b0f6-4897-d3d9-000002393d26","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-BK_31ORE0ZY/WD284cEVoLI/AAAAAAAACWA/bU0n3MBMD8Mbgzv9bD6VLJb51Q_kr5AJgCLcB/s1600/note.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-BK_31ORE0ZY/WD284cEVoLI/AAAAAAAACWA/bU0n3MBMD8Mbgzv9bD6VLJb51Q_kr5AJgCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--734ae65e-3f1b-8f04-0559-00000c79ba83","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/804810315456200704","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/804810315456200704']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--830fd621-b2fd-4f1d-0e3f-00008a2416f2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/rip-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/rip-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--005e520b-3bc6-fcb2-92f2-0000fc7de96a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-D-j_9_LZen0/WEPq4G5w5FI/AAAAAAAACXs/GTnckI3CGYQxuDMPXBzpGXDtarPK8yJ5wCLcB/s1600/note_2.PNG","pattern":"[url:value = 'https://2.bp.blogspot.com/-D-j_9_LZen0/WEPq4G5w5FI/AAAAAAAACXs/GTnckI3CGYQxuDMPXBzpGXDtarPK8yJ5wCLcB/s1600/note_2.PNG']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b4e93bf-9a84-32ad-f6ee-0000f17c4946","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/11/satan666-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/11/satan666-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b886afa-3f96-1206-0ee3-000030543b1c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-anaLWyg_iJI/WFaxDs8KI3I/AAAAAAAACro/yGXh3AV-ZpAKmD4fpQbBkAyYXXnkqgR3ACLcB/s1600/note666_2.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-anaLWyg_iJI/WFaxDs8KI3I/AAAAAAAACro/yGXh3AV-ZpAKmD4fpQbBkAyYXXnkqgR3ACLcB/s1600/note666_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--020c91ec-f0cf-169a-4979-000035629b18","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1039907030570598400","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1039907030570598400']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b9f39bd-2fd8-d080-73d0-000057c42ba9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a990ad79-aed4-a55d-e708-000044f04738","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1050118985210048512","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1050118985210048512']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7249403-5885-2c46-fb86-0000df1e50cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1049314118409306112","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1049314118409306112']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95baeb4b-883a-b9e8-fd4a-00001e8757af","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d666a4a7-5555-439a-ce82-000046fbb31d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-fox-ransomware-matrix-variant-tries-its-best-to-close-all-file-handles/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-fox-ransomware-matrix-variant-tries-its-best-to-close-all-file-handles/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0c9b5cd-8cd6-f62f-af66-0000160b60f4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1034212374805278720","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1034212374805278720']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa7a4c60-3e42-fa27-43b0-000050bd160f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6614eae-f054-d65d-5bca-000073df0677","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-matrix-ransomware-variants-installed-via-hacked-remote-desktop-services/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-matrix-ransomware-variants-installed-via-hacked-remote-desktop-services/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7e60cd9-b56a-1001-ebd5-000093f243e7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/rommeljoven17/status/804251901529231360","pattern":"[url:value = 'https://twitter.com/rommeljoven17/status/804251901529231360']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ec16f13-4204-6972-56f9-0000e410ddd7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/matrix-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/matrix-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74c4e5aa-850c-984a-f5b2-00009f999c6c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-2nd-2016-screenlockers-kangaroo-the-sfmta-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-2nd-2016-screenlockers-kangaroo-the-sfmta-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0375cc80-0add-2f70-afa2-0000526343dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pbs.twimg.com/media/Do_pn7bX0AYh1F-.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/Do_pn7bX0AYh1F-.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c03768d-e1e2-9eb0-2946-0000fdf742ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pbs.twimg.com/media/DZ4V8uXWsAI0r1v.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DZ4V8uXWsAI0r1v.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5b45b62-fccf-e1b7-754b-00002a66a93f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pbs.twimg.com/media/DZ4VCRpWsAYtckw.jpg","pattern":"[url:value = 'https://pbs.twimg.com/media/DZ4VCRpWsAYtckw.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33c6636a-ae5a-1755-92d7-00008de1548a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/2/wallpaper.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/2/wallpaper.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c89f8d6c-7077-8376-136f-00005b261ff1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/1/background.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/1/background.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b57fd4a-b8aa-7b69-dd07-0000dd661664","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/1/ransom-note.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/1/ransom-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3275e87f-d4e5-0cbb-f836-00001d1396a6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-RGHgroHt5cU/WEUWnFBn2hI/AAAAAAAACYA/zwSf7rmfWdo4ESQ8kjwj6mJrfzL2V22mgCLcB/s1600/note-eng.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-RGHgroHt5cU/WEUWnFBn2hI/AAAAAAAACYA/zwSf7rmfWdo4ESQ8kjwj6mJrfzL2V22mgCLcB/s1600/note-eng.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23d0dfab-3e17-589f-ee56-0000c388568e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: cock.li","pattern":"[domain-name:value = 'cock.li']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7859d30-cba8-3b66-acb2-000089202361","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://en.wikipedia.org/wiki/RSA_(cryptosystem)\\nhttp://en.wikipedia.org/wiki/Advanced_Encryption_Standard\\nIt","pattern":"[url:value = 'http://en.wikipedia.org/wiki/RSA_(cryptosystem)\\\\nhttp://en.wikipedia.org/wiki/Advanced_Encryption_Standard\\\\nIt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f2be93c-6968-e927-ff0a-0000fa07e8e0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/sq-vo-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/sq-vo-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48d5908a-571a-7c29-a008-00009f2c77f1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-Lhq40sgYUpI/WEWpGkkWOKI/AAAAAAAACZQ/iOp9g9Ya0Fk9vZrNKwTEMVcEOzKFIwqgACLcB/s1600/english-2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-Lhq40sgYUpI/WEWpGkkWOKI/AAAAAAAACZQ/iOp9g9Ya0Fk9vZrNKwTEMVcEOzKFIwqgACLcB/s1600/english-2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2ef6b88-0f20-c7ec-3da6-0000adec42c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/634747/sage-20-ransomware-sage-support-help-topic/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/634747/sage-20-ransomware-sage-support-help-topic/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c8b78e8-2844-5333-aab2-0000ce0b6d8c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/634978/sage-file-sample-extension-sage/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/634978/sage-file-sample-extension-sage/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01f0b3e8-1911-9e6c-cf0b-000021d2cbd0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/sage-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/sage-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a637899-9ba1-b46c-4bdb-000035e905e7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-GasUzax8cco/WEar0U0tPqI/AAAAAAAACZw/6V_1JFxLMH0UnmLa3-WZa_ML9JbxF0JYACEw/s1600/note-txt2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-GasUzax8cco/WEar0U0tPqI/AAAAAAAACZw/6V_1JFxLMH0UnmLa3-WZa_ML9JbxF0JYACEw/s1600/note-txt2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5bc4435-1413-d597-a449-0000801417b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/634778/golden-eye-virus/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/634778/golden-eye-virus/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cb1c715-341f-742d-ad8c-0000d646e6fa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/petya-ransomware-returns-with-goldeneye-version-continuing-james-bond-theme/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/petya-ransomware-returns-with-goldeneye-version-continuing-james-bond-theme/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13d75e94-371e-cef3-4385-000032e3623c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/goldeneye-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/goldeneye-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4fe6e48-dac1-5024-d16c-00002b840030","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-avE8liOWdPY/WEcEbdTxx6I/AAAAAAAACa8/KOKgXzU1h2EJ0tTOKMdQzZ_JdWWNeFMdwCLcB/s1600/goldeneye-1-2.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-avE8liOWdPY/WEcEbdTxx6I/AAAAAAAACa8/KOKgXzU1h2EJ0tTOKMdQzZ_JdWWNeFMdwCLcB/s1600/goldeneye-1-2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6990a883-d618-2a32-896e-000081d445bb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-qcJxWivTx1w/WEcEW14om5I/AAAAAAAACa4/xLAlsQGZjeg7Zlg3F2fQAcgQ_6b_cNQLACLcB/s1600/goldeneye-1.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-qcJxWivTx1w/WEcEW14om5I/AAAAAAAACa4/xLAlsQGZjeg7Zlg3F2fQAcgQ_6b_cNQLACLcB/s1600/goldeneye-1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61ccf3dc-b237-a3c3-593c-0000dda6b57e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/hackedlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/hackedlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d17b369-c698-d61c-012e-0000ff4bcde0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-G-xrI4N08hs/WFJjQgB3ojI/AAAAAAAACnM/DEfy_skSg044UmbBfNodiQY4OaLkkQPOwCLcB/s1600/note-hacked.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-G-xrI4N08hs/WFJjQgB3ojI/AAAAAAAACnM/DEfy_skSg044UmbBfNodiQY4OaLkkQPOwCLcB/s1600/note-hacked.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee3135d5-70de-d945-251c-00008cdb7017","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-scheme-spread-popcorn-time-ransomware-get-chance-of-free-decryption-key/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-scheme-spread-popcorn-time-ransomware-get-chance-of-free-decryption-key/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2b78e5a-9e3f-1797-ae80-000065587d80","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/popcorntime-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/popcorntime-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7df917f-fb11-fffd-ce54-0000d5ed1e2a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-sLwR-6y2M-I/WEmVIdJuPMI/AAAAAAAACeY/gpQDT-2-d7kkrfTHgiEZCfxViHu7dNE7ACLcB/s1600/med.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-sLwR-6y2M-I/WEmVIdJuPMI/AAAAAAAACeY/gpQDT-2-d7kkrfTHgiEZCfxViHu7dNE7ACLcB/s1600/med.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eefed462-43a5-783d-0d91-00000074850e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-WxtRn5yVcNw/WEmgAPgO4AI/AAAAAAAACeo/M7iS6L8pSOEr8EUDkCK_g6h0aMKQQXfGwCLcB/s1600/note2.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-WxtRn5yVcNw/WEmgAPgO4AI/AAAAAAAACeo/M7iS6L8pSOEr8EUDkCK_g6h0aMKQQXfGwCLcB/s1600/note2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90a89a05-90be-6a23-3446-0000a11ece9f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepstatic.com/images/news/ransomware/p/Popcorn-time/refer-a-friend.png","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/ransomware/p/Popcorn-time/refer-a-friend.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6adc4d1-808a-a000-4475-00007fccd760","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/flkr-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/flkr-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8747fc1e-b356-bfdc-daa6-0000b27fb1d1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-Fh2I6542zi4/WEpmphY0i1I/AAAAAAAACe4/FBP3J6UraBMkSMTWx2tm-FRYnmlYLtFWgCLcB/s1600/note2.png.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-Fh2I6542zi4/WEpmphY0i1I/AAAAAAAACe4/FBP3J6UraBMkSMTWx2tm-FRYnmlYLtFWgCLcB/s1600/note2.png.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fad20d4c-4389-25a8-d60d-000013ad97b9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: meta.ua","pattern":"[domain-name:value = 'meta.ua']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9ae7bdf-46a2-85a7-ba81-00008f0619c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/code-virus-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/code-virus-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d862245-4e38-8c0c-93e9-0000214e6a2d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-eBeh1lzEYsI/WFJ4l1oJ4fI/AAAAAAAACno/P5inceelNNk-zfkJGhE3XNamOGC8YmBwwCLcB/s1600/str123.gif","pattern":"[url:value = 'https://4.bp.blogspot.com/-eBeh1lzEYsI/WFJ4l1oJ4fI/AAAAAAAACno/P5inceelNNk-zfkJGhE3XNamOGC8YmBwwCLcB/s1600/str123.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e2f1548-8ead-9c0d-a9ea-0000169b42a5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-Lyd1uRKG-94/WFJ3TbNqWfI/AAAAAAAACnc/4LoazYU0S1s1YRz3Xck3LN1vOm5RwIpugCLcB/s1600/note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-Lyd1uRKG-94/WFJ3TbNqWfI/AAAAAAAACnc/4LoazYU0S1s1YRz3Xck3LN1vOm5RwIpugCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf4dbff4-e35a-b215-3af1-00002d8b1147","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/634258/aes-key-gen-assistprotonmailcom-help-support/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/634258/aes-key-gen-assistprotonmailcom-help-support/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89414a2e-dd9c-cabc-5450-0000cde8f844","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/09/dxxd-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/09/dxxd-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e52e7350-3f49-61c6-5aac-0000400e4c01","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/aeskeygenassist-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/aeskeygenassist-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ace713c8-a54d-866b-2bc9-0000344bb4b3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-6NIoKnSTwcs/WExcV900C_I/AAAAAAAACfI/_Hba3mOwk3UQ0T5rGercOglMsCTjVtCnQCLcB/s1600/note2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-6NIoKnSTwcs/WExcV900C_I/AAAAAAAACfI/_Hba3mOwk3UQ0T5rGercOglMsCTjVtCnQCLcB/s1600/note2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3356cba5-aa2e-0730-ddae-000081c32052","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/807161652663742465","pattern":"[url:value = 'https://twitter.com/struppigel/status/807161652663742465']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f968739-ccf2-9d7e-ed88-0000b262a353","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/ultralocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/ultralocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f829f1ae-44bf-f79f-f83d-000068857dac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-DOjKnuzCMo8/WE1Xd8yksiI/AAAAAAAACfo/d93v2xn857gQDg4o5Rd4oZpP3q-Ipv9xgCLcB/s1600/UltraLocker.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-DOjKnuzCMo8/WE1Xd8yksiI/AAAAAAAACfo/d93v2xn857gQDg4o5Rd4oZpP3q-Ipv9xgCLcB/s1600/UltraLocker.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eed01919-dd42-ab2e-366a-0000fa52a673","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/m4n1f3sto-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/m4n1f3sto-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b162879-54ae-0f26-905b-000006df0d81","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-9MsC3A3tuUA/WFGZM45Pw5I/AAAAAAAACms/NbDFma30D9MpK2Zc0O6NvDizU8vqUWWlwCLcB/s1600/M4N1F3STO.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-9MsC3A3tuUA/WFGZM45Pw5I/AAAAAAAACms/NbDFma30D9MpK2Zc0O6NvDizU8vqUWWlwCLcB/s1600/M4N1F3STO.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ded48c70-895e-a89f-1ff7-0000b60fecaa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/slimhem-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/slimhem-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bae5e00-8a0d-2289-9229-0000e120bbf0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/808316635094380544","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/808316635094380544']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edc4a769-2b45-007d-20a7-0000ce3f996b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/payday-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/payday-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce1af0dd-90eb-a3af-4619-000098f9fbc4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-MWEyG49z2Qk/WE78wLqCXPI/AAAAAAAAChw/SIlQSe_o_wMars2egfZ7VqKfWuan6ThwQCLcB/s1600/note1.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-MWEyG49z2Qk/WE78wLqCXPI/AAAAAAAAChw/SIlQSe_o_wMars2egfZ7VqKfWuan6ThwQCLcB/s1600/note1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03447610-d742-b972-754f-0000e084bd24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/antix-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/antix-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d42f99bf-2788-5278-27f8-00003126f05d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-6iMtvGe3T58/WE8Ftx7zcUI/AAAAAAAACiE/2ISTxSYzgKEgnfQ7FSUWo3BiCeVLHH_uwCLcB/s1600/note.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-6iMtvGe3T58/WE8Ftx7zcUI/AAAAAAAACiE/2ISTxSYzgKEgnfQ7FSUWo3BiCeVLHH_uwCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f61b2f0e-3f4b-29d1-0428-0000669199d3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/kraken-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/kraken-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--329aa2bb-4f48-7061-71a0-0000b196f05c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-b5caw8XAvIQ/WFBUuOto40I/AAAAAAAACjQ/_yzwIU17BHw4Ke4E3wM_XBI1XfnAvGSZQCLcB/s1600/005.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-b5caw8XAvIQ/WFBUuOto40I/AAAAAAAACjQ/_yzwIU17BHw4Ke4E3wM_XBI1XfnAvGSZQCLcB/s1600/005.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--793b5089-6800-e79c-4434-00001122d1a8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-E4brsgJRDHA/WFBU7wPaYLI/AAAAAAAACjU/sLEkzMiWp5wuc8hpFbylC7lLVMhftCLGgCLcB/s1600/111m.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-E4brsgJRDHA/WFBU7wPaYLI/AAAAAAAACjU/sLEkzMiWp5wuc8hpFbylC7lLVMhftCLGgCLcB/s1600/111m.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--983cb19a-b539-5d33-5798-0000d6439b6e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/loveserver-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/loveserver-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eeccebaf-9178-6e91-a95b-0000090afba1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-LY1A0aeA_c0/WFEduvkiNQI/AAAAAAAACjk/B2-nFQoExscMVvZqvCaf9R4z_C6-rSdvACLcB/s1600/note2.png.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-LY1A0aeA_c0/WFEduvkiNQI/AAAAAAAACjk/B2-nFQoExscMVvZqvCaf9R4z_C6-rSdvACLcB/s1600/note2.png.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--077b45ab-7c4b-4098-d3cd-00006b82e4dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://guides.yoosecurity.com/cia-special-agent-767-virus-locks-your-pc-screen-how-to-unlock/","pattern":"[url:value = 'https://guides.yoosecurity.com/cia-special-agent-767-virus-locks-your-pc-screen-how-to-unlock/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0c9f500-6862-f1ad-d57b-00007f052ae2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-16th-2016-samas-no-more-ransom-screen-lockers-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-16th-2016-samas-no-more-ransom-screen-lockers-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a9bc79f-0cec-1c89-42a4-0000e15fb1ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/virus-removal/remove-cia-special-agent-767-screen-locker","pattern":"[url:value = 'https://www.bleepingcomputer.com/virus-removal/remove-cia-special-agent-767-screen-locker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f07f4fa-e4d3-cd76-e859-0000a291028d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/cia-special-agent-767-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/cia-special-agent-767-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ab1d4ab-4347-15ee-836f-0000786974a4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-6I7jtsp5Wi4/WFLqnfUvg5I/AAAAAAAACow/BCOv7etYxxwpIERR1Qs5fmJ2wKBx3sqmACLcB/s1600/screen-locker.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-6I7jtsp5Wi4/WFLqnfUvg5I/AAAAAAAACow/BCOv7etYxxwpIERR1Qs5fmJ2wKBx3sqmACLcB/s1600/screen-locker.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92c517d7-a17e-3ace-f8b4-0000923dd420","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-T8iSbbGOz84/WFGZEbuRfCI/AAAAAAAACm0/SO8Srwx2UIM3FPZcZl7W76oSDCsnq2vfgCPcB/s1600/code2.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-T8iSbbGOz84/WFGZEbuRfCI/AAAAAAAACm0/SO8Srwx2UIM3FPZcZl7W76oSDCsnq2vfgCPcB/s1600/code2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e1cc4c2-0ed4-2f58-a42f-0000ddca490b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/antihacker2017-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/antihacker2017-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cb59de9-a071-dcb2-4963-00002da11db9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-k7iDPgj17Zo/WFKEfMvR4wI/AAAAAAAACn4/8irB4Tf1x_MjfTmWaAjuae6mFJbva6GcwCLcB/s1600/note.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-k7iDPgj17Zo/WFKEfMvR4wI/AAAAAAAACn4/8irB4Tf1x_MjfTmWaAjuae6mFJbva6GcwCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4df622d1-a09a-0984-5bad-00008b510bed","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/cryptorium-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/cryptorium-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bf8b9b2-657d-a481-2fcf-0000b4cd0084","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-I0fsQu2YXMI/WFLb9LPdkFI/AAAAAAAACoY/xqRhgO1o98oruVDMC6rO4RxCk5MFDSTYgCLcB/s1600/lock.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-I0fsQu2YXMI/WFLb9LPdkFI/AAAAAAAACoY/xqRhgO1o98oruVDMC6rO4RxCk5MFDSTYgCLcB/s1600/lock.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42e521d1-41e1-c262-912a-000024c219ff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/v8locker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/v8locker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b798cab-0b83-89d7-bea1-00009fb4e96b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-Acmbpw6fEaQ/WFUFKU9V9ZI/AAAAAAAACqc/47AceoWZzOwP9qO8uenjNVOVXeFJf7DywCLcB/s1600/note_2.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-Acmbpw6fEaQ/WFUFKU9V9ZI/AAAAAAAACqc/47AceoWZzOwP9qO8uenjNVOVXeFJf7DywCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5832e747-b684-3aaf-b3a5-0000584bea18","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/17/g/globeimposter-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/17/g/globeimposter-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f36e1862-2982-b6ae-19ef-000097348e15","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.emsisoft.com/en/23639/globeimposter-ransomware/","pattern":"[url:value = 'https://blog.emsisoft.com/en/23639/globeimposter-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c27005d6-71c6-da95-0d0e-000050008997","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/globeimposter-ransomware-spreading-via-spam-campaigns/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/globeimposter-ransomware-spreading-via-spam-campaigns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9b81249-b666-de18-478e-00003673b865","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ransomlook.io/group/globeimposter","pattern":"[url:value = 'https://www.ransomlook.io/group/globeimposter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e268053d-0b93-b49d-6d9b-0000e6db2ea0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/GrujaRS/status/1004661259906768896","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/1004661259906768896']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ccf676-611d-f4a9-52e3-0000743e99db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/809795402421641216","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/809795402421641216']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--588e0778-a42d-6321-acaa-0000ebd544fe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decrypter.emsisoft.com/globeimposter","pattern":"[url:value = 'https://decrypter.emsisoft.com/globeimposter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98568cab-bb05-ef64-194c-00003465d431","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/fwosar/status/812421183245287424","pattern":"[url:value = 'https://twitter.com/fwosar/status/812421183245287424']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7a4db8d-38a2-da49-4ac3-0000aeecb68f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-30th-2016-infected-tvs-and-open-source-ransomware-sucks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-30th-2016-infected-tvs-and-open-source-ransomware-sucks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74d72d1f-02d6-c077-65fd-0000db91bc0f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/fake-globe-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/fake-globe-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b241f05c-c853-d6ea-81c2-000084b70273","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-F8oAU82KnQ4/WFWgxjZz2vI/AAAAAAAACrI/J76wm21b5K4F9sjLF1VcEGoif3cS-Y-bwCLcB/s1600/note.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-F8oAU82KnQ4/WFWgxjZz2vI/AAAAAAAACrI/J76wm21b5K4F9sjLF1VcEGoif3cS-Y-bwCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e026760e-77bd-8787-b0c5-0000558033c9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/koolova-ransomware-decrypts-for-free-if-you-read-two-articles-about-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/koolova-ransomware-decrypts-for-free-if-you-read-two-articles-about-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e3eb8ba-612a-6384-573e-0000d1c2071d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/koolova-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/koolova-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebf1bf11-4849-7a2a-308b-00004075fcff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-kz7PePfAiLI/WGTpY3us5LI/AAAAAAAAC3A/wu1rkx-BWlMzglJXXmCxeuYzbZKN5FP4gCLcB/s1600/koolova-v2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-kz7PePfAiLI/WGTpY3us5LI/AAAAAAAAC3A/wu1rkx-BWlMzglJXXmCxeuYzbZKN5FP4gCLcB/s1600/koolova-v2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6492618d-5da0-9a6e-e0d3-00007f7c6597","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/aes-ni-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/aes-ni-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6f2eb40-25af-1342-3e37-00006ad571cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-GdF-kk1j9-8/WFl6NVm3PAI/AAAAAAAACvE/guFIi_FUpgIQNzX-usJ8CpofX45eXPvkQCLcB/s1600/note_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-GdF-kk1j9-8/WFl6NVm3PAI/AAAAAAAACvE/guFIi_FUpgIQNzX-usJ8CpofX45eXPvkQCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dcff0b2-4248-4200-68df-00002dcb5161","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/drProct0r/status/810500976415281154","pattern":"[url:value = 'https://twitter.com/drProct0r/status/810500976415281154']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70806d6d-3b9c-5dee-009d-000089928b67","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/cryptoblock-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/cryptoblock-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--beeb4547-e68e-de90-a92a-00003b755ee5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-4Y7GZEsWh7A/WFfnmQFF7nI/AAAAAAAACsQ/j3rXZmWrDxMM6xhV1s4YVl_WLDe28cpAwCLcB/s1600/001.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-4Y7GZEsWh7A/WFfnmQFF7nI/AAAAAAAACsQ/j3rXZmWrDxMM6xhV1s4YVl_WLDe28cpAwCLcB/s1600/001.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58eeb4d3-b795-ceaa-3994-0000bca26a5c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/810766686005719040","pattern":"[url:value = 'https://twitter.com/struppigel/status/810766686005719040']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1df8a592-f150-7187-2979-00006af71baf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/msn-cryptolocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/msn-cryptolocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2cb0b71-adbd-eabf-34e1-00004e078588","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-R-lKbH_tLvs/WGPRa-hCtqI/AAAAAAAAC1Y/zgKYZmys_jciaYhtTUsVLen5IHX8_LyiACLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-R-lKbH_tLvs/WGPRa-hCtqI/AAAAAAAAC1Y/zgKYZmys_jciaYhtTUsVLen5IHX8_LyiACLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1585073a-29aa-66bb-2e48-00000f19c495","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/braincrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/braincrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f70558c3-604d-7567-8ba8-000065974e93","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-8bxTSAADM7M/WFmBEu-eUXI/AAAAAAAACvU/xaQBufV5a-4GWEJhXj2VVLqXnTjQJYNrwCLcB/s1600/note-brain2.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-8bxTSAADM7M/WFmBEu-eUXI/AAAAAAAACvU/xaQBufV5a-4GWEJhXj2VVLqXnTjQJYNrwCLcB/s1600/note-brain2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8008b502-5646-1464-d515-0000609b438f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-KrKO1vYs-1w/WFlw6bOfI_I/AAAAAAAACug/42w1VSl2GIoxRuA2SPKJr6xYp3c4OBnJQCLcB/s1600/note_2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-KrKO1vYs-1w/WFlw6bOfI_I/AAAAAAAACug/42w1VSl2GIoxRuA2SPKJr6xYp3c4OBnJQCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70a36214-692e-ac3b-c3ff-0000f74db505","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/811264254481494016","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/811264254481494016']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38b57b18-c9cb-b4ef-8ee4-000091835060","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/811343914712100872","pattern":"[url:value = 'https://twitter.com/demonslay335/status/811343914712100872']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a3ac5ed-b8ec-f8bc-7c60-000025cdfcce","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/enkripsipc-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/enkripsipc-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52c97081-95a9-716f-ed29-0000d90637a9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-owEtII_eezA/WFmOp0ccjaI/AAAAAAAACvk/gjYcSeflS4AChm5cYO5c3EV4aSmzr14UwCLcB/s1600/enc100.gif","pattern":"[url:value = 'https://4.bp.blogspot.com/-owEtII_eezA/WFmOp0ccjaI/AAAAAAAACvk/gjYcSeflS4AChm5cYO5c3EV4aSmzr14UwCLcB/s1600/enc100.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edb44b2d-d882-cb04-c64f-00001b6271ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/811587154983981056","pattern":"[url:value = 'https://twitter.com/struppigel/status/811587154983981056']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--201b7c2a-811e-e114-1fbf-0000c84379ae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-23rd-2016-cryptxxx-koolova-cerber-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-23rd-2016-cryptxxx-koolova-cerber-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfda5e47-24b5-2b9e-b96c-0000c39d9534","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/manifestus-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/manifestus-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58c9951f-33c9-68ee-8e67-00000d82a5f0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-85wiBKXIqro/WFrFOaNeSsI/AAAAAAAACwA/UyrPc2bKQCcznmtLTFkEfc6lEvhseyRYACLcB/s1600/lock1.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-85wiBKXIqro/WFrFOaNeSsI/AAAAAAAACwA/UyrPc2bKQCcznmtLTFkEfc6lEvhseyRYACLcB/s1600/lock1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d861563c-0728-8562-1e2d-00000f53f29e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/811613888705859586","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/811613888705859586']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09c4acb1-e5b5-edff-ad6f-0000ae5124cc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/812002960083394560","pattern":"[url:value = 'https://twitter.com/demonslay335/status/812002960083394560']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--347a7261-a05c-8ca9-87d5-000010ba67db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.archersecuritygroup.com/what-is-ransomware/","pattern":"[url:value = 'http://www.archersecuritygroup.com/what-is-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e97597b0-521a-9163-0eb0-00002f472239","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/proposalcrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/proposalcrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e81b87b7-a313-2b64-b9ac-0000cac06ab3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-TkMikT4PA3o/WFrb4it2u9I/AAAAAAAACww/_zZgu9EHBj8Ibar8i5ekwaowGBD8EoOygCLcB/s1600/note.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-TkMikT4PA3o/WFrb4it2u9I/AAAAAAAACww/_zZgu9EHBj8Ibar8i5ekwaowGBD8EoOygCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c16e2bc-64b8-d415-33a0-0000a0ae6679","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/cryptolocker3-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/cryptolocker3-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dc3d1e0-85c8-4392-29d7-0000c7daf277","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-LDSJ7rws1WI/WGDR-oDSshI/AAAAAAAACyw/_Kn0mnjpm2YN5tS9YldEnca-zOLJpXjcACLcB/s1600/crypto1-2.gif","pattern":"[url:value = 'https://4.bp.blogspot.com/-LDSJ7rws1WI/WGDR-oDSshI/AAAAAAAACyw/_Kn0mnjpm2YN5tS9YldEnca-zOLJpXjcACLcB/s1600/crypto1-2.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83e2b9f7-b27d-9ff2-98fd-00003ffeb6dd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/roga-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/roga-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a406f98a-06c4-4e58-637d-000034c9249d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-ZIWywQMf2mY/WGJD-rqLZYI/AAAAAAAACzQ/p5PWlpWyHjcVHKq74DOsE7yS-ornW48_QCLcB/s1600/note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-ZIWywQMf2mY/WGJD-rqLZYI/AAAAAAAACzQ/p5PWlpWyHjcVHKq74DOsE7yS-ornW48_QCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72de6d27-dbef-2929-e91e-0000784cff80","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-ClUef8T55f4/WGKb8U4GeaI/AAAAAAAACzg/UFD0X2sORHYTVRNBSoqd5q7TBrOblQHmgCLcB/s1600/site.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-ClUef8T55f4/WGKb8U4GeaI/AAAAAAAACzg/UFD0X2sORHYTVRNBSoqd5q7TBrOblQHmgCLcB/s1600/site.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--340dead5-b9d5-f024-bb7e-0000a514d59a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/812131324979007492","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/812131324979007492']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82829d17-843f-1d62-8476-00002a46e682","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/guster-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/guster-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bec0309-b061-e739-711e-0000793683ea","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-0-kDVCM-kuI/WGVH-d2trGI/AAAAAAAAC4A/4LlxFpwkhEk89QcJ5ZhO1i-T6dQ_RcVegCEw/s1600/guster-note-2.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-0-kDVCM-kuI/WGVH-d2trGI/AAAAAAAAC4A/4LlxFpwkhEk89QcJ5ZhO1i-T6dQ_RcVegCEw/s1600/guster-note-2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58e6d658-0602-5494-6bf1-000008d21f2a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/pclock4-sysgop-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/pclock4-sysgop-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5414315-7f02-e467-f2b6-000034144930","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-T9Mt0pE7kwY/WF7NKAPfv1I/AAAAAAAACxw/gOjxeSR0x7EurKQTI2p6Ym70ViYuYdsvQCLcB/s1600/note_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-T9Mt0pE7kwY/WF7NKAPfv1I/AAAAAAAACxw/gOjxeSR0x7EurKQTI2p6Ym70ViYuYdsvQCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2c386b9-7828-6809-37b6-0000514d2c14","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/l33taf-locker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/l33taf-locker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5620325-4e9c-497a-2286-0000426192e7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-yncl7-Jy198/WGDjdgNKXjI/AAAAAAAACzA/bfkDgwWEGKggUG3E1tgPBAWDXwi-p-7AwCLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-yncl7-Jy198/WGDjdgNKXjI/AAAAAAAACzA/bfkDgwWEGKggUG3E1tgPBAWDXwi-p-7AwCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--176de7e7-01aa-a8b1-1e37-0000e639b4d5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: HACKED.txt","pattern":"[domain-name:value = 'HACKED.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09b39701-2a60-2abe-920b-000099dcd17b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://removevirusadware.com/tips-for-removeing-kokokrypt-ransomware/","pattern":"[url:value = 'http://removevirusadware.com/tips-for-removeing-kokokrypt-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49a36ff6-ac3d-aebd-f3d2-0000e885cfbf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/kokokrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/kokokrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d3c0842-b3ea-6023-b20f-000060deeae2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-NiQ6rSIprB8/WF-uxTMq6hI/AAAAAAAACyA/tA6qO3aJdGc0Dn_I-IOZOM3IwN5rgq9sACLcB/s1600/note-koko.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-NiQ6rSIprB8/WF-uxTMq6hI/AAAAAAAACyA/tA6qO3aJdGc0Dn_I-IOZOM3IwN5rgq9sACLcB/s1600/note-koko.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37b463c3-34c2-e853-a6fe-0000e5432271","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/PolarToffee/status/812331918633172992","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/812331918633172992']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e397234-bc40-290d-bb08-000095189b00","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/alphabet-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/alphabet-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8877c2fb-fb0e-1326-9a52-00007a4a8844","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-bFPI3O1BI3s/WGPpvnDvNNI/AAAAAAAAC10/mLUiFOCWnEkjbV91PmUGnc3qsFMv9um8QCLcB/s1600/wallp.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-bFPI3O1BI3s/WGPpvnDvNNI/AAAAAAAAC10/mLUiFOCWnEkjbV91PmUGnc3qsFMv9um8QCLcB/s1600/wallp.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4223e3bb-a41d-67ac-b4c6-0000ea498540","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/adamlocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/adamlocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--913ec340-ebae-ed15-d808-0000a55a51d9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-9IgXt6L0hLY/WGARdzJgfvI/AAAAAAAACyQ/1bfnX_We65AirDcAFpiG49NPuBMfGH9wwCLcB/s1600/note-adam.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-9IgXt6L0hLY/WGARdzJgfvI/AAAAAAAACyQ/1bfnX_We65AirDcAFpiG49NPuBMfGH9wwCLcB/s1600/note-adam.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9be8c889-bff5-492f-3850-0000b7605236","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/813064189719805952","pattern":"[url:value = 'https://twitter.com/demonslay335/status/813064189719805952']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83fbb4c0-1b22-a9c7-7202-0000cf1f9345","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/badencript-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/badencript-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b77f53cf-6d26-4b3b-d1dd-00003fa9f65e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-hApL-ObdWsk/WGAYUyCzPcI/AAAAAAAACyg/NuL26zNgRGcLnnF2BwgOEn3AYMgVu3gQACLcB/s1600/More-note.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-hApL-ObdWsk/WGAYUyCzPcI/AAAAAAAACyg/NuL26zNgRGcLnnF2BwgOEn3AYMgVu3gQACLcB/s1600/More-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f82bd8eb-5729-a9b1-4670-0000b49ccc40","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-derialock-ransomware-active-on-christmas-includes-an-unlock-all-command/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-derialock-ransomware-active-on-christmas-includes-an-unlock-all-command/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebe776e4-5ff8-e674-c388-00001d969492","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/derialock-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/derialock-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf5bf777-c16f-4c3d-819a-0000028cc4c2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-9vg_tRPq8rQ/WGOjf4ULuGI/AAAAAAAACzw/d16uRmEOotsCbRM4hwvzQ6bB8xAVNJ7ogCLcB/s1600/DeriaLock.gif","pattern":"[url:value = 'https://3.bp.blogspot.com/-9vg_tRPq8rQ/WGOjf4ULuGI/AAAAAAAACzw/d16uRmEOotsCbRM4hwvzQ6bB8xAVNJ7ogCLcB/s1600/DeriaLock.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d07cc600-eedb-2c50-b99f-00006d9c2964","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: unlock-everybody.txt","pattern":"[domain-name:value = 'unlock-everybody.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19a8c9cb-9495-c4a2-078d-0000abb97bcb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberx-labs.com/en/blog/new-killdisk-malware-brings-ransomware-into-industrial-domain/","pattern":"[url:value = 'https://cyberx-labs.com/en/blog/new-killdisk-malware-brings-ransomware-into-industrial-domain/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e010b9f5-26c8-1210-b0aa-00006fc9f1e0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt/","pattern":"[url:value = 'http://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd0ac685-5362-2b53-79ac-00006efd05ae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.securityweek.com/destructive-killdisk-malware-turns-ransomware","pattern":"[url:value = 'http://www.securityweek.com/destructive-killdisk-malware-turns-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--828eef92-8e5e-42a8-816b-0000d90768b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.zdnet.com/article/247000-killdisk-ransomware-demands-a-fortune-forgets-to-unlock-files/","pattern":"[url:value = 'http://www.zdnet.com/article/247000-killdisk-ransomware-demands-a-fortune-forgets-to-unlock-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5753879f-d5f8-acf5-2302-00008499b4f6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/killdisk-ransomware-now-targets-linux-prevents-boot-up-has-faulty-encryption/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/killdisk-ransomware-now-targets-linux-prevents-boot-up-has-faulty-encryption/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20bd333e-b113-2494-95cb-00009b382715","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/killdisk-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/killdisk-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8b7843c-7294-26c5-04a2-0000d3ed22d2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-8MqANWraAgE/WGT7mj-XirI/AAAAAAAAC3g/H_f1hTxa7Sc_DEtllBe-vYaAfY-YqMelgCLcB/s1600/wallp.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-8MqANWraAgE/WGT7mj-XirI/AAAAAAAAC3g/H_f1hTxa7Sc_DEtllBe-vYaAfY-YqMelgCLcB/s1600/wallp.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60f7af52-02a9-d1aa-2622-000091087889","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/seoirse-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/seoirse-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b3c8a7f-7a7f-78fd-81d3-000045d866fe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decrypter.emsisoft.com/mrcr","pattern":"[url:value = 'https://decrypter.emsisoft.com/mrcr']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--751a2173-05b3-d75b-8442-0000d33c7f4b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/merry-christmas-ransomware-and-its-dev-comodosecurity-not-bringing-holiday-cheer/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/merry-christmas-ransomware-and-its-dev-comodosecurity-not-bringing-holiday-cheer/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71f5eb2a-4705-fcdc-8ef6-0000b1f1aa5d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.zdnet.com/article/not-such-a-merry-christmas-the-ransomware-that-also-steals-user-data/","pattern":"[url:value = 'http://www.zdnet.com/article/not-such-a-merry-christmas-the-ransomware-that-also-steals-user-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da65cdeb-c5a9-edfc-e88f-0000124d46e1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/-merry-christmas-ransomware-now-steals-user-private-data-via-diamondfox-malware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/-merry-christmas-ransomware-now-steals-user-private-data-via-diamondfox-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b147930d-53c7-46b5-c766-00004e7adba6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/12/mrcr1-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/12/mrcr1-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d75e7b30-b3b0-6627-d41a-000090057c27","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-_w8peyLMcww/WHNJ1Gb0qeI/AAAAAAAADBw/EVbR-gKipYoNujo-YF6VavafsUfWDANEQCLcB/s1600/8-1-17.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-_w8peyLMcww/WHNJ1Gb0qeI/AAAAAAAADBw/EVbR-gKipYoNujo-YF6VavafsUfWDANEQCLcB/s1600/8-1-17.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b760a39-fd3b-d455-25b9-00009c45a749","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-3F3QAZnDxsI/WGpvD4wZ2OI/AAAAAAAAC80/-2L6dIPqsgs8hZHOX0T6AFf5LwPwfZ-rwCLcB/s1600/note.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-3F3QAZnDxsI/WGpvD4wZ2OI/AAAAAAAAC80/-2L6dIPqsgs8hZHOX0T6AFf5LwPwfZ-rwCLcB/s1600/note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88344f5c-c11d-d20f-7d2a-000096293cd1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: BRUCE.HTA","pattern":"[domain-name:value = 'BRUCE.HTA']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56d983c3-1a8c-90b1-425d-0000f5fe1c42","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: DEAD.HTA","pattern":"[domain-name:value = 'DEAD.HTA']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e86a40c-4530-b16e-1a2f-000033dce35c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-ZnWdPDprJOg/WJCPeCtP4HI/AAAAAAAADfw/kR0ifI1naSwTAwSuOPiw8ZCPr0tSIz1CgCLcB/s1600/netflix-akk.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-ZnWdPDprJOg/WJCPeCtP4HI/AAAAAAAADfw/kR0ifI1naSwTAwSuOPiw8ZCPr0tSIz1CgCLcB/s1600/netflix-akk.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2eba6f55-a296-98cc-8bc1-000057d08421","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-bQQ4DTIClvA/WJCIh6Uq2nI/AAAAAAAADfY/hB5HcjuGgh8rRJKeLHo__IRz3Ezth22-wCEw/s1600/form1.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-bQQ4DTIClvA/WJCIh6Uq2nI/AAAAAAAADfY/hB5HcjuGgh8rRJKeLHo__IRz3Ezth22-wCEw/s1600/form1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d616ca2a-dfce-c40d-58cc-0000046d0cdb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.darkreading.com/attacks-breaches/netflix-scam-spreads-ransomware/d/d-id/1328012","pattern":"[url:value = 'http://www.darkreading.com/attacks-breaches/netflix-scam-spreads-ransomware/d/d-id/1328012']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a008b64-05ae-dc3d-8950-000063df67d8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/rogue-netflix-app-spreads-netix-ransomware-that-targets-windows-7-and-10-users/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/rogue-netflix-app-spreads-netix-ransomware-that-targets-windows-7-and-10-users/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--054fa962-0384-623d-4fe5-000026830144","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/netflix-scam-delivers-ransomware/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/netflix-scam-delivers-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe37ab9a-7200-ba93-22a1-0000f1bcb85b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/netflix-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/netflix-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--776e300b-9b8f-a5e0-7674-00008d6fd094","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-Cw4e1drBKl4/WJCHmgp1vtI/AAAAAAAADfI/QqFxUsuad","pattern":"[url:value = 'https://4.bp.blogspot.com/-Cw4e1drBKl4/WJCHmgp1vtI/AAAAAAAADfI/QqFxUsuad']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbb68bf9-9e7d-60df-68eb-0000b4165a03","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-vODt2aB9Hck/WJCFc3g5eCI/AAAAAAAADe8/OrEVkqUHMU4swRWedoZuBu50AWoKR1FGACLcB/s1600/netflix-note.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-vODt2aB9Hck/WJCFc3g5eCI/AAAAAAAADe8/OrEVkqUHMU4swRWedoZuBu50AWoKR1FGACLcB/s1600/netflix-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb1fc91b-df3e-60b4-0aac-000073356806","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.forbes.com/sites/leemathews/2017/01/27/fake-ransomware-is-tricking-people-into-paying/#777faed0381c","pattern":"[url:value = 'http://www.forbes.com/sites/leemathews/2017/01/27/fake-ransomware-is-tricking-people-into-paying/#777faed0381c']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--963b9259-cec6-d4ee-5e52-0000656751bb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/sureransom-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/sureransom-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7466291-0fb1-4635-29bf-0000c0d37a1e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-zShnOIf3R_E/WJBfhC4CdSI/AAAAAAAADdo/6l4hwSOmI0Evj4W0Esj1S_uNOy5Yq6X0QCLcB/s1600/note1-2-3.gif","pattern":"[url:value = 'https://1.bp.blogspot.com/-zShnOIf3R_E/WJBfhC4CdSI/AAAAAAAADdo/6l4hwSOmI0Evj4W0Esj1S_uNOy5Yq6X0QCLcB/s1600/note1-2-3.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a49b877b-247e-7901-a471-0000bfcd86fb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/GrujaRS/status/826153382557712385","pattern":"[url:value = 'https://twitter.com/GrujaRS/status/826153382557712385']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1007b5f4-cb67-a646-95fb-0000416d51ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://download.bleepingcomputer.com/demonslay335/StupidDecrypter.zip","pattern":"[url:value = 'https://download.bleepingcomputer.com/demonslay335/StupidDecrypter.zip']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f12ce1d1-7ab3-39c4-10c1-00000d80b416","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.pcrisk.com/removal-guides/10899-zyka-ransomware","pattern":"[url:value = 'https://www.pcrisk.com/removal-guides/10899-zyka-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bdef1cc-64c7-fb04-bba0-0000000f052e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/zyka-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/zyka-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e85d3cc-b677-be42-ca65-00005b04cbd7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-SF4RsOANlI0/WJBQd4SJv6I/AAAAAAAADdY/hI-Ncw9FoFMi5jvljUftpzTgdykOfR3vgCLcB/s1600/lock-wallp_2.png.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-SF4RsOANlI0/WJBQd4SJv6I/AAAAAAAADdY/hI-Ncw9FoFMi5jvljUftpzTgdykOfR3vgCLcB/s1600/lock-wallp_2.png.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e87c92b-27e7-cd0f-3446-0000a98a96a5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-ClM0LCPjQuk/WI-BgHTpdNI/AAAAAAAADc8/JyEQ8-pcJmsXIntuP-MMdE-pohVncxTXQCLcB/s1600/7-zip-logo.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-ClM0LCPjQuk/WI-BgHTpdNI/AAAAAAAADc8/JyEQ8-pcJmsXIntuP-MMdE-pohVncxTXQCLcB/s1600/7-zip-logo.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ea6e864-1da3-6725-ddf9-000012ba5925","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/7zipper-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/7zipper-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcaf1f4b-5cef-4066-1f86-0000038a97d4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-BR0DvtIft7g/WI95IF7IdUI/AAAAAAAADck/gzWAMbpFvaYicHFuMzvlM3YGJpgulMQBQCLcB/s1600/note_2.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-BR0DvtIft7g/WI95IF7IdUI/AAAAAAAADck/gzWAMbpFvaYicHFuMzvlM3YGJpgulMQBQCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--244a76fe-1074-f174-19be-0000a4406dae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/825790584971472902","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/825790584971472902']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e60edbd5-eb0c-a33e-3835-0000fa408340","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/xcrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/xcrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2da50827-d717-9dec-ea69-0000a711c889","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-XZNMg5P75r4/WI985j-EKHI/AAAAAAAADcw/jGdtXoq2pnwjlAbFAJia4UsXuJrV5AU3gCLcB/s1600/note.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-XZNMg5P75r4/WI985j-EKHI/AAAAAAAADcw/jGdtXoq2pnwjlAbFAJia4UsXuJrV5AU3gCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afd85683-b685-bd8a-0c3f-000073ec40ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/first-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/first-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7493c744-226b-c12b-d477-00006e58e3b1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-T0PhVuoFSyA/WGk5mYkRFAI/AAAAAAAAC64/j14Pt84YUmQMNa_5LSEn6fZ5CoYqz60swCLcB/s1600/note-lock.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-T0PhVuoFSyA/WGk5mYkRFAI/AAAAAAAAC64/j14Pt84YUmQMNa_5LSEn6fZ5CoYqz60swCLcB/s1600/note-lock.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--455afccd-49fb-f66c-2111-00005eb656a3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JaromirHorejsi/status/815557601312329728","pattern":"[url:value = 'https://twitter.com/JaromirHorejsi/status/815557601312329728']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--410a112e-ce04-e1a1-356c-000075a9e40b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/red-alert-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/red-alert-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b1999f5-0e05-4d0e-f065-000083916d5d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-tDS74fDwB1Q/WGk2D5DcUYI/AAAAAAAAC6s/vahju5JD9B4chwnNDUvDPp4ejZOxnj_awCLcB/s1600/note-wallp.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-tDS74fDwB1Q/WGk2D5DcUYI/AAAAAAAAC6s/vahju5JD9B4chwnNDUvDPp4ejZOxnj_awCLcB/s1600/note-wallp.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d176d0c-76cc-a00b-e90b-00001863bf49","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: MESSAGE.txt","pattern":"[domain-name:value = 'MESSAGE.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--faed143d-59be-c7e9-1e74-000028d07a07","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/815392891338194945","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/815392891338194945']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b70d52c1-519f-807f-21a6-00009227fa05","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/edgelocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/edgelocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f294ba7b-72c6-0949-6d05-0000459ad382","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-dNBgohC1UYg/WGnXhem546I/AAAAAAAAC7w/Wv0Jy4173xsBJDZPLMxe6lXBgI5BkY4BgCLcB/s1600/note-lock.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-dNBgohC1UYg/WGnXhem546I/AAAAAAAAC7w/Wv0Jy4173xsBJDZPLMxe6lXBgI5BkY4BgCLcB/s1600/note-lock.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8383b64e-af81-9fe5-1c4c-0000485c3e43","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://chuongdong.com/reverse%20engineering/2020/11/17/RegretLocker/","pattern":"[url:value = 'http://chuongdong.com/reverse%20engineering/2020/11/17/RegretLocker/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ecd37da-ef14-cd76-a72c-000001baeb7f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/816112218815266816","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/816112218815266816']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--017538c5-65b7-1fb5-f039-000054e2284c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/gog-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/gog-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04504499-1fd9-33c4-2cc7-0000f9ca1d20","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-TDK91s7FmNM/WGpcwq5HmwI/AAAAAAAAC8Q/i0Q66vE7m-0kmrKPXWdwnYQg6Eaw2KSDwCLcB/s1600/note-pay_2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-TDK91s7FmNM/WGpcwq5HmwI/AAAAAAAAC8Q/i0Q66vE7m-0kmrKPXWdwnYQg6Eaw2KSDwCLcB/s1600/note-pay_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--327c43e0-6da5-f7a4-d7f7-0000df73b4ed","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-cAnilnXjK7k/WG_OHhC_UdI/AAAAAAAAC_4/sdbzTx9hP4sryM7xE59ONdk7Zr8D_m6XwCLcB/s1600/note-txt_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-cAnilnXjK7k/WG_OHhC_UdI/AAAAAAAAC_4/sdbzTx9hP4sryM7xE59ONdk7Zr8D_m6XwCLcB/s1600/note-txt_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46a8856b-5907-206d-1cb7-000040541ee8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: DecryptFile.txt","pattern":"[domain-name:value = 'DecryptFile.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb531f2a-3887-675b-3f57-0000fe9488a3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/x3m-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/x3m-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--595dbecd-6c12-d33a-45fa-0000029dee9b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-hMAakgAORvg/WG_i-lk09II/AAAAAAAADAI/Uq2iCHC5ngYzeVcuxQF0mcbrLqyOGcA_wCLcB/s1600/note.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-hMAakgAORvg/WG_i-lk09II/AAAAAAAADAI/Uq2iCHC5ngYzeVcuxQF0mcbrLqyOGcA_wCLcB/s1600/note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03405e0b-3387-c53d-e719-0000aac79b06","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/btcamant.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/btcamant.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--654636e9-1d13-3bbc-147b-000044e6db34","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-uiHluU553MU/WGzoFpEWkfI/AAAAAAAAC9o/M34ndwHUsoEfZiLJv9j4PCgBImS8oyYaACLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-uiHluU553MU/WGzoFpEWkfI/AAAAAAAAC9o/M34ndwHUsoEfZiLJv9j4PCgBImS8oyYaACLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec7a5595-6ddf-f40b-cf7d-000078b20e6a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/firecrypt-ransomware-comes-with-a-ddos-component/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/firecrypt-ransomware-comes-with-a-ddos-component/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95da2ef0-b95f-721c-23ee-00002cb3040d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/bleedgreen-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/bleedgreen-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cae5744-b421-993d-1565-000047712592","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-np8abNpYeoU/WG1KX4_H0yI/AAAAAAAAC98/gxRJeDb01So5yTboXYP7sZWurJFBbWziACLcB/s1600/note-html.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-np8abNpYeoU/WG1KX4_H0yI/AAAAAAAAC98/gxRJeDb01So5yTboXYP7sZWurJFBbWziACLcB/s1600/note-html.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57f11732-e6e8-3010-60d4-00001ca0321b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-xrr6aoB_giw/WG1UrGpmZJI/AAAAAAAAC-Q/KtKdQP6iLY4LHaHgudF5dKs6i1JHQOBmgCLcB/s1600/green1.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-xrr6aoB_giw/WG1UrGpmZJI/AAAAAAAAC-Q/KtKdQP6iLY4LHaHgudF5dKs6i1JHQOBmgCLcB/s1600/green1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bf28e7d-ffef-a27e-0b11-00005eec9833","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decrypter.emsisoft.com/globe3","pattern":"[url:value = 'https://decrypter.emsisoft.com/globe3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18b07695-a543-b46b-2e6e-0000bdaa5251","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decryptors.blogspot.co.il/2017/01/globe3-decrypter.html","pattern":"[url:value = 'https://decryptors.blogspot.co.il/2017/01/globe3-decrypter.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--532ec707-b0f4-0287-13ac-0000a9541f3e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-globe-ransomware-wants-to-purge-your-files/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-globe-ransomware-wants-to-purge-your-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4263fbb9-32c8-7ffa-5ceb-00001d0a88e7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/624518/globe-ransomware-help-and-support-purge-extension-how-to-restore-fileshta/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/624518/globe-ransomware-help-and-support-purge-extension-how-to-restore-fileshta/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87d92f14-8b3b-c32c-8c78-0000024a1c98","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/globe3-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/globe3-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f101009-574e-fb19-ab94-0000acd27c2b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-lYkopoRH0wQ/WHOt1KhhzhI/AAAAAAAADCA/nPdhHK3wEucAK1GHodeh5w3HcpdugzSHwCLcB/s1600/globe3-9-1-17.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-lYkopoRH0wQ/WHOt1KhhzhI/AAAAAAAADCA/nPdhHK3wEucAK1GHodeh5w3HcpdugzSHwCLcB/s1600/globe3-9-1-17.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d598653d-c48b-8920-9cc8-00003e9bb72c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-Wk1_IdcEHbk/WG6FVnoaKlI/AAAAAAAAC-4/WeHzJAUJ0goxxuAoGUUebSgzGHrnD6LQQCLcB/s1600/Globe-ransom-note_2.png.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-Wk1_IdcEHbk/WG6FVnoaKlI/AAAAAAAAC-4/WeHzJAUJ0goxxuAoGUUebSgzGHrnD6LQQCLcB/s1600/Globe-ransom-note_2.png.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbff6f93-7c0f-b9e7-8ca5-000030378d7a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: mia.kokers","pattern":"[domain-name:value = 'mia.kokers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20124c31-86c1-bcd0-aaab-00007eaabb68","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/817069320937345024","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/817069320937345024']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63823b88-0b76-2d9a-139e-0000245402c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-january-6th-2017-fsociety-mongodb-pseudo-darkleech-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-january-6th-2017-fsociety-mongodb-pseudo-darkleech-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0112867e-fec7-9cf0-66b8-000034794e70","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/mafiaware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/mafiaware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84c1879c-e3ae-6283-b682-000098def814","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-BclLp7x1sUM/WG6acqtDBbI/AAAAAAAAC_I/ToVEXx-G2DcKD4d7TZ0RkVqA1wRicxnZQCLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-BclLp7x1sUM/WG6acqtDBbI/AAAAAAAAC_I/ToVEXx-G2DcKD4d7TZ0RkVqA1wRicxnZQCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--318c3172-71b3-7ee0-9499-0000ff24a5d3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: ME.txt","pattern":"[domain-name:value = 'ME.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e50edcea-8599-7661-9f7e-00009a36b729","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/817079028725190656","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/817079028725190656']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3077c80-c37f-d079-da11-000008adfdd4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/skyname-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/skyname-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed79c1d6-a536-8282-efdb-0000864a2356","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-OlKgHvtAUHg/WHFDCx4thaI/AAAAAAAADAw/wzBXV17Xh-saaFGlrxw3CDNhGSTaVe2dQCLcB/s1600/lock1.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-OlKgHvtAUHg/WHFDCx4thaI/AAAAAAAADAw/wzBXV17Xh-saaFGlrxw3CDNhGSTaVe2dQCLcB/s1600/lock1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e976cafd-a419-ab74-6262-0000c1194e09","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-i4ksJq-UzX8/WHFFXQL5wAI/AAAAAAAADA8/awfsqj1lr7IMBAPtE0tB44PNf1N6zkGDwCLcB/s1600/note_2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-i4ksJq-UzX8/WHFFXQL5wAI/AAAAAAAADA8/awfsqj1lr7IMBAPtE0tB44PNf1N6zkGDwCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--908167b0-0d93-d84e-31ba-00003e87cf8d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: INFOK1.txt","pattern":"[domain-name:value = 'INFOK1.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d029166-86e6-91b0-7945-00003e782856","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/817648547231371264","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/817648547231371264']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deb6eca2-cd1e-1e45-3eb1-0000fe436627","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/ocelot-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/ocelot-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5602101-d6fe-3dce-cc27-000034995be7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-DMxJm5GT0VY/WHEyEOi_vZI/AAAAAAAADAc/6Zi3IBuBz1I7jdQHcSrzhUGagGCUfs6iACLcB/s1600/lock2.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-DMxJm5GT0VY/WHEyEOi_vZI/AAAAAAAADAc/6Zi3IBuBz1I7jdQHcSrzhUGagGCUfs6iACLcB/s1600/lock2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0f9036e-ada5-4e25-9365-00005973ba1f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-3iMAtqvAmts/WHEyA_dW5OI/AAAAAAAADAY/tE5FtaVMJcc3aQQvWI4XOdjtvbXufFgywCLcB/s1600/lock1.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-3iMAtqvAmts/WHEyA_dW5OI/AAAAAAAADAY/tE5FtaVMJcc3aQQvWI4XOdjtvbXufFgywCLcB/s1600/lock1.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b943c50-6988-f9a4-ac29-00001c5b4597","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/PolarToffee/status/826508611878793219","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/826508611878793219']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--283ab26e-e211-4f73-a764-0000a6c0b624","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/jiriatvirlab/status/818443491713884161","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/818443491713884161']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8e6d2f2-b297-7440-472c-0000b8510218","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://usproins.com/evil-ransomware-is-lurking/","pattern":"[url:value = 'http://usproins.com/evil-ransomware-is-lurking/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54009be0-8ce1-78f5-939f-0000cf21c68b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.enigmasoftware.com/evilransomware-removal/","pattern":"[url:value = 'http://www.enigmasoftware.com/evilransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43727497-821c-f883-a9eb-0000f972477a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/evil-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/evil-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1053e9cc-d33b-2ac0-6bb4-0000111d6271","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-xxJ9xdRuWis/WHO_FL-hWcI/AAAAAAAADCU/VqI02AhzopQY1WKk-k6QYSdHFWFzg1NcACLcB/s1600/note_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-xxJ9xdRuWis/WHO_FL-hWcI/AAAAAAAADCU/VqI02AhzopQY1WKk-k6QYSdHFWFzg1NcACLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5eb290ab-0d82-215c-7903-00007575afcb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-0NFy_yDghZ0/WHO_ClbPdMI/AAAAAAAADCQ/RX2cgYg3z381gro6UUQtAED7JgXHbvGLgCLcB/s1600/note-txt_2.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-0NFy_yDghZ0/WHO_ClbPdMI/AAAAAAAADCQ/RX2cgYg3z381gro6UUQtAED7JgXHbvGLgCLcB/s1600/note-txt_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4505c78a-6482-4005-4739-0000ec056ebb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/nemesis-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/nemesis-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a8ae954-27cd-53fa-ebde-00001d12e143","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-dLSbqOiIbLU/WHPh-akYinI/AAAAAAAADC0/6nFQClDBJ5M7ZhrjkhnxfkdboOh7SlE-ACLcB/s1600/v5YZMxt.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-dLSbqOiIbLU/WHPh-akYinI/AAAAAAAADC0/6nFQClDBJ5M7ZhrjkhnxfkdboOh7SlE-ACLcB/s1600/v5YZMxt.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2372587f-c365-4898-a2d7-000067b2adac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/startups/Windows_Update_Host-16362.html","pattern":"[url:value = 'https://www.bleepingcomputer.com/startups/Windows_Update_Host-16362.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--691acef5-de61-3d54-2615-0000ef62f746","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/updatehost-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/updatehost-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f74f9b6-0475-4238-559e-0000a7b32842","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-BOmKmroIvEI/WJn-LAUmyyI/AAAAAAAADsI/W987TEaOnEAd45AOxO1cFyFvxEx_RfehgCLcB/s1600/note_2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-BOmKmroIvEI/WJn-LAUmyyI/AAAAAAAADsI/W987TEaOnEAd45AOxO1cFyFvxEx_RfehgCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e0421c6-c208-cf3b-3f12-0000eaa67e38","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/watch-your-computer-go-bonkers-with-cancer-trollware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/watch-your-computer-go-bonkers-with-cancer-trollware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43d28ec6-bb3d-2a50-45c3-0000ac89a922","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/cancer-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/cancer-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c775bb7-7fcf-e4e9-345c-0000a349cd57","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-ozPs6mwKfEI/WJjTwbrOx9I/AAAAAAAADqE/4gewG-f_dLQQDevajtn8CnX69lvWgCZQACLcB/s1600/wallp.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-ozPs6mwKfEI/WJjTwbrOx9I/AAAAAAAADqE/4gewG-f_dLQQDevajtn8CnX69lvWgCZQACLcB/s1600/wallp.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98b12a4b-449a-0477-df5c-00005bb46825","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/ransomuhahawhere.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/ransomuhahawhere.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dff8c63-693f-bb10-6fb0-000004d30800","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-7KRVg6kt418/WJnwxDOV5NI/AAAAAAAADrk/or9DbPMl-7ksN7OwIAH6BMJwE5fGc_BfgCLcB/s1600/note_2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-7KRVg6kt418/WJnwxDOV5NI/AAAAAAAADrk/or9DbPMl-7ksN7OwIAH6BMJwE5fGc_BfgCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fad05d97-9f35-218f-7df2-000085ec1aec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/erebus-ransomware-utilizes-a-uac-bypass-and-request-a-90-ransom-payment/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/erebus-ransomware-utilizes-a-uac-bypass-and-request-a-90-ransom-payment/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8e69ec9-b56e-1490-25a2-0000cca30860","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/erebus-2017-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/erebus-2017-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--888ff4c8-1c0f-5d5d-e9de-0000661d38d6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-tAp9wE6CJxM/WJrvOOyIfRI/AAAAAAAADts/iMfaiDRyRcQuPXgtQV--qt7q8ZI3ZV0tQCLcB/s1600/note1%252B.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-tAp9wE6CJxM/WJrvOOyIfRI/AAAAAAAADts/iMfaiDRyRcQuPXgtQV--qt7q8ZI3ZV0tQCLcB/s1600/note1%252B.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdd87248-508d-caba-91a3-00001ffed889","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/serpent-danish-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/serpent-danish-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c581d29f-7849-55dd-fea2-00002b88ae8d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.torproject.org/projects/torbrowser.html.en#downloads\\n2","pattern":"[url:value = 'https://www.torproject.org/projects/torbrowser.html.en#downloads\\\\n2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f95bc07-4b71-14d0-4d21-0000a68e562d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: hnxrvobhgm.pw","pattern":"[domain-name:value = 'hnxrvobhgm.pw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--729a41c6-7932-524c-2b85-000080032fa5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: vdpbkmwbnp.pw","pattern":"[domain-name:value = 'vdpbkmwbnp.pw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ca4aea4-fce5-cb00-d769-0000cb384688","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/dyna-crypt-not-only-encrypts-your-files-but-also-steals-your-info/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/dyna-crypt-not-only-encrypts-your-files-but-also-steals-your-info/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ec708f2-6c21-71cf-6d9b-00008fef3f45","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/dyna-crypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/dyna-crypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05ad9a90-fbe5-30bf-9385-00002aac409e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-Qx8RhielSbI/WJypR9Zw9nI/AAAAAAAADus/Opsfy8FxRIIBmouywdl7uT94ZpfwKr6JACLcB/s1600/note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-Qx8RhielSbI/WJypR9Zw9nI/AAAAAAAADus/Opsfy8FxRIIBmouywdl7uT94ZpfwKr6JACLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36f02c65-73c0-8f7e-07d6-00003ee6d5e1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/04/magic-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/04/magic-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e3463f-768e-a07c-f0ac-00004461bc26","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ozbargain.com.au/node/228888?page=3","pattern":"[url:value = 'https://www.ozbargain.com.au/node/228888?page=3']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df06be0c-0467-04d0-5ff5-00006e499a16","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/hugeme-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/hugeme-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e49fcc1c-ff9e-0d0b-1129-0000e6b509c9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-kolk6sABFzQ/WJ95ddcAxNI/AAAAAAAADwI/oP8ZFD7KnqoQWgpfgEHId843x3l0xfhjACLcB/s1600/note_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-kolk6sABFzQ/WJ95ddcAxNI/AAAAAAAADwI/oP8ZFD7KnqoQWgpfgEHId843x3l0xfhjACLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf932579-13fa-3090-cc00-00002ea304d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/838700700586684416","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/838700700586684416']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07d10490-387c-a92a-edc8-00009cddda1f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/829768819031805953","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/829768819031805953']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--931e48a1-8e82-209f-1f09-0000ee638a04","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/fadesoft-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/fadesoft-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fddae935-44f1-b3db-1371-00003f6c1147","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-5t-5eBl4Tng/WKARmYV5GVI/AAAAAAAADxA/OuS7Eo__z1sh2tRbBpQIxJQ6IVbSiQakwCLcB/s1600/lock-note.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-5t-5eBl4Tng/WKARmYV5GVI/AAAAAAAADxA/OuS7Eo__z1sh2tRbBpQIxJQ6IVbSiQakwCLcB/s1600/lock-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d51799a-a17d-a507-a9e6-0000e663db08","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/830116190873849856","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/830116190873849856']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf6fc6b7-cab6-f67d-8f45-000074caa1f5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-10th-2017-serpent-spora-id-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-10th-2017-serpent-spora-id-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ec9ef6a-4392-ac3c-b026-00008a689e51","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ultranationalist-developer-behind-serbransom-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ultranationalist-developer-behind-serbransom-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c50c04a-8e59-6702-54a8-000029eacb7e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/serbransom-2017.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/serbransom-2017.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b25e352-d333-63e4-f653-0000a519cb13","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-DQQ5tk0C9lY/WKALND0dYPI/AAAAAAAADwo/EuKiO_F0Mn0ImrGLVE-Sks-j93pHoTjKACLcB/s1600/konstr.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-DQQ5tk0C9lY/WKALND0dYPI/AAAAAAAADwo/EuKiO_F0Mn0ImrGLVE-Sks-j93pHoTjKACLcB/s1600/konstr.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e9d9944-ce8c-18c6-e582-0000add8be96","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-OY8jgTN5Y9Q/WKAI6a9xfMI/AAAAAAAADwc/ng36hAXsvfYQ5rdkSFeVgEvLY88pJmnWACLcB/s1600/note-html-wallp.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-OY8jgTN5Y9Q/WKAI6a9xfMI/AAAAAAAADwc/ng36hAXsvfYQ5rdkSFeVgEvLY88pJmnWACLcB/s1600/note-html-wallp.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--996a0a7b-d910-46fc-a5a9-0000fb5aa24a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/allyourdocuments-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/allyourdocuments-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04d4fd50-969d-9d2e-7f52-0000b866e227","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-mwIvQNkFH4g/WKAydZnGn_I/AAAAAAAADxs/6xHgbD3OUFUbebeuNVkI6tp_cMRVUQHtQCLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-mwIvQNkFH4g/WKAydZnGn_I/AAAAAAAADxs/6xHgbD3OUFUbebeuNVkI6tp_cMRVUQHtQCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--696ada43-628f-46fc-dc05-0000501ad38d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/cryptokill-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/cryptokill-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3bff387-a146-f714-6b6f-00007443547b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://blog.emsisoft.com/2017/01/10/from-darknet-with-love-meet-spora-ransomware/","pattern":"[url:value = 'http://blog.emsisoft.com/2017/01/10/from-darknet-with-love-meet-spora-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26c497c9-7171-f401-1b19-0000c801f233","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.gdatasoftware.com/2017/01/29442-spora-worm-and-ransomware","pattern":"[url:value = 'https://blog.gdatasoftware.com/2017/01/29442-spora-worm-and-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59a1edbe-90b5-d044-ad36-000071b78832","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/spora-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/spora-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8caaa3ae-ce09-f4a3-6623-000094b99094","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-0COE3ADdaYk/WHpnHzuo7OI/AAAAAAAADHY/yfDF3XG720Yyn3xQHwFngt1T99cT-Xt3wCLcB/s1600/rus-note_2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-0COE3ADdaYk/WHpnHzuo7OI/AAAAAAAADHY/yfDF3XG720Yyn3xQHwFngt1T99cT-Xt3wCLcB/s1600/rus-note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6c04a90-da76-7adc-f46e-0000989798d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-KkJXiHG80S0/WHX4TBpkamI/AAAAAAAADDg/F_bN796ndMYnzfUsgSWMXhRxFf3Ic-HtACLcB/s1600/spam-email.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-KkJXiHG80S0/WHX4TBpkamI/AAAAAAAADDg/F_bN796ndMYnzfUsgSWMXhRxFf3Ic-HtACLcB/s1600/spam-email.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f4b6cec-36c5-80bb-b3a7-00007cc8d0b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/marlboro-ransomware-defeated-in-one-day/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/marlboro-ransomware-defeated-in-one-day/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19528a6d-3222-d300-ab4d-0000f0705ddd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decrypter.emsisoft.com/marlboro","pattern":"[url:value = 'https://decrypter.emsisoft.com/marlboro']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29515868-5275-02f4-aba1-0000dcbc6921","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/marlboro.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/marlboro.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46c5d552-f2c9-d666-0fd5-00008c0fb853","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-MWRTa6aXtdk/WHflJFyb-GI/AAAAAAAADFs/dc-l-RrWSCAPE8akw2SCb1uuj-a-2shiwCLcB/s1600/docm.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-MWRTa6aXtdk/WHflJFyb-GI/AAAAAAAADFs/dc-l-RrWSCAPE8akw2SCb1uuj-a-2shiwCLcB/s1600/docm.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--555a548d-a168-daab-8242-000048f2ed92","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-7UmhPM2VSKY/WHe5tDsHfuI/AAAAAAAADFM/FRdUnAyxAggvF0hX0adtrpq48F7HXPbawCLcB/s1600/check-decrypt.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-7UmhPM2VSKY/WHe5tDsHfuI/AAAAAAAADFM/FRdUnAyxAggvF0hX0adtrpq48F7HXPbawCLcB/s1600/check-decrypt.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--842f7185-74fb-2628-2320-00008e7de9af","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016_03_01_archive.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016_03_01_archive.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96827a32-2e6b-97f8-5916-000005ff07b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/hakunamatata.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/hakunamatata.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1607147-2f69-88b6-def7-0000fa35f7c5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-DUXeyyzqwKs/WHkrGvLyFvI/AAAAAAAADGg/SPfrNMZYGs8edE7X5z-3MBroIqS5GQ8kACLcB/s1600/note_1-str_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-DUXeyyzqwKs/WHkrGvLyFvI/AAAAAAAADGg/SPfrNMZYGs8edE7X5z-3MBroIqS5GQ8kACLcB/s1600/note_1-str_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b55990d7-725c-8db6-dec9-00001f4605e4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://cfoc.org/how-to-restore-files-affected-by-the-lambdalocker-ransomware/","pattern":"[url:value = 'http://cfoc.org/how-to-restore-files-affected-by-the-lambdalocker-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c9d42c9-9b39-f348-a182-000026f92a23","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/lambdalocker.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/lambdalocker.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a58c09ee-6887-5c7b-c677-000062c6cce3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-B3o6bGziu_M/WHkyueI902I/AAAAAAAADGw/la7psCE9JEEe17GipFh69xVnIDYGFF38wCLcB/s1600/note-1-2.gif","pattern":"[url:value = 'https://1.bp.blogspot.com/-B3o6bGziu_M/WHkyueI902I/AAAAAAAADGw/la7psCE9JEEe17GipFh69xVnIDYGFF38wCLcB/s1600/note-1-2.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aed3725-40b5-4af3-2255-0000844cff4e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/819927858437099520","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/819927858437099520']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99a5bbda-850a-95a3-58f0-0000d5e5d5c5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/kaandsona-ransomtroll.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/kaandsona-ransomtroll.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4085eafe-1bb2-fa93-3895-0000726f77fd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-v3jncd77m3U/WHkjPoEusKI/AAAAAAAADGE/xJOIgzm-ST0L4kpNeThKTyfukq3e1Th-QCLcB/s1600/troll-22.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-v3jncd77m3U/WHkjPoEusKI/AAAAAAAADGE/xJOIgzm-ST0L4kpNeThKTyfukq3e1Th-QCLcB/s1600/troll-22.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97453e74-2e72-a70a-7165-0000e0fd2bd7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://sensorstechforum.com/remove-cryptosweettooth-ransomware-restore-locked-files/","pattern":"[url:value = 'http://sensorstechforum.com/remove-cryptosweettooth-ransomware-restore-locked-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b13712b3-3dfa-6290-51c9-0000f327d08a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/cryptosweettooth.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/cryptosweettooth.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40199359-d002-a57b-46ab-0000a91c21c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-KE6dziEK4To/WHnvPzKOs7I/AAAAAAAADHI/KPBjmO9iChgAa12-f1VOxF49Pv27-0XfQCLcB/s1600/note.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-KE6dziEK4To/WHnvPzKOs7I/AAAAAAAADHI/KPBjmO9iChgAa12-f1VOxF49Pv27-0XfQCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d3d4147-cf51-26f8-6768-000030a9ecb3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/havoc-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/havoc-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d664b2ab-e971-1b77-178a-0000bd779e82","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-Xs7yigomWw8/WH0mqn0QJLI/AAAAAAAADKA/0Fk5QroMsgQ3AsXbHsbVtopcJN4qzDgdACLcB/s1600/note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-Xs7yigomWw8/WH0mqn0QJLI/AAAAAAAADKA/0Fk5QroMsgQ3AsXbHsbVtopcJN4qzDgdACLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--831bfefc-a590-8f03-c710-000048f2ca46","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/Xylit0l/status/821757718885236740","pattern":"[url:value = 'https://twitter.com/Xylit0l/status/821757718885236740']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04fd4794-3d03-4a2b-3ec2-0000725802e5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-satan-ransomware-available-through-a-ransomware-as-a-service-/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-satan-ransomware-available-through-a-ransomware-as-a-service-/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25cfed10-9566-c7a7-c4f0-0000085bb47b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-january-20th-2017-satan-raas-spora-locky-and-more/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-january-20th-2017-satan-raas-spora-locky-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b641058e-7b93-42f4-ef4c-00006371f6d1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/637811/satan-ransomware-help-support-topic-stn-extension-help-decrypt-fileshtml/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/637811/satan-ransomware-help-support-topic-stn-extension-help-decrypt-fileshtml/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83841767-81d1-72fd-8b79-000056b85b27","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/satan-raas.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/satan-raas.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fc1c79d-141a-bf84-4062-00006965dd8d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-5BgSHIym-8Y/WIH92q4ymHI/AAAAAAAADSk/MF2T-mmhuY4irQZFqmpGZjmUI2onlNCyACLcB/s1600/ransom-note.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-5BgSHIym-8Y/WIH92q4ymHI/AAAAAAAADSk/MF2T-mmhuY4irQZFqmpGZjmUI2onlNCyACLcB/s1600/ransom-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a4b3de0-6945-c51d-bd01-0000d67245c2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-7fwX40eYL18/WH-tfpNjDgI/AAAAAAAADPk/KVP_ji8lR0gENCMYhb324mfzIFFpiaOwACLcB/s1600/site-raas.gif","pattern":"[url:value = 'https://3.bp.blogspot.com/-7fwX40eYL18/WH-tfpNjDgI/AAAAAAAADPk/KVP_ji8lR0gENCMYhb324mfzIFFpiaOwACLcB/s1600/site-raas.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c63f15be-7b76-df88-0376-0000ba655d5b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/garryweber.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/garryweber.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5a1f36a-bce9-6a94-000c-00002f762afd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-w6lxK0qHj8A/WIO_iAngUzI/AAAAAAAADTk/dLGlrwwOh508AlG2ojLRszpUxL0tHrtSQCLcB/s1600/note-html.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-w6lxK0qHj8A/WIO_iAngUzI/AAAAAAAADTk/dLGlrwwOh508AlG2ojLRszpUxL0tHrtSQCLcB/s1600/note-html.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4b58834-f6f1-14a4-0865-000021b5c547","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: protonmail.ch","pattern":"[domain-name:value = 'protonmail.ch']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--065e7ae3-72c1-0b14-816c-000006d1c6de","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/dn-donotopen.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/dn-donotopen.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31991a49-76b5-ce91-97be-0000b2c322eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-ilIaUD5qOuk/WIJuV1TuC1I/AAAAAAAADTA/SOj8St_qXMsgDexK1BGgZT0yFDkNDz_7QCLcB/s1600/lock.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-ilIaUD5qOuk/WIJuV1TuC1I/AAAAAAAADTA/SOj8St_qXMsgDexK1BGgZT0yFDkNDz_7QCLcB/s1600/lock.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c866eda0-8b9b-88fb-ab38-0000620f51ca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-llR46G5zOBE/WIJuTTHImXI/AAAAAAAADS8/Ww_QU1Z7Q3geZgiSStJB3siO3oQJpIcowCLcB/s1600/note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-llR46G5zOBE/WIJuTTHImXI/AAAAAAAADS8/Ww_QU1Z7Q3geZgiSStJB3siO3oQJpIcowCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8308feac-13da-0130-e613-0000a0f0a528","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/BleepinComputer/status/822653335681593345","pattern":"[url:value = 'https://twitter.com/BleepinComputer/status/822653335681593345']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e595afe7-04ac-6e5a-2792-0000f1214483","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://bestsecuritysearch.com/cloudsword-ransomware-virus-removal-steps-protection-updates/","pattern":"[url:value = 'http://bestsecuritysearch.com/cloudsword-ransomware-virus-removal-steps-protection-updates/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e463afb-947a-2372-8a83-0000f7f1e33d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/cloudsword.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/cloudsword.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4987999e-c2e3-44fa-35eb-0000d0a4f7cd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-OTxFEWf7LiY/WIO0rJmBgJI/AAAAAAAADTQ/U3BLcd2-CPQQ_73eIKIyg28cKFmw4nctgCLcB/s1600/note.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-OTxFEWf7LiY/WIO0rJmBgJI/AAAAAAAADTQ/U3BLcd2-CPQQ_73eIKIyg28cKFmw4nctgCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bb7ca2b-776f-175c-a4f0-0000a47ef52f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.govcert.admin.ch/blog/27/sage-2.0-comes-with-ip-generation-algorithm-ipga","pattern":"[url:value = 'https://www.govcert.admin.ch/blog/27/sage-2.0-comes-with-ip-generation-algorithm-ipga']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43123894-e3d5-1227-5b04-0000ea4a9872","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/sage-2-0-ransomware-gearing-up-for-possible-greater-distribution/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/sage-2-0-ransomware-gearing-up-for-possible-greater-distribution/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ecc4411-7859-96ab-42e4-0000ef55883d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.securityweek.com/sage-20-ransomware-demands-2000-ransom","pattern":"[url:value = 'http://www.securityweek.com/sage-20-ransomware-demands-2000-ransom']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ac31884-8e27-bb49-f975-0000923cfdeb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://isc.sans.edu/forums/diary/Sage+20+Ransomware/21959/","pattern":"[url:value = 'https://isc.sans.edu/forums/diary/Sage+20+Ransomware/21959/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27c130d0-efeb-c355-81f4-00004adab46c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/sage-2-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/sage-2-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d812dbe6-1bcc-21b3-9e12-0000c86c84f8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-_c5vGu4nCvE/WIT_pWP_FSI/AAAAAAAADUs/8hK8a4E48sY3U_aAHC2qNzYDBL0bQcNjgCLcB/s1600/note-wallp111.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-_c5vGu4nCvE/WIT_pWP_FSI/AAAAAAAADUs/8hK8a4E48sY3U_aAHC2qNzYDBL0bQcNjgCLcB/s1600/note-wallp111.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cbfc452-e404-966c-84a7-00006f0603bb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-6YhxRaqa_9Q/WISA9dW31bI/AAAAAAAADUE/78mNNKpPMyc2Gzi1N9CooyQp7RNT40NNgCLcB/s1600/note1_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-6YhxRaqa_9Q/WISA9dW31bI/AAAAAAAADUE/78mNNKpPMyc2Gzi1N9CooyQp7RNT40NNgCLcB/s1600/note1_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d727d35-b3a8-0a48-c5ed-0000f24c7543","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.2-spyware.com/remove-zekwacrypt-ransomware-virus.html","pattern":"[url:value = 'http://www.2-spyware.com/remove-zekwacrypt-ransomware-virus.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22c4d889-b824-6a0f-455e-0000cf7a2c3d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2016/06/zekwacrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2016/06/zekwacrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--059d4835-8810-c9a7-cbb4-000060c84824","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-CLo4JTpveKY/WI4sVXEQSPI/AAAAAAAADcU/n8qrwehDEQMlG845cjNow_fC4PDqlvPIQCLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-CLo4JTpveKY/WI4sVXEQSPI/AAAAAAAADcU/n8qrwehDEQMlG845cjNow_fC4PDqlvPIQCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75f3b9b5-17a5-0a8a-a771-00003690e55a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: jabbim.com","pattern":"[domain-name:value = 'jabbim.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abf15456-c237-f935-8048-0000882a4ddd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.enigmasoftware.com/funfactransomware-removal/","pattern":"[url:value = 'http://www.enigmasoftware.com/funfactransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd5b4384-2867-0fe5-2fe9-000035a762b5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/funfact.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/funfact.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--640aabaa-2f7a-b08f-5e58-000038ba019c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: note.iti","pattern":"[domain-name:value = 'note.iti']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8cd7c60-849a-e96c-725f-0000b0a9ab5c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: sigaint.org","pattern":"[domain-name:value = 'sigaint.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ae2c5a5-82e3-4f32-27dd-0000d34c7a20","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/vxlock-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/vxlock-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef7effe3-3223-4bec-c678-00007b4b8af1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/zxz-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/zxz-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ddecba9-8c5b-9b20-9585-00006bbad23a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/638191/zxz-ransomware-support-help-topic-zxz/?hl=%2Bzxz#entry4168310","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/638191/zxz-ransomware-support-help-topic-zxz/?hl=%2Bzxz#entry4168310']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78b5247f-dc79-7125-ced9-0000e138cc1e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1004803373747572736","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1004803373747572736']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bc0d964-547c-a5f0-5dc5-000070369acf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/1004351990493741057","pattern":"[url:value = 'https://twitter.com/demonslay335/status/1004351990493741057']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d6b0177-daa1-ab60-b326-000066b3b287","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/PolarToffee/status/824705553201057794","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/824705553201057794']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9819d658-36bf-d824-6b0c-000025d0f067","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/638344/cryptconsole-uncrypteoutlookcom-support-topic-how-decrypt-fileshta/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/638344/cryptconsole-uncrypteoutlookcom-support-topic-how-decrypt-fileshta/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc120fe8-b303-d25a-3cb7-000027a6a98d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/cryptconsole-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/cryptconsole-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4acc62e8-f6d3-c129-2ce3-0000969e4342","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://xchange.cc","pattern":"[url:value = 'https://xchange.cc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf1746e5-242f-67a3-3ae3-00007eaf3a1e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.coinbase.com","pattern":"[url:value = 'https://www.coinbase.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f1886f0-3d33-27e1-b6f1-00003f07918a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://localbitcoins.com","pattern":"[url:value = 'https://localbitcoins.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--296501ae-9ef1-0dd9-8b38-00000353917b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/jiriatvirlab/status/825411602535088129","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/825411602535088129']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55d25307-409c-1d15-e7a9-00000872ee11","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/ransomplus-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/ransomplus-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--844d5f15-d8c8-28af-aaf0-0000dbd55807","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.2-spyware.com/remove-ransomplus-ransomware-virus.html","pattern":"[url:value = 'http://www.2-spyware.com/remove-ransomplus-ransomware-virus.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61054581-b15d-d859-a762-0000e9e57bb7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-uIb_TdWTk3Q/WI2qRSlsXJI/AAAAAAAADcE/h92XEY6AraQMUwEIOBZ9moxN1J2So8xpwCLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-uIb_TdWTk3Q/WI2qRSlsXJI/AAAAAAAADcE/h92XEY6AraQMUwEIOBZ9moxN1J2So8xpwCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1c1c8f2-12fb-53f6-f21f-0000ad764d91","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://localbitcoins.com","pattern":"[url:value = 'http://localbitcoins.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99f6dcd3-200d-99e0-3fa0-000002ea1364","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/opentodecrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/opentodecrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2fce8fa-cb2c-1a6e-d14f-00006e8974d9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-RPeHrC9Trqk/WGk1kQlBQQI/AAAAAAAAC6o/FutnWrlUf44hq54_xI_6Uz2migCR0rwlwCLcB/s1600/Note-wallp.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-RPeHrC9Trqk/WGk1kQlBQQI/AAAAAAAAC6o/FutnWrlUf44hq54_xI_6Uz2migCR0rwlwCLcB/s1600/Note-wallp.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--459736f6-befd-c703-2358-00001cc53f1f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: india.comIdentification","pattern":"[domain-name:value = 'india.comIdentification']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22e86cb4-8b3b-fafe-7b09-000051b85da1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/01/polato-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/01/polato-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1215d46a-e799-0293-5caa-000039bfefba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-E9GDxEoz95k/WIop79nWZ2I/AAAAAAAADZU/CnsvOl96yesoH07BZ2Q05Fp40kLcTMmqQCLcB/s1600/note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-E9GDxEoz95k/WIop79nWZ2I/AAAAAAAADZU/CnsvOl96yesoH07BZ2Q05Fp40kLcTMmqQCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c831b6c-5039-c4f6-177a-0000683c6ea6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/ranion-ransomware-as-a-service-available-on-the-dark-web-for-educational-purposes/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/ranion-ransomware-as-a-service-available-on-the-dark-web-for-educational-purposes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61a72135-7bb8-5a25-d13f-000012fb411c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/ranion-raas.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/ranion-raas.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29f290f7-f4a1-e583-62df-0000660f39f8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-ORiqmM6oWXc/WJV7X4IvTWI/AAAAAAAADlE/wXvz5Hsv1gQ-UrLoA1plVjLTVD7iDDxwQCLcB/s1600/buy_2.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-ORiqmM6oWXc/WJV7X4IvTWI/AAAAAAAADlE/wXvz5Hsv1gQ-UrLoA1plVjLTVD7iDDxwQCLcB/s1600/buy_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af2f6355-f85b-3acc-902b-00007b00ac67","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/_ddoxer/status/827555507741274113","pattern":"[url:value = 'https://twitter.com/_ddoxer/status/827555507741274113']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25c7b639-071e-aea6-2117-00006853c5b9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/yourransom-is-the-latest-in-a-long-line-of-prank-and-educational-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/yourransom-is-the-latest-in-a-long-line-of-prank-and-educational-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--762f48bc-1709-0e82-b8af-0000ab43baf8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/yourransom-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/yourransom-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26f41e69-ecf5-5a15-b66d-0000dde1bcfd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-dFQlF_6uTkI/WJYigC5GwiI/AAAAAAAADlk/jm-ZwqJ2mVYd2gtAQgYW_lOd78u5N2x0ACLcB/s1600/note_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-dFQlF_6uTkI/WJYigC5GwiI/AAAAAAAADlk/jm-ZwqJ2mVYd2gtAQgYW_lOd78u5N2x0ACLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62e8b71f-c92e-c1f6-7520-0000e659f3b4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/polski-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/polski-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d68e78b-a0ae-caca-4366-00004b403d03","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-ahpZEI1FHQM/WJd7_dpYlyI/AAAAAAAADm8/4-nFXqc9bjEI93VDJRdsLSlBOwQiaM7swCLcB/s1600/note.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-ahpZEI1FHQM/WJd7_dpYlyI/AAAAAAAADm8/4-nFXqc9bjEI93VDJRdsLSlBOwQiaM7swCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ea3e298-e5e0-a96c-8ccb-000024e1cff4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/x-files-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/x-files-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66ee8180-951e-b0ff-d85a-00007069383d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017_02_01_archive.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017_02_01_archive.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--464a70e4-de77-3476-2075-0000e3abecec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/bleepincomputer/status/816053140147597312?lang=en","pattern":"[url:value = 'https://twitter.com/bleepincomputer/status/816053140147597312?lang=en']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6b74ba8-282e-51d0-c91f-00006595f961","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/dumb-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/dumb-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--599873da-1ccd-4326-df6e-00008eaec452","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-Vx9ZtCODajg/WKiMr2QX5cI/AAAAAAAAD64/QAh37o_CRIImaxUfIhoEh8qE4JLn5HaNwCLcB/s1600/dumb.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-Vx9ZtCODajg/WKiMr2QX5cI/AAAAAAAAD64/QAh37o_CRIImaxUfIhoEh8qE4JLn5HaNwCLcB/s1600/dumb.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--460eb15d-bf52-4642-5609-00008a744af5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-_Udncaac_gM/WKROBN00ORI/AAAAAAAAD2U/HsHkEspG85YSfPg-8MbPYYTYmBU4PAJAgCLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-_Udncaac_gM/WKROBN00ORI/AAAAAAAAD2U/HsHkEspG85YSfPg-8MbPYYTYmBU4PAJAgCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d41e849-cee4-249d-6a49-00001c41fb4e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/wcry-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/wcry-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0a03ce6-8c5d-3a69-d2c2-0000fc3c337b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-iUq492KUatk/WKH-GXnO4-I/AAAAAAAADzw/9uwo1LF5ciIvMJ6jAn3mskSqtdiTkxvlACLcB/s1600/lock-note.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-iUq492KUatk/WKH-GXnO4-I/AAAAAAAADzw/9uwo1LF5ciIvMJ6jAn3mskSqtdiTkxvlACLcB/s1600/lock-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b8c1ac6-f036-6c27-4c25-000035779ad7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/lovelock-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/lovelock-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7014ca2c-ee17-0caf-95c5-0000eeee11e3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-YdCKWLUFBOo/WKRCD2BLzTI/AAAAAAAAD14/BPtYMLvQpEMAbT-ZdiCVPi_LZCrXYJMhwCLcB/s1600/ReadME%2521.txt.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-YdCKWLUFBOo/WKRCD2BLzTI/AAAAAAAAD14/BPtYMLvQpEMAbT-ZdiCVPi_LZCrXYJMhwCLcB/s1600/ReadME%2521.txt.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc7c9e58-5ecb-df8a-c042-000020a8a0f9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/hermes-ransomware-decrypted-in-live-video-by-emsisofts-fabian-wosar/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/hermes-ransomware-decrypted-in-live-video-by-emsisofts-fabian-wosar/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60cf2949-3650-af75-97a1-0000c4a0b34b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/642019/hermes-ransomware-help-support-decrypt-informationhtml/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/642019/hermes-ransomware-help-support-decrypt-informationhtml/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f13b4a26-1213-8643-ea66-0000732b31a6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/hermes-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/hermes-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d81b1c5-7718-26d5-93d4-000004733d27","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-Yisae5e5Pjs/WKbXmIXU8YI/AAAAAAAAD3g/WZs5XzL4l4snT2j4yfc3CAaF7KonH_DQACLcB/s1600/note_1.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-Yisae5e5Pjs/WKbXmIXU8YI/AAAAAAAAD3g/WZs5XzL4l4snT2j4yfc3CAaF7KonH_DQACLcB/s1600/note_1.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3392e3eb-cdc8-9ad0-0ac7-00003a93289b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-nzY6thZOXSk/WKbYmWxa0rI/AAAAAAAAD3s/t_3d90FGOe8je8rfeeYLF1jzJinG5JMVgCLcB/s1600/note_2_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-nzY6thZOXSk/WKbYmWxa0rI/AAAAAAAAD3s/t_3d90FGOe8je8rfeeYLF1jzJinG5JMVgCLcB/s1600/note_2_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f397d64b-afe1-116d-15b9-000031b04302","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/cryptomix-variant-named-cryptoshield-1-0-ransomware-distributed-by-exploit-kits/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/cryptomix-variant-named-cryptoshield-1-0-ransomware-distributed-by-exploit-kits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--693c0335-5961-d697-59a0-0000d2944df8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/cryptoshield-2-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/cryptoshield-2-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0bb07ec-e420-cce4-135c-0000477c9009","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-A-N9zQgZrhE/WJHAHzuitvI/AAAAAAAADhI/AHkLaL9blZgqQWc-sTevVRTxVRttbugoQCLcB/s1600/note-2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-A-N9zQgZrhE/WJHAHzuitvI/AAAAAAAADhI/AHkLaL9blZgqQWc-sTevVRTxVRttbugoQCLcB/s1600/note-2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61bb773b-7b63-badc-4eba-0000e085ca8b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-thor-extension-after-being-a-bad-malware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-thor-extension-after-being-a-bad-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8092579a-b1ba-4cb6-b110-0000ef0941f3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/locky-impersonator.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/locky-impersonator.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56e2349c-6242-3958-efeb-0000f55174cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-locky-ransomware-encrypts-local-files-and-unmapped-network-shares/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-locky-ransomware-encrypts-local-files-and-unmapped-network-shares/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6832d31f-7fb7-33b6-e043-0000879a017e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: sigaint.net","pattern":"[domain-name:value = 'sigaint.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08aa98d5-6469-e191-4ba2-0000f0aff899","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-17th-2017-live-hermes-reversing-and-scada-poc-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-17th-2017-live-hermes-reversing-and-scada-poc-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7e675e0-7e37-0698-896a-000046b55f57","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MarceloRivero/status/832302976744173570","pattern":"[url:value = 'https://twitter.com/MarceloRivero/status/832302976744173570']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcd2a78e-8322-9c34-1262-00009646ea2e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/kasiski-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/kasiski-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6652b389-fa71-2a72-e652-0000501fa864","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-ehXlWPLxtR8/WKdHF_Y-MeI/AAAAAAAAD5A/KKXO-S9OtMQAcNM-IOV2ees8qKlAJ3pzACLcB/s1600/note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-ehXlWPLxtR8/WKdHF_Y-MeI/AAAAAAAAD5A/KKXO-S9OtMQAcNM-IOV2ees8qKlAJ3pzACLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b88cadc4-c611-4a14-2e35-0000c9a5bfa5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: INSTRUCCIONES.txt","pattern":"[domain-name:value = 'INSTRUCCIONES.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c7f5094-8b50-bb92-67e2-0000746d6477","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/vhd-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/vhd-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e545cad-53fd-c8af-828d-00005fde0c26","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-viZiAZr3_ns/WKrIDWEEBXI/AAAAAAAAD8c/8n1RJ9m2Odoe3bvMMmIm421NdxS-OIRzQCLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-viZiAZr3_ns/WKrIDWEEBXI/AAAAAAAAD8c/8n1RJ9m2Odoe3bvMMmIm421NdxS-OIRzQCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc4c8dc5-0b8b-5e76-b445-00009255fa44","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/suchsecurity-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/suchsecurity-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d67cef5f-487f-dd5e-1ac1-000013c3fec1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-OCBIabrrZNg/WLm1RGFVKEI/AAAAAAAAEHY/1MASb-0Y7jsBlE2TzyqgknrfDhuEsNx2gCLcB/s1600/Screenshot_1.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-OCBIabrrZNg/WLm1RGFVKEI/AAAAAAAAEHY/1MASb-0Y7jsBlE2TzyqgknrfDhuEsNx2gCLcB/s1600/Screenshot_1.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e31a74e8-8ca9-1bdb-6a48-0000e5b681dd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/avastvirusinfo-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/avastvirusinfo-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1484ac3-5bf1-dc6e-13d0-0000150e037b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017_03_01_archive.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017_03_01_archive.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f07defe-6100-ebdc-8821-0000caf36639","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/userfileslocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/userfileslocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1a76150-62a2-3605-be82-0000ac9e0742","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-0D8XdlTNIsA/WLXFiBWz5II/AAAAAAAAEFQ/Hojw0BHHysUieiCnidoVwTrqXVCckLkSQCLcB/s1600/lock-screen.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-0D8XdlTNIsA/WLXFiBWz5II/AAAAAAAAEFQ/Hojw0BHHysUieiCnidoVwTrqXVCckLkSQCLcB/s1600/lock-screen.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a00837f-75ff-b9d9-bd62-0000bb75a1d1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/cryptolocker-by-ntk-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/cryptolocker-by-ntk-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9079b4d9-cb75-7bf8-b57b-0000df5ee9a5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-hvTBarxSO8Y/WKs5kjdpgDI/AAAAAAAAD9Q/m3louiSE6xY0BcGjnWvg_NNDU6K1ok3ggCLcB/s1600/lock.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-hvTBarxSO8Y/WKs5kjdpgDI/AAAAAAAAD9Q/m3louiSE6xY0BcGjnWvg_NNDU6K1ok3ggCLcB/s1600/lock.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--194e39d1-62f8-c3f4-f8d7-0000e7ddfb9d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/835668540367777792","pattern":"[url:value = 'https://twitter.com/demonslay335/status/835668540367777792']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0910ef8-5721-460b-ddfc-0000562ae97a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/barraxcrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/barraxcrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0c9949f-39fa-be7d-258f-0000f5ac8f89","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf10584d-2e70-d2d4-d210-0000e3e19cba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/cryptconsole-2-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/cryptconsole-2-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e63c6f94-ec87-3407-b510-0000c3665e8b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-M2CMU8RPgqw/WLfqOCgNXrI/AAAAAAAAEGA/W-uAf30qQgoZxqRwblUcSKzYrM5QmcLfgCLcB/s1600/note-html_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-M2CMU8RPgqw/WLfqOCgNXrI/AAAAAAAAEGA/W-uAf30qQgoZxqRwblUcSKzYrM5QmcLfgCLcB/s1600/note-html_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db46dade-c992-5961-11b5-0000737bd99c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: files.hta","pattern":"[domain-name:value = 'files.hta']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--592be0f5-82f6-4f65-034d-0000b5bbfe60","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.enigmasoftware.com/youarefuckedransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/youarefuckedransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b47be60-fb80-3feb-f63a-00002e5fd910","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-S0-Bop8XUgk/WLD_RVgldgI/AAAAAAAAEBU/r2LmgjTHUbMTtIKGH2pHdKfFXcUEOQdMgCLcB/s1600/lock-act2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-S0-Bop8XUgk/WLD_RVgldgI/AAAAAAAAEBU/r2LmgjTHUbMTtIKGH2pHdKfFXcUEOQdMgCLcB/s1600/lock-act2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03a48d0f-4287-c6df-9323-0000a0bc8367","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/833636006721122304","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/833636006721122304']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dca90f4b-df60-203c-71be-0000a02b20d0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/xyzware-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/xyzware-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf2eb3d2-a79f-fb5a-407d-00007526d89b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: indonesianbacktrack.or.id","pattern":"[domain-name:value = 'indonesianbacktrack.or.id']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fe598c3-d1da-debe-b13c-00006faf80a7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: decrypt.Email","pattern":"[domain-name:value = 'decrypt.Email']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf3263e5-25db-9237-cf3a-0000dd583ebe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335/status/835664067843014656","pattern":"[url:value = 'https://twitter.com/demonslay335/status/835664067843014656']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d87d8f3-d2aa-9a57-ece6-000079c9d1be","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decrypter.emsisoft.com/damage","pattern":"[url:value = 'https://decrypter.emsisoft.com/damage']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf017508-0875-31a4-4d88-0000df2aa9fc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/damage-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/damage-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d3522e4-6681-25ce-48cf-0000ab9cbf8c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-24th-2017-trump-locker-macos-rw-and-cryptomix/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-24th-2017-trump-locker-macos-rw-and-cryptomix/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27dd716d-2636-b599-6e00-00007a3ffb24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/trumplocker.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/trumplocker.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76b640b9-ac69-4b99-0374-0000ec82d9fb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-trump-locker-ransomware-is-a-fraud-just-venuslocker-in-disguise/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-trump-locker-ransomware-is-a-fraud-just-venuslocker-in-disguise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87af9543-fa9c-e59c-9d61-0000ccf5b696","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepstatic.com/images/news/u/986406/Ransomware/TrumpLocker/TrumpLocker-wallpaper.jpg","pattern":"[url:value = 'https://www.bleepstatic.com/images/news/u/986406/Ransomware/TrumpLocker/TrumpLocker-wallpaper.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f122b2d-4b8a-b615-a527-00005bc6cedf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: files.txt","pattern":"[domain-name:value = 'files.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a1891b4-fe3a-b730-baf5-00004d173025","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-8qIiBHnE9yU/WK1mZn3LgwI/AAAAAAAAD-M/ZKl7_Iwr1agYtlVO3HXaUrwitcowp5_NQCLcB/s1600/lock.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-8qIiBHnE9yU/WK1mZn3LgwI/AAAAAAAAD-M/ZKl7_Iwr1agYtlVO3HXaUrwitcowp5_NQCLcB/s1600/lock.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c687f8e2-cc25-191f-c89e-0000f1a93c90","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/Jan0fficial/status/834706668466405377","pattern":"[url:value = 'https://twitter.com/Jan0fficial/status/834706668466405377']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14a9f406-0b44-c7bd-c127-00002f2106fd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/pyl33t-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/pyl33t-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2e26103-abe6-b34f-6bce-0000c4d222b7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JAMESWT_MHT/status/834783231476166657","pattern":"[url:value = 'https://twitter.com/JAMESWT_MHT/status/834783231476166657']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bda64041-ccaf-21c5-16ec-00004ae2eb3c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/vanguard-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/vanguard-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49e2bb44-bb23-fd47-81cc-0000cad094dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bitcoin.com/buy-bitcoin","pattern":"[url:value = 'https://www.bitcoin.com/buy-bitcoin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--949f18ba-4ce4-f687-381c-0000de142870","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.coindesk.com/information/how-can-i-buy-bitcoins/","pattern":"[url:value = 'http://www.coindesk.com/information/how-can-i-buy-bitcoins/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba8bcd87-cd52-0d97-c8b3-00001432bbba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://translate.google.com","pattern":"[url:value = 'https://translate.google.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60867304-05eb-d2dd-5f48-0000f3b6e132","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/834821166116327425","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/834821166116327425']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff18e0d0-ff9f-e2fe-b2e6-000034ed1bdb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/pickles-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/pickles-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51524fde-5ecf-3688-f43f-000059442f62","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"domain: DECRYPT.txt","pattern":"[domain-name:value = 'DECRYPT.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--166bc2fb-eac6-df8a-9ba0-00006e4bd495","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-raas-portal-preparing-to-spread-unlock26-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-raas-portal-preparing-to-spread-unlock26-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a54cc3bd-f2db-52ef-84f6-0000a64da17e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/unlock26-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/unlock26-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--068d6038-a01f-dd55-8414-000028fa65ba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-E1vV0sqaw2o/WLB1OvOLCPI/AAAAAAAAEAg/D4OkAOBT_uM4DeVS1hAu6eBGcmga8CSYwCLcB/s1600/site1.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-E1vV0sqaw2o/WLB1OvOLCPI/AAAAAAAAEAg/D4OkAOBT_uM4DeVS1hAu6eBGcmga8CSYwCLcB/s1600/site1.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9862e2b2-ac2e-0c04-2c38-0000fd58fe52","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-92aP_sumdLo/WLAy3D2kLvI/AAAAAAAAEAQ/FA1j--rOIygsNbDAWqrDqufT7zSwuEnvQCLcB/s1600/note-html_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-92aP_sumdLo/WLAy3D2kLvI/AAAAAAAAEAQ/FA1j--rOIygsNbDAWqrDqufT7zSwuEnvQCLcB/s1600/note-html_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61ff3f04-f904-ec97-4e9e-00008859d4ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: attachments.All","pattern":"[domain-name:value = 'attachments.All']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d47c1d1-219e-38f0-d889-0000426428c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/02/dotransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/02/dotransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7079d0e6-c498-b5ba-9465-0000f1f8e54b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-BoKI2-Lhsp8/WLHq34zCtdI/AAAAAAAAECo/YkfIG29vRRsLvdn51ctrMEypptRzZS2IgCLcB/s1600/raas.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-BoKI2-Lhsp8/WLHq34zCtdI/AAAAAAAAECo/YkfIG29vRRsLvdn51ctrMEypptRzZS2IgCLcB/s1600/raas.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55460690-8f21-ed6f-4d41-0000c080be28","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/search?updated-min=2017-01-01T00:00:00-08:00&updated-max=2018-01-01T00:00:00-08:00&max-results=50","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/search?updated-min=2017-01-01T00:00:00-08:00&updated-max=2018-01-01T00:00:00-08:00&max-results=50']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5941c726-a2e7-d0b6-21bb-00004dd64f2a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-qsS0x-tHx00/WLM3kkKWKAI/AAAAAAAAEDg/Zhy3eYf-ek8fY5uM0yHs7E0fEFg2AXG-gCLcB/s1600/failed-key.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-qsS0x-tHx00/WLM3kkKWKAI/AAAAAAAAEDg/Zhy3eYf-ek8fY5uM0yHs7E0fEFg2AXG-gCLcB/s1600/failed-key.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fece4bbd-2811-b1e3-1159-000056a1516a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/836995570384453632","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/836995570384453632']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0347036-4bdb-3d95-564e-0000da1b512f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/krider-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/krider-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0694d4c-d012-7db2-d828-0000fc4fd95e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/consoleapplication1-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/consoleapplication1-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d950dc59-64b7-ff0a-45b7-0000d1fd8baf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/redants-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/redants-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12c6dffb-303b-2c78-f92d-0000394067d8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/lock2017-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/lock2017-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3c1775f-5241-4b92-feae-00001f8b31c7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-FllHGqIx_JQ/WL1QF2uMCCI/AAAAAAAAEJQ/Fn-8j2t8dwgSo8YTHM1iOkL-3U_hbcaKwCLcB/s1600/Note_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-FllHGqIx_JQ/WL1QF2uMCCI/AAAAAAAAEJQ/Fn-8j2t8dwgSo8YTHM1iOkL-3U_hbcaKwCLcB/s1600/Note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d92e976d-ecde-7d4a-9c1a-0000b2502f3d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: unseen.is","pattern":"[domain-name:value = 'unseen.is']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f9b2518-e716-f7de-abda-000020101f11","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: name.file","pattern":"[domain-name:value = 'name.file']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4280502d-de5d-946b-ec5e-000093e04e2b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/837565766073475072","pattern":"[url:value = 'https://twitter.com/struppigel/status/837565766073475072']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8d7a074-3163-dc33-9a9c-0000113e7e04","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/fabsyscrypto-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/fabsyscrypto-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--337a9773-b33c-9d4e-ca04-00002c11176b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-QuBYcLAKRPU/WLnE3Rn3MhI/AAAAAAAAEH4/WnC5Ke11j4MO7wmnfqBhtA-hpx6YN6TBgCLcB/s1600/note_2.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-QuBYcLAKRPU/WLnE3Rn3MhI/AAAAAAAAEH4/WnC5Ke11j4MO7wmnfqBhtA-hpx6YN6TBgCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6128f4f4-0762-78e4-6d7b-000003de1280","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/PolarToffee/status/843527738774507522","pattern":"[url:value = 'https://twitter.com/PolarToffee/status/843527738774507522']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2faaa5ca-5221-0327-6ee6-00008d3d544d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/cryptodevil-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/cryptodevil-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8da7fab-a5eb-e2f7-d652-0000effaa934","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-9ovaMSUgtFQ/WM7dXo84tlI/AAAAAAAAEVc/_Zx9gZuvHA0tU9-jtzP492bXa5fQiL7kgCLcB/s1600/key-price.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-9ovaMSUgtFQ/WM7dXo84tlI/AAAAAAAAEVc/_Zx9gZuvHA0tU9-jtzP492bXa5fQiL7kgCLcB/s1600/key-price.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26c03473-b5da-6cce-331e-0000828fa2c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-i5iUwC8XWDo/WM7dSVNQ8UI/AAAAAAAAEVY/uXmUErkLgHcWbfpdw1zGTvwY9DimiAH8wCLcB/s1600/lock-panel.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-i5iUwC8XWDo/WM7dSVNQ8UI/AAAAAAAAEVY/uXmUErkLgHcWbfpdw1zGTvwY9DimiAH8wCLcB/s1600/lock-panel.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8d0846a-f823-55d4-97c0-0000680a843b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/642409/motd-ransomware-help-support-topics-motdtxt-and-enc-extension/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/642409/motd-ransomware-help-support-topics-motdtxt-and-enc-extension/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f106bbc9-5776-e85e-5e5d-0000845a3ad6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/642409/motd-of-ransome-hostage/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/642409/motd-of-ransome-hostage/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06e0111f-2908-0885-b14e-000010df608d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/motd-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/motd-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac1ef672-1eeb-b3e3-332d-00001bea8264","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-suCNGXgzWuM/WM7HPujx_qI/AAAAAAAAEUk/gIvzbsbB_BUrBmmBsgpb_8w7zjwudu_mACLcB/s1600/note_2.png","pattern":"[url:value = 'https://4.bp.blogspot.com/-suCNGXgzWuM/WM7HPujx_qI/AAAAAAAAEUk/gIvzbsbB_BUrBmmBsgpb_8w7zjwudu_mACLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ca8960f-7f70-d396-69ab-0000897cb6e0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: motd.txt","pattern":"[domain-name:value = 'motd.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ff569b6-5d79-e724-930c-00004c4d117e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/839467168760725508","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/839467168760725508']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3960fbf4-bf61-1b03-9e8d-0000fc41c7b5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.fixinfectedpc.com/uninstall-crptxxx-ransomware-from-pc","pattern":"[url:value = 'http://www.fixinfectedpc.com/uninstall-crptxxx-ransomware-from-pc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77385dcb-9d99-4835-6eb7-00004e9ba7ff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/609690/ultracrypter-cryptxxx-ultradecrypter-ransomware-help-topic-crypt-cryp1/page-84","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/609690/ultracrypter-cryptxxx-ultradecrypter-ransomware-help-topic-crypt-cryp1/page-84']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ac3f4a4-1a3a-c9bb-23fb-000058ba079b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/crptxxx-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/crptxxx-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66686bf9-498c-0c83-652e-00008b035691","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-itq9nR2EedY/WM2OPtDKCgI/AAAAAAAAEUI/KcC8vtnmlHENz0CSOvxqoYeZL8qdx1IZgCLcB/s1600/note_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-itq9nR2EedY/WM2OPtDKCgI/AAAAAAAAEUI/KcC8vtnmlHENz0CSOvxqoYeZL8qdx1IZgCLcB/s1600/note_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b3cb817-2d96-5553-0bb9-0000ee6ca827","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/842781575410597894","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/842781575410597894']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2cb8774-86b7-e65a-2601-0000dffa9064","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/demonslay335?lang=en","pattern":"[url:value = 'https://twitter.com/demonslay335?lang=en']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e986cda3-258a-6229-efee-000055c72968","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/zinocrypt-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/zinocrypt-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96dd6806-b3e0-03fd-b37f-0000a5bd764c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-t1Q-a7sJlag/WMw8MBNIrkI/AAAAAAAAET4/aycY-m5GXVYQjcbZJ8N0kIfUZ3onYt8AgCLcB/s1600/note.jpg","pattern":"[url:value = 'https://4.bp.blogspot.com/-t1Q-a7sJlag/WMw8MBNIrkI/AAAAAAAAET4/aycY-m5GXVYQjcbZJ8N0kIfUZ3onYt8AgCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd77bc9f-0db6-b089-9101-00008428bf95","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.virustotal.com/en/file/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc/analysis/","pattern":"[url:value = 'https://www.virustotal.com/en/file/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc/analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cee4ceef-d341-77aa-1747-0000a4d60e5c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.grahamcluley.com/kirk-ransomware-sports-star-trek-themed-decryptor-little-known-crypto-currency/","pattern":"[url:value = 'https://www.grahamcluley.com/kirk-ransomware-sports-star-trek-themed-decryptor-little-known-crypto-currency/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bc0d8f8-f3b2-5f88-3552-00009d24ea3a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.securityweek.com/star-trek-themed-kirk-ransomware-emerges","pattern":"[url:value = 'http://www.securityweek.com/star-trek-themed-kirk-ransomware-emerges']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97329e03-b609-c3de-32c8-0000d1250d74","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.networkworld.com/article/3182415/security/star-trek-themed-kirk-ransomware-has-spock-decryptor-demands-ransom-be-paid-in-monero.html","pattern":"[url:value = 'http://www.networkworld.com/article/3182415/security/star-trek-themed-kirk-ransomware-has-spock-decryptor-demands-ransom-be-paid-in-monero.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f77367c1-59db-320c-08e7-000087ab64c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/forums/t/642239/kirk-ransomware-help-support-topic-kirk-extension-ransom-notetxt/","pattern":"[url:value = 'https://www.bleepingcomputer.com/forums/t/642239/kirk-ransomware-help-support-topic-kirk-extension-ransom-notetxt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--536ef291-08ec-5d60-47b3-00008427585a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/kirkspock-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/kirkspock-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de8c157c-6095-4982-2a78-00007a26fd5b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-USLFJX6OMD4/WMwmKIsJnEI/AAAAAAAAETQ/S8uzyHF5mWQZjra6EGBidZ6wqgzrNqIMgCLcB/s1600/full-ransom-note.png","pattern":"[url:value = 'https://3.bp.blogspot.com/-USLFJX6OMD4/WMwmKIsJnEI/AAAAAAAAETQ/S8uzyHF5mWQZjra6EGBidZ6wqgzrNqIMgCLcB/s1600/full-ransom-note.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--963f7c39-4204-3bee-03f2-0000e9286915","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: kirk.payments","pattern":"[domain-name:value = 'kirk.payments']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c98cc89-e0b5-6674-74da-0000fb50280e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: scryptmail.com","pattern":"[domain-name:value = 'scryptmail.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b96d9c09-fdde-b021-3790-000097936f93","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: kirk.help","pattern":"[domain-name:value = 'kirk.help']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fe1c9a4-e9e3-223c-2a4f-0000d4242bf9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: NOTE.txt","pattern":"[domain-name:value = 'NOTE.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5834c8a4-404d-3e4c-e6c3-0000e1a7fe17","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: encryption.In","pattern":"[domain-name:value = 'encryption.In']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ee8c632-1ea7-a24c-6fca-0000e0e86efc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/JakubKroustek/status/842034887397908480","pattern":"[url:value = 'https://twitter.com/JakubKroustek/status/842034887397908480']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa1533e6-42c2-e848-b299-0000c0af68cd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/turkish-fileencryptor.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/turkish-fileencryptor.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e7e70b6-e594-9202-3a29-0000ad27e2ef","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-ccU4txzjpWg/WMl33c7YD3I/AAAAAAAAESU/moLHgQnVMYstKuHKuNgWKz8VbNv5ECdzACLcB/s1600/lock-note.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-ccU4txzjpWg/WMl33c7YD3I/AAAAAAAAESU/moLHgQnVMYstKuHKuNgWKz8VbNv5ECdzACLcB/s1600/lock-note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8d4f6cf-92f4-b585-c4a9-0000fe3e3581","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: www.localbitcoins.co","pattern":"[domain-name:value = 'www.localbitcoins.co']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0e2763b-f899-2253-07c9-00001a8828d9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: lelantos.org","pattern":"[domain-name:value = 'lelantos.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfb51492-de44-a105-ad0c-0000ce1e54a4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: Oku.txt","pattern":"[domain-name:value = 'Oku.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cdd8b9e-8390-9a02-ab3b-000023ee3ff1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/revenge-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/revenge-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d95e6417-c1d5-7191-941f-0000605d22d2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/revenge-ransomware-a-cryptomix-variant-being-distributed-by-rig-exploit-kit/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/revenge-ransomware-a-cryptomix-variant-being-distributed-by-rig-exploit-kit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cceb9a73-2efa-4f80-73d6-00001eb7ca0b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-KkPVDxjy8tk/WM7LtYHmuAI/AAAAAAAAEUw/kDJghaq-j1AZuqjzqk2Fkxpp4yr9Yeb5wCLcB/s1600/revenge-note-2.jpg","pattern":"[url:value = 'https://2.bp.blogspot.com/-KkPVDxjy8tk/WM7LtYHmuAI/AAAAAAAAEUw/kDJghaq-j1AZuqjzqk2Fkxpp4yr9Yeb5wCLcB/s1600/revenge-note-2.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2b145b1-e4ef-e493-2534-00000182e901","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/malwrhunterteam/status/841747002438361089","pattern":"[url:value = 'https://twitter.com/malwrhunterteam/status/841747002438361089']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e70bc95-f81a-7653-eb4f-000017dbaf63","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/karmen-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/karmen-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6440c70c-0636-69d2-e007-00000f0bbcb7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-OmuOKzLOHnw/WMl74fSSaJI/AAAAAAAAESg/4CsOYOSuUeEhsO4jSi6k10sbb_1NnfYxACLcB/s1600/lock-screen.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-OmuOKzLOHnw/WMl74fSSaJI/AAAAAAAAESg/4CsOYOSuUeEhsO4jSi6k10sbb_1NnfYxACLcB/s1600/lock-screen.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--792e41e9-9b5e-bb90-356b-000067f1dd73","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/blog/research/77762/petrwrap-the-new-petya-based-ransomware-used-in-targeted-attacks/","pattern":"[url:value = 'https://securelist.com/blog/research/77762/petrwrap-the-new-petya-based-ransomware-used-in-targeted-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe85565b-0443-c18a-bfae-0000e5ac097c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-17th-2017-revenge-petrwrap-and-captain-kirk/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-17th-2017-revenge-petrwrap-and-captain-kirk/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9843e60f-4db3-1ad2-8ae5-000018db464b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/petrwrap-ransomware-is-a-petya-offspring-used-in-targeted-attacks/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/petrwrap-ransomware-is-a-petya-offspring-used-in-targeted-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c85fd1fa-0be4-3c6f-a856-00002fd20b5b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/petrwrap-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/petrwrap-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35fb360d-e283-fa59-0cb8-00005fdd6c29","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-ZbWrN1LR-14/WMhPB7M8LBI/AAAAAAAAERQ/ZGG3RDHd8V0hwK_pf-vYChTn9VRpLBgNQCLcB/s1600/petya-based_ru_3.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-ZbWrN1LR-14/WMhPB7M8LBI/AAAAAAAAERQ/ZGG3RDHd8V0hwK_pf-vYChTn9VRpLBgNQCLcB/s1600/petya-based_ru_3.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3993429a-85bb-d4a7-fdae-0000afbb97c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/project34-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/project34-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7c1c3d8-90ac-c49a-30e3-0000ad601be4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: 2IP.RU","pattern":"[domain-name:value = '2IP.RU']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fce23eb8-d034-932a-2cb4-00008f898af3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: india.com","pattern":"[domain-name:value = 'india.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2194aed1-8afc-1bcf-7ff3-0000bfdbdcb2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/gg-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/gg-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--262f6da0-0a2b-c89f-9a58-0000568c305b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/cryptomeister-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/cryptomeister-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b17a5911-8db3-dfb2-0c3a-00009a3eb650","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: wvw.coinbase.com","pattern":"[domain-name:value = 'wvw.coinbase.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ccd2744-d4b6-8096-ffba-0000bcf56cd6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/jiriatvirlab/status/840863070733885440","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/840863070733885440']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a08b429-5649-67c0-3953-00004d98dbd5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/rozalocker-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/rozalocker-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e67c733-e423-88b1-1105-00008536ab6b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x-pay.cc/","pattern":"[url:value = 'https://x-pay.cc/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--123c762b-3949-e7ec-f42b-000096644e4a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/gc47-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/gc47-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25feb049-2a3f-7e89-a09b-000035fd8267","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://3.bp.blogspot.com/-i4i0joM4qRk/WMO7sKLu4dI/AAAAAAAAENU/vLR4B1Xg39wduycHe2f0vEYSv_dtJ-gxwCLcB/s1600/note.jpg","pattern":"[url:value = 'https://3.bp.blogspot.com/-i4i0joM4qRk/WMO7sKLu4dI/AAAAAAAAENU/vLR4B1Xg39wduycHe2f0vEYSv_dtJ-gxwCLcB/s1600/note.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fccc5b4c-0e2e-c5b9-4470-0000466b3bf2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/struppigel/status/839778905091424260","pattern":"[url:value = 'https://twitter.com/struppigel/status/839778905091424260']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abe6a306-35df-c6a3-f02e-00003cb891d0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/vortex-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/vortex-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7b9691b-8ccc-bb86-0946-0000e6d7b39a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: airmail.cc","pattern":"[domain-name:value = 'airmail.cc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cac4262f-f088-c71c-6172-00007ac5198b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: openmailbox.org","pattern":"[domain-name:value = 'openmailbox.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92b47f76-10d0-933a-30a5-00006dd7329a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: form.The","pattern":"[domain-name:value = 'form.The']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21c42711-d9fd-3898-e576-0000af5e3804","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/dangerous-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/dangerous-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d02286c-8feb-9377-9953-0000b3b2a8d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: someting.com","pattern":"[domain-name:value = 'someting.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69604252-d56a-b31d-acf1-000014b3f3c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/embittered-enjey-ransomware-developer-launches-ddos-attack-on-id-ransomware/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/embittered-enjey-ransomware-developer-launches-ddos-attack-on-id-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bae520c-3ab5-0d27-b25b-0000448f0d78","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-10th-2017-spora-cerber-and-technical-writeups/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-10th-2017-spora-cerber-and-technical-writeups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6598f851-af5c-65e7-5ac7-0000bbb9718f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/enjey-crypter-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/enjey-crypter-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--121e2a2b-1200-5042-b1e8-0000550a1df6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://2.bp.blogspot.com/-rkOR4L9jDZc/WMG1uI6vqQI/AAAAAAAAEMk/SAu_FleTLHcagf_maS31xt3D_qnwAx2RQCLcB/s1600/note-enjey_2.png","pattern":"[url:value = 'https://2.bp.blogspot.com/-rkOR4L9jDZc/WMG1uI6vqQI/AAAAAAAAEMk/SAu_FleTLHcagf_maS31xt3D_qnwAx2RQCLcB/s1600/note-enjey_2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a7c319c-1c9d-a04f-6106-0000118eed47","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: india.com.enjey","pattern":"[domain-name:value = 'india.com.enjey']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5346e936-8563-1740-c8c6-000080cbc81d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: encrypted.contact","pattern":"[domain-name:value = 'encrypted.contact']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3e6849b-15c1-900f-2d34-000013b6084e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/kaenlupuf-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/kaenlupuf-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0b213b7-901f-90b4-4e2c-000070e73ec9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-yTOgGw5v_vo/WMBUGHN7bnI/AAAAAAAAELY/8DDyxB4pSWgje_-iVbXgy2agNty1X6D6ACLcB/s1600/C6TUfkZWAAEewi_.jpg","pattern":"[url:value = 'https://1.bp.blogspot.com/-yTOgGw5v_vo/WMBUGHN7bnI/AAAAAAAAELY/8DDyxB4pSWgje_-iVbXgy2agNty1X6D6ACLcB/s1600/C6TUfkZWAAEewi_.jpg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0d77a75-548e-f33c-4d5e-00006b2b39fe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/jiriatvirlab/status/838779371750031360","pattern":"[url:value = 'https://twitter.com/jiriatvirlab/status/838779371750031360']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--796beae1-f9d6-b5d0-59ff-000022a75cf6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/cryptojacky-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/cryptojacky-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eab348d-9109-a279-d446-0000e7b54474","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://1.bp.blogspot.com/-pSmSehFx0bI/WL8Rp7RoMHI/AAAAAAAAEKw/eyfsAjikl9sDHlcjdyQeRxZsLto4hxvGwCLcB/s1600/note-1-2.png","pattern":"[url:value = 'https://1.bp.blogspot.com/-pSmSehFx0bI/WL8Rp7RoMHI/AAAAAAAAEKw/eyfsAjikl9sDHlcjdyQeRxZsLto4hxvGwCLcB/s1600/note-1-2.png']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63b3c950-9ba0-469c-f241-0000d09ae54c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.co.il/2017/03/nhtnwcuf-ransomware.html","pattern":"[url:value = 'https://id-ransomware.blogspot.co.il/2017/03/nhtnwcuf-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--991a394b-b4c8-185b-a9c4-00007b5f53d6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://4.bp.blogspot.com/-OkiR6pVmYUw/WMFiLGPuJhI/AAAAAAAAEME/wccYzFDIzJYWKXVxaTQeB4vM-4X6h3atgCLcB/s1600/note-nhtnwcuf.gif","pattern":"[url:value = 'https://4.bp.blogspot.com/-OkiR6pVmYUw/WMFiLGPuJhI/AAAAAAAAEME/wccYzFDIzJYWKXVxaTQeB4vM-4X6h3atgCLcB/s1600/note-nhtnwcuf.gif']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8d31bdd-80e7-6e02-475d-0000fdb3adc6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: ransomlook.io","pattern":"[domain-name:value = 'ransomlook.io']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ea6c5cc-b280-a539-5349-0000e5fb0f72","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://id-ransomware.blogspot.com/2016/07/ransomware-list.html","pattern":"[url:value = 'https://id-ransomware.blogspot.com/2016/07/ransomware-list.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8994b432-fa22-6bf6-3a8b-0000a4524838","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://pastebin.com/raw/GHgpWjar","pattern":"[url:value = 'http://pastebin.com/raw/GHgpWjar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e6920cb-a4c5-8710-ac4e-0000c866c14f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml","pattern":"[url:value = 'https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7053c688-c7ec-82f5-3fd5-000074927f60","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/free-tools/ransomware-intelligence/groups/gammax","pattern":"[url:value = 'https://socradar.io/free-tools/ransomware-intelligence/groups/gammax']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00bf3543-126f-dc66-0ee7-00007f451a9c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/booba-project","pattern":"[url:value = 'https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/booba-project']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef32addf-c503-3d0a-63e0-0000a1dda468","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1314b756-0368-e5a2-771e-00002d19fbbd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/94847/","pattern":"[url:value = 'https://asec.ahnlab.com/en/94847/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8e75b83-001c-4900-96d3-0000702413fb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/94685/","pattern":"[url:value = 'https://asec.ahnlab.com/en/94685/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0397edd-94ec-8e33-1cc2-00009f9e3f4d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://stealthmole-intelligence-hub.blogspot.com/2026/07/the-many-faces-of-modernstealer-tracing.html","pattern":"[url:value = 'https://stealthmole-intelligence-hub.blogspot.com/2026/07/the-many-faces-of-modernstealer-tracing.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--377e49da-36af-9164-5694-0000e26e5d08","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybersecuritynews.com/modernstealer-threat-actor/","pattern":"[url:value = 'https://cybersecuritynews.com/modernstealer-threat-actor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7402989-6aa3-cca3-a7f1-00002808bb3d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/blog/dark-web-profile-exfilsquad/","pattern":"[url:value = 'https://socradar.io/blog/dark-web-profile-exfilsquad/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d24c4b4c-b444-24b8-dd6d-0000e111aaad","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ransomfeed.it/index.php?page=post_details&id_post=34186","pattern":"[url:value = 'https://ransomfeed.it/index.php?page=post_details&id_post=34186']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9facdbff-c8f3-9019-bbbd-0000f74282cb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ransomfeed.it/index.php?page=post_details&id_post=34211","pattern":"[url:value = 'https://ransomfeed.it/index.php?page=post_details&id_post=34211']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad9ab97d-2001-c9cc-bd49-00008d82d1ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ransomfeed.it/index.php?page=post_details&id_post=34231","pattern":"[url:value = 'https://ransomfeed.it/index.php?page=post_details&id_post=34231']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--917753cd-47c2-a63b-2632-000032f6aa24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ransomfeed.it/index.php?page=post_details&id_post=34219","pattern":"[url:value = 'https://ransomfeed.it/index.php?page=post_details&id_post=34219']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b766f25-d724-da81-a956-000091f3629f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/94786/","pattern":"[url:value = 'https://asec.ahnlab.com/en/94786/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee36db1f-df2b-7a54-f8b1-00004e7a2840","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/free-tools/ransomware-intelligence/groups/orova","pattern":"[url:value = 'https://socradar.io/free-tools/ransomware-intelligence/groups/orova']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70575321-7f69-ad45-9d0f-0000a960a3c9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/microsoft-disrupts-fox-tempest-malware-signing-service","pattern":"[url:value = 'https://therecord.media/microsoft-disrupts-fox-tempest-malware-signing-service']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb22aa3a-8f45-a601-38ec-00005c0230a4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/","pattern":"[url:value = 'https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b8ccf0d-049a-b617-76a1-000054c2d25c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92f8609e-57cd-a02f-2570-0000d560c14f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socfortress.medium.com/jadepuffer-the-dawn-of-agentic-ransomware-operations-003a59848007","pattern":"[url:value = 'https://socfortress.medium.com/jadepuffer-the-dawn-of-agentic-ransomware-operations-003a59848007']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d55f89b-8db3-def0-deb6-0000c254dc1c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securereading.com/jadepuffer-ai-ransomware-autonomous-llm-attack/","pattern":"[url:value = 'https://securereading.com/jadepuffer-ai-ransomware-autonomous-llm-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c1f7269-91de-faba-2a3c-00002371a3ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://nsfocusglobal.com/ai-security-incident-jadepuffer-ransomware-leverages-ai-agent-to-automate-attacks/","pattern":"[url:value = 'https://nsfocusglobal.com/ai-security-incident-jadepuffer-ransomware-leverages-ai-agent-to-automate-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecd8f056-333b-74f5-ce4a-000000f3ac1b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://krypt3ia.wordpress.com/2026/07/13/threat-intelligence-report-jadepuffer-agentic-ransomware-and-automated-extortion/","pattern":"[url:value = 'https://krypt3ia.wordpress.com/2026/07/13/threat-intelligence-report-jadepuffer-agentic-ransomware-and-automated-extortion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d68e40e-5284-266c-7d0b-00008793b73b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html","pattern":"[url:value = 'https://thehackernews.com/2026/07/new-encforge-ransomware-targets-ai.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d99507ec-16bd-f243-787d-00009baa9dbf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","pattern":"[url:value = 'https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82b8a259-7848-5f19-9a58-0000ce90b5c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.polyswarm.io/multiple-threat-actors-leveraging-cve-2025-55182-react2shell","pattern":"[url:value = 'https://blog.polyswarm.io/multiple-threat-actors-leveraging-cve-2025-55182-react2shell']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cdd9945-b1a2-3ce7-f380-0000dac695c3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42f39c50-5d96-dc01-1b97-0000618a0dec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/","pattern":"[url:value = 'https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e3c4bea-1cd6-2565-6a50-00006ce1faaf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand","pattern":"[url:value = 'https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36bcfdf6-ece6-147e-8605-000026fa2aad","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-7810/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-7810/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4c5789b-d9c4-f6a0-903f-000009d8d7aa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/","pattern":"[url:value = 'https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--718c5446-c8e7-036c-63a1-0000bab8e3f6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2021/05/unc2529-triple-double-trifecta-phishing-campaign.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2021/05/unc2529-triple-double-trifecta-phishing-campaign.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a2664f4-dc2d-5c24-6fe2-00009527b566","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree","pattern":"[url:value = 'https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--874834ad-8162-9aeb-51eb-0000e6fbb14f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.levelblue.com/blogs/spiderlabs-blog/scattered-lapsuss-hunters-anatomy-of-a-federated-cybercriminal-brand","pattern":"[url:value = 'https://www.levelblue.com/blogs/spiderlabs-blog/scattered-lapsuss-hunters-anatomy-of-a-federated-cybercriminal-brand']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--335e96af-ddad-f804-dcf5-00008d9a0eaf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://falconfeeds.io/blogs/scattered-lapsus-hunters-slsh-threat-intelligence-2025/","pattern":"[url:value = 'https://falconfeeds.io/blogs/scattered-lapsus-hunters-slsh-threat-intelligence-2025/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c81a168d-49d1-c41c-5b4d-0000fc618118","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pushsecurity.com/blog/scattered-lapsus-hunters/","pattern":"[url:value = 'https://pushsecurity.com/blog/scattered-lapsus-hunters/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82a93d1c-656b-3944-4ce1-000024a84cca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/scattered-lapsus-hunters/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/scattered-lapsus-hunters/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cefcf13-589e-422c-47f7-000096c16cb3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/","pattern":"[url:value = 'https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb6df654-7b9d-11f3-f076-0000ee2698e7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://sosransomware.com/en/ransomware-groups/scattered-lapsus-hunters-the-cybercrime-alliance-that-will-shake-global-businesses-in-2025/","pattern":"[url:value = 'https://sosransomware.com/en/ransomware-groups/scattered-lapsus-hunters-the-cybercrime-alliance-that-will-shake-global-businesses-in-2025/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25dc3663-f5f3-e78b-990a-0000b89e3f78","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.picussecurity.com/resource/blog/scattered-lapsus-hunters-2025s-most-dangerous-cybercrime-supergroup","pattern":"[url:value = 'https://www.picussecurity.com/resource/blog/scattered-lapsus-hunters-2025s-most-dangerous-cybercrime-supergroup']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4e6e8fa-abe8-f166-677b-000093eb8df5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/","pattern":"[url:value = 'https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e554b499-8c51-2f24-bb57-0000ea1b3865","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.anomali.com/blog/anomali-cyber-watch-f5-breach-mysterious-elephant-apt-malicious-mcp-servers","pattern":"[url:value = 'https://www.anomali.com/blog/anomali-cyber-watch-f5-breach-mysterious-elephant-apt-malicious-mcp-servers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb478fc4-b495-3257-cbad-000036732b3e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/mysterious-elephant-apt-ttps-and-tools/117596/","pattern":"[url:value = 'https://securelist.com/mysterious-elephant-apt-ttps-and-tools/117596/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab25bc15-bd1f-0f34-b213-0000edef116d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.techrepublic.com/article/news-novo-nordisk-1-3tb-theft-25m-demand-emea/","pattern":"[url:value = 'https://www.techrepublic.com/article/news-novo-nordisk-1-3tb-theft-25m-demand-emea/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77806597-e076-3ee8-cae7-0000f918f76e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.bushidotoken.net/2026/06/uk-cybercrime-journal-arup-group.html","pattern":"[url:value = 'https://blog.bushidotoken.net/2026/06/uk-cybercrime-journal-arup-group.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--666ea948-4c3f-4750-0194-00005f30d24f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.resecurity.com/blog/article/cybercriminals-are-targeting-edtech-data-breaches-and-ransomware-attacks-on-the-rise","pattern":"[url:value = 'https://www.resecurity.com/blog/article/cybercriminals-are-targeting-edtech-data-breaches-and-ransomware-attacks-on-the-rise']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db804207-28cd-6341-66a7-0000decefd57","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/prc-targets-us-medical-research","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/prc-targets-us-medical-research']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53b524d7-6bcb-5692-dff8-00003653c0ed","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thecyberexpress.com/cyberattacks-on-jordan/","pattern":"[url:value = 'https://thecyberexpress.com/cyberattacks-on-jordan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--092c3594-6069-3012-3cbb-00009e85fbde","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a725e36-a7fc-d350-18da-00004ea3bccc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://teamt5.org/tw/posts/alert-exploitation-of-cve-2026-34197-in-apache-active-mq?utm_source=rss&tm_medium=rss","pattern":"[url:value = 'https://teamt5.org/tw/posts/alert-exploitation-of-cve-2026-34197-in-apache-active-mq?utm_source=rss&tm_medium=rss']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ffe6159-4f8e-ce9f-742d-0000b1f8d543","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/latin-america-and-the-caribbean-cybercrime-landscape","pattern":"[url:value = 'https://www.recordedfuture.com/research/latin-america-and-the-caribbean-cybercrime-landscape']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f555baa-25e1-2c1b-0abf-000062d7bcc3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://intelinsights.substack.com/p/profiling-hacktivist-groupsalliances","pattern":"[url:value = 'https://intelinsights.substack.com/p/profiling-hacktivist-groupsalliances']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11a47040-bbed-6062-128f-00007a68d678","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://outpost24.com/blog/hacktivist-cyber-operations-iran-israel/","pattern":"[url:value = 'https://outpost24.com/blog/hacktivist-cyber-operations-iran-israel/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e845407a-59b8-10af-7451-00005bdf52da","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thehackernews.com/2025/06/us-agencies-warn-of-rising-iranian.html","pattern":"[url:value = 'https://thehackernews.com/2025/06/us-agencies-warn-of-rising-iranian.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--164b62cf-9869-fb98-7e80-0000f05b96b9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: sundhed.dk","pattern":"[domain-name:value = 'sundhed.dk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ec5b987-2406-eae8-696b-0000ce056b7b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/26/e/banana-rat.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/26/e/banana-rat.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97b09cb4-0089-4451-0951-000020b4656f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.f6.ru/blog/narketing163/?utm_referrer=https%3A//www.f6.ru/blog/narketing163/","pattern":"[url:value = 'https://www.f6.ru/blog/narketing163/?utm_referrer=https%3A//www.f6.ru/blog/narketing163/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e5cd83c-7624-d2ea-5022-0000f23b0bdc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aaa59bc-73cf-6ceb-c095-00006548ee6b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://hacknotice.com/2026/03/16/hualun-new-materials-suffers-massive-data-breach-by-snowsoul/","pattern":"[url:value = 'https://hacknotice.com/2026/03/16/hualun-new-materials-suffers-massive-data-breach-by-snowsoul/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef48cab9-4c14-1f42-aaf3-000077eb76b8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dailydarkweb.net/guangdong-caiding-market-group-faces-data-breach-after-extortion/","pattern":"[url:value = 'https://dailydarkweb.net/guangdong-caiding-market-group-faces-data-breach-after-extortion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b08a5985-f24a-b2f1-4794-0000759c1056","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dailydarkweb.net/snowsoul-attack-hits-multiple-chinese-organizations/","pattern":"[url:value = 'https://dailydarkweb.net/snowsoul-attack-hits-multiple-chinese-organizations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c62846e1-3027-c19e-6111-0000cfc0bf86","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/windows-backdoor-for-novel-c2-communication/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/windows-backdoor-for-novel-c2-communication/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0538276-bd72-557f-51d2-00005fddab6b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.qualys.com/qualys-insights/2026/06/02/hazybeacon-aws-lambda-function-url-command-control-abuse","pattern":"[url:value = 'https://blog.qualys.com/qualys-insights/2026/06/02/hazybeacon-aws-lambda-function-url-command-control-abuse']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a3e03af-123d-b3fd-5f95-0000cc1e11c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://labs.withsecure.com/publications/greyvibe","pattern":"[url:value = 'https://labs.withsecure.com/publications/greyvibe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b2dff75-f9ed-aacf-6ac8-000070b74e29","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://hackernoon.com/zeffsec-resurfaces-on-telegram-claims-breach-of-gozine2ir","pattern":"[url:value = 'https://hackernoon.com/zeffsec-resurfaces-on-telegram-claims-breach-of-gozine2ir']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b5d2206-f7c4-a99d-dbad-00004293525e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/cl-unk-1068-targets-critical-sectors/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/cl-unk-1068-targets-critical-sectors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d052d23-3d0e-c6a2-da08-00009e3d130a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.wiz.io/blog/threat-actors-target-crypto-orgs","pattern":"[url:value = 'https://www.wiz.io/blog/threat-actors-target-crypto-orgs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7860de4a-e6d5-4b81-7fc6-0000db72c409","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/ghost-stadium-football-fraud/","pattern":"[url:value = 'https://www.group-ib.com/blog/ghost-stadium-football-fraud/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec174f24-38f0-4681-b7f4-00003f007d73","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://trojan-killer.net/drivesurge-clickfix-fake-browser-updates/","pattern":"[url:value = 'https://trojan-killer.net/drivesurge-clickfix-fake-browser-updates/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f13fd13-bcc2-e2b6-761c-0000cfba8636","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json","pattern":"[url:value = 'https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea4d15b2-8e01-7dc4-26ba-00000d74b403","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2026/03/12/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2026/03/12/storm-2561-uses-seo-poisoning-to-distribute-fake-vpn-clients-for-credential-theft/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fe260df-1e5b-f045-7fc5-0000595adfdf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://darkwebinformer.com/polish-eco-friendly-retailer-vegehome-suffers-data-breach-exposing-100k-customers/","pattern":"[url:value = 'https://darkwebinformer.com/polish-eco-friendly-retailer-vegehome-suffers-data-breach-exposing-100k-customers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29824719-5935-2263-bd7d-00005b0fe6b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://darkwebinformer.com/almaex-iranian-cryptocurrency-exchange-breach-allegedly-exposes-over-50-000-user-records/","pattern":"[url:value = 'https://darkwebinformer.com/almaex-iranian-cryptocurrency-exchange-breach-allegedly-exposes-over-50-000-user-records/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5d97c19-0781-ee64-1073-00009b04813e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://darkwebinformer.com/singapore-traditional-chinese-medicine-clinic-kin-teck-tong-allegedly-suffers-data-breach-exposing-150-000-patient-records/","pattern":"[url:value = 'https://darkwebinformer.com/singapore-traditional-chinese-medicine-clinic-kin-teck-tong-allegedly-suffers-data-breach-exposing-150-000-patient-records/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43507e63-7dbc-be7b-2dd7-0000d6fa016a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: histories.Sample","pattern":"[domain-name:value = 'histories.Sample']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cef45627-4813-8a09-20ce-00009f45d9d2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ibm.com/think/x-force/slopoly-start-ai-enhanced-ransomware-attacks","pattern":"[url:value = 'https://www.ibm.com/think/x-force/slopoly-start-ai-enhanced-ransomware-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35e20815-8263-872a-57c5-000068462d5c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27e47d11-61ab-4e74-ff42-0000d464ad14","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.xlab.qianxin.com/mr_rot13-the-elusive-6-year-hacker-group-weaponizing-critical-cpanel-flaws-for-backdoor-deployment/","pattern":"[url:value = 'https://blog.xlab.qianxin.com/mr_rot13-the-elusive-6-year-hacker-group-weaponizing-critical-cpanel-flaws-for-backdoor-deployment/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89be3d12-b21e-734f-58ed-0000ade5e40c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/","pattern":"[url:value = 'https://news.sophos.com/en-us/2024/12/19/phishing-platform-rockstar-2fa-trips-and-flowerstorm-picks-up-the-pieces/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dc1a79a-24fd-8ef9-b2df-000009d7a0fd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f62265b9-9132-d4f9-58d7-0000f3135ec1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://darkwebinformer.com/alleged-breach-of-chiles-ley-del-lobby-platform-exposes-250gb-of-government-lobbying-records-spanning-2018-to-2026/","pattern":"[url:value = 'https://darkwebinformer.com/alleged-breach-of-chiles-ley-del-lobby-platform-exposes-250gb-of-government-lobbying-records-spanning-2018-to-2026/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cf09485-40d7-6500-4a34-0000bb1821db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://darkwebinformer.com/alleged-breach-of-chiles-servicio-civil-platform-exposes-110k-public-servant-records-with-full-names-and-user-ids/","pattern":"[url:value = 'https://darkwebinformer.com/alleged-breach-of-chiles-servicio-civil-platform-exposes-110k-public-servant-records-with-full-names-and-user-ids/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3e25ece-e926-7a90-f5da-0000057b0d89","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://redpiranha.net/news/threat-intelligence-report-april-21-april-27-2026","pattern":"[url:value = 'https://redpiranha.net/news/threat-intelligence-report-april-21-april-27-2026']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f057a85a-966d-f3c2-590f-0000068c1c8e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5019e593-5815-3ede-9e84-00004c41ec3e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-8302/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-8302/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b66f9394-9498-725e-8cf2-0000890df024","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sophos.com/en-us/blog/nickel-alley-strategy-fake-it-til-you-make-it","pattern":"[url:value = 'https://www.sophos.com/en-us/blog/nickel-alley-strategy-fake-it-til-you-make-it']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b03933b4-5e19-0a41-7b9b-00009d4ffeea","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/unc6692-social-engineering-custom-malware/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/unc6692-social-engineering-custom-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26817cc1-e5da-b25a-cc26-00007d2e3cb3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/","pattern":"[url:value = 'https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--455a424c-615e-831c-62f5-00002fe17fd8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: tasks.json","pattern":"[domain-name:value = 'tasks.json']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3db65ce-6470-b371-70d2-000066cc6ab9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://web-assets.esetstatic.com/wls/en/papers/white-papers/gopherwhisper-burrow-full-malware.pdf","pattern":"[url:value = 'https://web-assets.esetstatic.com/wls/en/papers/white-papers/gopherwhisper-burrow-full-malware.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65ccd75a-9a66-03ef-efcd-0000c9f633ee","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/26/a/shadow-aether-015-earth-preta-mitre.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/26/a/shadow-aether-015-earth-preta-mitre.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cba9116-4a97-c549-bb4b-0000af337be9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/new-lua-based-malware-lucidrook/","pattern":"[url:value = 'https://blog.talosintelligence.com/new-lua-based-malware-lucidrook/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--729dff01-bb42-fbe7-2462-0000e82e3d60","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.confiant.com/news/cashrewindo-investment-scam-unveiled","pattern":"[url:value = 'https://www.confiant.com/news/cashrewindo-investment-scam-unveiled']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--470e35f4-2608-7b3d-a3d8-000003327154","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/krybit-ransomware-victim-fraper-com/","pattern":"[url:value = 'https://www.redpacketsecurity.com/krybit-ransomware-victim-fraper-com/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1d248c1-0c6c-59be-823d-00003466cfcd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/krybit-ransomware-victim-hacked-0apt/","pattern":"[url:value = 'https://www.redpacketsecurity.com/krybit-ransomware-victim-hacked-0apt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08a8a929-25ee-5da0-8afe-0000642214b3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyberdaily.au/security/13464-exclusive-krybit-hackers-claim-breach-of-new-zealand-it-services-provider","pattern":"[url:value = 'https://www.cyberdaily.au/security/13464-exclusive-krybit-hackers-claim-breach-of-new-zealand-it-services-provider']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--113e6da3-57ee-774f-1c72-000054938862","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: fraper.com","pattern":"[domain-name:value = 'fraper.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d750a03-4687-cf1b-3dc9-00004f2e3a39","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: asesoriauriel.com","pattern":"[domain-name:value = 'asesoriauriel.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b04f1e15-9828-8cee-3bbb-0000dcb9475b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dataminr.com/resources/intel-brief/pro-iran-actor-ababil-of-minab-claims-cyberattack-on-la-metro/","pattern":"[url:value = 'https://www.dataminr.com/resources/intel-brief/pro-iran-actor-ababil-of-minab-claims-cyberattack-on-la-metro/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8be51f05-6559-cd1c-4441-0000ef879fa7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/graycharlie-hijacks-law-firm-sites-suspected-supply-chain-attack","pattern":"[url:value = 'https://www.recordedfuture.com/research/graycharlie-hijacks-law-firm-sites-suspected-supply-chain-attack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d062859e-6242-01be-f0d5-0000e6b3bcfe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://businessinsights.bitdefender.com/coinbase-cartel-ransomware-group-extortion-tactics","pattern":"[url:value = 'https://businessinsights.bitdefender.com/coinbase-cartel-ransomware-group-extortion-tactics']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--552e38ab-8d00-e64e-c816-0000ea12464e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybelangel.com/blog/ruskinet-hacktivism-apt-threats/","pattern":"[url:value = 'https://cybelangel.com/blog/ruskinet-hacktivism-apt-threats/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d883612e-e158-9745-01bc-0000cef2a6e0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6288047","pattern":"[url:value = 'https://cert.gov.ua/article/6288047']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f4bf2c0-8264-3bd1-0a6f-0000a25dc8a6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/uac-0255-distributing-agewheeze-rat/","pattern":"[url:value = 'https://socprime.com/blog/uac-0255-distributing-agewheeze-rat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5303b0c7-0ed6-46f1-9bc7-00001d5a3a3a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://bi.zone/eng/expertise/blog/arcane-werewolf-vernulsya-s-obnovlennym-implantom-loki/","pattern":"[url:value = 'https://bi.zone/eng/expertise/blog/arcane-werewolf-vernulsya-s-obnovlennym-implantom-loki/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--484e0dc0-634f-0d14-cc51-00004113c17c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-10608-inside-a-large-scale-automated-credential-harvesting-operation-targeting-web-applications/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-10608-inside-a-large-scale-automated-credential-harvesting-operation-targeting-web-applications/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd254216-5e6a-7963-f576-000065966361","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.f6.ru/blog/bearlyfy/","pattern":"[url:value = 'https://www.f6.ru/blog/bearlyfy/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1df6489-d6c9-011f-b7ae-00000d6f04b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/ransomware-ukraine-russia-bearlyfy","pattern":"[url:value = 'https://therecord.media/ransomware-ukraine-russia-bearlyfy']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa6ac038-0a38-d88e-4978-0000b893ae24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/92988/","pattern":"[url:value = 'https://asec.ahnlab.com/en/92988/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b0d1188-07e7-1a81-4322-000036385030","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cstromblad.com/posts/threat-actor-profile-teampcp/","pattern":"[url:value = 'https://cstromblad.com/posts/threat-actor-profile-teampcp/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56f84049-5d7f-36a9-0296-0000c822c69c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware","pattern":"[url:value = 'https://flare.io/learn/resources/blog/teampcp-cloud-native-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb2f44ef-ccfb-a65c-4070-0000690c6590","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/en-us/adversaries/altered-spider/","pattern":"[url:value = 'https://www.crowdstrike.com/en-us/adversaries/altered-spider/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0690c07c-b130-76d9-33c1-000092689096","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://tracebit.com/blog/detecting-cicd-supply-chain-attacks-with-canary-credentials","pattern":"[url:value = 'https://tracebit.com/blog/detecting-cicd-supply-chain-attacks-with-canary-credentials']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--880796fb-c261-ffbe-eda7-0000f4986128","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/26/c/inside-litellm-supply-chain-compromise.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/26/c/inside-litellm-supply-chain-compromise.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8404309-8a78-1603-8d7d-0000562f23af","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/26/c/teampcp-telnyx-attack-marks-a-shift-in-tactics.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/26/c/teampcp-telnyx-attack-marks-a-shift-in-tactics.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72dab5b3-dbe0-428e-9d49-0000ccda64a2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east/","pattern":"[url:value = 'https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c97b134-58d4-0763-ca8d-000044a19180","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sophos.com/en-us/blog/hacktivist-campaigns-increase-as-united-states-iran-and-israel-conflict-intensifies","pattern":"[url:value = 'https://www.sophos.com/en-us/blog/hacktivist-campaigns-increase-as-united-states-iran-and-israel-conflict-intensifies']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6052e01-fc4c-9764-b0d9-00008ed9d2ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyfirma.com/research/firewalls-and-frontlines-the-india-pakistan-cyber-battlefield-crisis/","pattern":"[url:value = 'https://www.cyfirma.com/research/firewalls-and-frontlines-the-india-pakistan-cyber-battlefield-crisis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5bd5f9c-a658-63a4-f394-0000888c8a55","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.netscout.com/blog/asert/keymous-threat-actor-profile","pattern":"[url:value = 'https://www.netscout.com/blog/asert/keymous-threat-actor-profile']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b03dc8e4-e03f-44ef-dc6b-000001d62c35","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.radware.com/security/threat-advisories-and-attack-reports/ddos-activity-following-operation-epic-fury-roaring-lion/","pattern":"[url:value = 'https://www.radware.com/security/threat-advisories-and-attack-reports/ddos-activity-following-operation-epic-fury-roaring-lion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b07b5b8-a031-f71f-2c12-000038ed2543","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rapid7.com/blog/post/tr-iran-cyber-playbook-escalating-regional-conflict/","pattern":"[url:value = 'https://www.rapid7.com/blog/post/tr-iran-cyber-playbook-escalating-regional-conflict/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e54c51f-1bfa-b961-b194-00003987170b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securitybrief.com.au/story/fake-captcha-scam-targets-2-353-wordpress-sites-warns-cybercx","pattern":"[url:value = 'https://securitybrief.com.au/story/fake-captcha-scam-targets-2-353-wordpress-sites-warns-cybercx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f15323bd-6af7-aaab-f113-0000753b5f33","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/threats-to-defense-industrial-base","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/threats-to-defense-industrial-base']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--349c8e1d-29d1-5f7b-7b9b-0000bc311f13","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.picussecurity.com/resource/blog/how-noname05716-uses-ddosia-to-attack-nato-targets","pattern":"[url:value = 'https://www.picussecurity.com/resource/blog/how-noname05716-uses-ddosia-to-attack-nato-targets']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf9619a8-ef93-41fd-37d0-0000a171d6d0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.intel471.com/blog/winter-olympics-2026-hacktivism-surges-ahead-of-protests-and-suspected-sabotage","pattern":"[url:value = 'https://www.intel471.com/blog/winter-olympics-2026-hacktivism-surges-ahead-of-protests-and-suspected-sabotage']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--833247d2-d0f7-37d3-b827-00000d942c31","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/blog/telegram-activity-timeline-iran-israel-us-war/","pattern":"[url:value = 'https://socradar.io/blog/telegram-activity-timeline-iran-israel-us-war/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76bb6f65-e09f-7317-6c46-000004bc517f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/security/report/resources/cloud-threat-horizons-report-h1-2026","pattern":"[url:value = 'https://cloud.google.com/security/report/resources/cloud-threat-horizons-report-h1-2026']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ec552bc-4260-0be8-a9ff-00005bb14b5d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://origin-unit42.paloaltonetworks.com/espionage-campaign-against-military-targets/","pattern":"[url:value = 'https://origin-unit42.paloaltonetworks.com/espionage-campaign-against-military-targets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b92e46a8-27ec-b357-d33a-000059e8ac83","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://attack.mitre.org/groups/G1052/","pattern":"[url:value = 'https://attack.mitre.org/groups/G1052/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b46f8557-3cc9-25fa-749c-0000067c6de8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3266330b-ac17-d0e2-27b6-0000a8990b20","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/","pattern":"[url:value = 'https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6d39f16-8aa3-b518-50aa-000005de8f01","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://botcrawl.com/nippon-medical-school-musashi-kosugi-hospital-data-breach-claimed-by-netrunnerpr/","pattern":"[url:value = 'https://botcrawl.com/nippon-medical-school-musashi-kosugi-hospital-data-breach-claimed-by-netrunnerpr/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61865056-015e-a4e9-8c32-000022276c8c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/gtfire-phishing-scheme/","pattern":"[url:value = 'https://www.group-ib.com/blog/gtfire-phishing-scheme/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8496a41c-fcb5-e46d-076e-0000324d50a2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-9244/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-9244/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1056b5dd-a64d-6089-9f4f-0000236e6590","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: bloopencil.net","pattern":"[domain-name:value = 'bloopencil.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba827cbf-b070-0dfd-82a7-0000ba4828cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-8616-sd-wan/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-8616-sd-wan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c22ab7ee-220e-2bc9-8d7d-00002735496f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/k/lumma-stealer-browser-fingerprinting.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/k/lumma-stealer-browser-fingerprinting.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d51b22e-902f-9347-92a4-00000c3a8351","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/j/the-impact-of-water-kurita-lumma-stealer-doxxing.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/j/the-impact-of-water-kurita-lumma-stealer-doxxing.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2ab5838-6fd2-2a71-bfbb-0000ed685c78","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/g/lumma-stealer-returns.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/g/lumma-stealer-returns.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9de6666-da89-cc20-3180-0000eae0c127","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/c/ai-assisted-fake-github-repositories.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/c/ai-assisted-fake-github-repositories.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a99c5486-2ddc-7b47-f82e-000036a0650a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations","pattern":"[url:value = 'https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fecebe03-128e-9cc4-23a5-0000f0aa9788","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries","pattern":"[url:value = 'https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3ff50c6-e445-fe41-bcff-0000f6ed1d46","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://nsfocusglobal.com/top-security-incidents-of-2025-the-emergence-of-the-chainedshark-apt-group/","pattern":"[url:value = 'https://nsfocusglobal.com/top-security-incidents-of-2025-the-emergence-of-the-chainedshark-apt-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e02ed9d5-b8a2-bc90-64a5-0000f318c10c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17504d54-d4db-9ff0-69ee-0000b17fa369","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sprocketsecurity.com/blog/tracing-a-threat-actors-footprints-on-tor","pattern":"[url:value = 'https://www.sprocketsecurity.com/blog/tracing-a-threat-actors-footprints-on-tor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73bd5022-f5ac-ca61-468c-0000c0d44536","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cybereason.com/blog/the-gentlemen-ransomware","pattern":"[url:value = 'https://www.cybereason.com/blog/the-gentlemen-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81634fcd-0380-aaf6-49f4-0000ce5b2314","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7efa0115-f1c9-8859-b5df-0000aae80e08","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/blog/dark-web-profile-the-gentlemen-ransomware/","pattern":"[url:value = 'https://socradar.io/blog/dark-web-profile-the-gentlemen-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9f4e76d-8124-c573-e828-00001f964e3a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit?linkId=59478481","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit?linkId=59478481']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--baa5dc20-ab06-2f9c-d098-0000470ade80","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://isovalent.com/blog/post/voidlink-cloud-malware-detection/","pattern":"[url:value = 'https://isovalent.com/blog/post/voidlink-cloud-malware-detection/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36380ea4-d0b6-58f3-ad13-00009c862534","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/voidlink/","pattern":"[url:value = 'https://blog.talosintelligence.com/voidlink/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6cc00f9-567e-bbb0-b3bd-0000dcb183bc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/new-windows-based-malware-family-airstalk/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/new-windows-based-malware-family-airstalk/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30fb949f-7016-ff32-5c2f-00003d7bded9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.koi.ai/blog/whitecobra-vscode-cursor-extensions-malware","pattern":"[url:value = 'https://www.koi.ai/blog/whitecobra-vscode-cursor-extensions-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f398f6d-a334-dc9f-5922-00005767115e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-slopads-covers-fraud-with-layers-of-obfuscation/","pattern":"[url:value = 'https://www.humansecurity.com/learn/blog/satori-threat-intelligence-alert-slopads-covers-fraud-with-layers-of-obfuscation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cbcf9ff-991d-cfd5-dc29-00004d47d41c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/italian-university-la-sapienza-goes-offline-after-cyberattack/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/italian-university-la-sapienza-goes-offline-after-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1786b65a-f9ca-242f-b60e-00002319c1f4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/access-granted-phishing-device-code-authorization-account-takeover']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--552699c5-8ea0-61b5-574e-0000119ca5fe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://flare.io/learn/resources/blog/paytool-targets-canadians-traffic-scams","pattern":"[url:value = 'https://flare.io/learn/resources/blog/paytool-targets-canadians-traffic-scams']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4886bea4-b355-330c-92c9-0000549a1579","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cloudsek.com/blog/pivoting-from-paytool-tracking-various-frauds-and-e-crime-targeting-canada","pattern":"[url:value = 'https://www.cloudsek.com/blog/pivoting-from-paytool-tracking-various-frauds-and-e-crime-targeting-canada']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4211ad62-3476-6962-9437-0000ce3cb8f4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://harfanglab.io/insidethelab/redkitten-ai-accelerated-campaign-targeting-iranian-protests/","pattern":"[url:value = 'https://harfanglab.io/insidethelab/redkitten-ai-accelerated-campaign-targeting-iranian-protests/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5152a0db-0f4d-d77f-83af-00005ec8131f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/shadow-campaigns-uncovering-global-espionage/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/shadow-campaigns-uncovering-global-espionage/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c0613e7-0576-eddc-c75d-0000d0576760","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/","pattern":"[url:value = 'https://ics-cert.kaspersky.com/publications/reports/2025/12/01/apt-and-financial-attacks-on-industrial-organizations-in-q3-2025/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df04d285-7a6e-6dac-2d48-0000a7ebff9e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet","pattern":"[url:value = 'https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08412e54-f5b2-f089-6ca2-0000951fbbe0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/l/SHADOW-VOID-042.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/l/SHADOW-VOID-042.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1171b31-c9a7-47ac-b05d-0000fb3a84f5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6286219","pattern":"[url:value = 'https://cert.gov.ua/article/6286219']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e794f48-7750-6fe6-bcf7-0000d4c7039a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/drat-v2-updated-drat-emerges-tag-140s-arsenal","pattern":"[url:value = 'https://www.recordedfuture.com/research/drat-v2-updated-drat-emerges-tag-140s-arsenal']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--313e304c-409e-6f8b-d8a2-000093d11a63","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50027465-a1d5-fa73-2eff-00001f3791eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.checkpoint.com/research/amaranth-dragon-targeted-cyber-espionage-campaigns-across-southeast-asia/","pattern":"[url:value = 'https://blog.checkpoint.com/research/amaranth-dragon-targeted-cyber-espionage-campaigns-across-southeast-asia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77f4ad1e-bfa7-3369-8321-000043b73f02","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://rewterz.com/threat-advisory/apt-ung0002-expands-cyber-espionage-campaigns-across-asia-active-iocs","pattern":"[url:value = 'https://rewterz.com/threat-advisory/apt-ung0002-expands-cyber-espionage-campaigns-across-asia-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5c423ff-5767-dacc-0612-0000684e005e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.seqrite.com/blog/ung0002-espionage-campaigns-south-asia/","pattern":"[url:value = 'https://www.seqrite.com/blog/ung0002-espionage-campaigns-south-asia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--932b87f9-3da2-6d0b-f6ff-0000961dfaae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/sedgwick-cyber-incident-ransomware","pattern":"[url:value = 'https://therecord.media/sedgwick-cyber-incident-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd89674f-d5c0-3a85-6b3d-00003168490a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fddda59b-1868-9b97-b7fb-00002e22f487","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/digium-phones-web-shell/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/digium-phones-web-shell/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1634513-1b8f-d042-4e0b-0000b3a3d394","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2020/inj3ctor3-operation-leveraging-asterisk-servers-for-monetization/","pattern":"[url:value = 'https://research.checkpoint.com/2020/inj3ctor3-operation-leveraging-asterisk-servers-for-monetization/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1aeffcd-12b0-df65-4ebc-0000cf4b33c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/bladedfeline-whispering-dark/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/bladedfeline-whispering-dark/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58ff93ae-b355-0d39-dc0f-000050fe03c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://catalyst.prodaft.com/public/report/lucid/overview#paragraph-1055|388","pattern":"[url:value = 'https://catalyst.prodaft.com/public/report/lucid/overview#paragraph-1055|388']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bfd98ef-9085-ade6-146c-00002c5c5cfb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sgdsn.gouv.fr/publications/analyse-du-mode-operatoire-informationnel-russe-storm-1516","pattern":"[url:value = 'https://www.sgdsn.gouv.fr/publications/analyse-du-mode-operatoire-informationnel-russe-storm-1516']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f48e3742-0025-16f0-6803-00001d6f12e7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.defense.gouv.fr/actualites/storm-1516-dessous-dune-operation-dinfluence-russe","pattern":"[url:value = 'https://www.defense.gouv.fr/actualites/storm-1516-dessous-dune-operation-dinfluence-russe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52911730-0dbc-178d-8a9f-000052968728","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections","pattern":"[url:value = 'https://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52e290fe-26c8-0e50-3ec7-000074691268","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections","pattern":"[url:value = 'https://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e161d27-6f10-7e87-ac3b-0000c2cccc88","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/copycop-deepens-its-playbook-with-new-websites-and-targets","pattern":"[url:value = 'https://www.recordedfuture.com/research/copycop-deepens-its-playbook-with-new-websites-and-targets']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deccf327-8103-890b-9f52-0000643729f0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d04927e2-4843-9b35-3527-00008bd50ae1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-6382-exploits-cityworks-vulnerability/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-6382-exploits-cityworks-vulnerability/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--132a7451-814c-cefa-c0f3-000009e0741e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit","pattern":"[url:value = 'https://www.lookout.com/threat-intelligence/article/cryptochameleon-fcc-phishing-kit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdb4f70d-7692-f2e7-de38-00006b5fd6af","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://any.run/cybersecurity-blog/salty2fa-tycoon2fa-hybrid-phishing-2025/","pattern":"[url:value = 'https://any.run/cybersecurity-blog/salty2fa-tycoon2fa-hybrid-phishing-2025/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e0b0e8e-4b62-d269-adf2-0000168c87ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.kelacyber.com/blog/bytetobreach-a-deep-dive-into-a-persistent-data-leak-operator/","pattern":"[url:value = 'https://www.kelacyber.com/blog/bytetobreach-a-deep-dive-into-a-persistent-data-leak-operator/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6a75f1b-7a07-1c86-d3e7-000091947e49","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-8099-chinese-speaking-cybercrime-group-seo-fraud/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-8099-chinese-speaking-cybercrime-group-seo-fraud/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e082a0-c47f-15d7-da66-000084b1001b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-8099-new-persistence-mechanisms-and-regional-focus/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-8099-new-persistence-mechanisms-and-regional-focus/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--011dc54d-1507-eb37-8d35-000059bf14ee","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/taxoff-um-you-ve-got-a-backdoor/","pattern":"[url:value = 'https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/taxoff-um-you-ve-got-a-backdoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc93401c-7e0f-78b2-d0a2-0000783592fd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/team46-and-taxoff-two-sides-of-the-same-coin","pattern":"[url:value = 'https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/team46-and-taxoff-two-sides-of-the-same-coin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--714b74ac-0d15-a989-dbff-0000dc0354ca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: global.ssl.fastly.net","pattern":"[domain-name:value = 'global.ssl.fastly.net']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31940e16-f93a-5da1-44a0-0000853ce08e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.sekoia.io/vicioustrap-infiltrate-control-lure-turning-edge-devices-into-honeypots-en-masse/","pattern":"[url:value = 'https://blog.sekoia.io/vicioustrap-infiltrate-control-lure-turning-edge-devices-into-honeypots-en-masse/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f37f9aed-53a5-a727-4857-00001e580893","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/dark-pink-episode-2/","pattern":"[url:value = 'https://www.group-ib.com/blog/dark-pink-episode-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e1a50f4-3493-1253-3653-000001623ab2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/dark-pink-apt/","pattern":"[url:value = 'https://www.group-ib.com/blog/dark-pink-apt/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--627e07f7-d4b9-354b-b693-0000bc01ea65","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyfirma.com/news/weekly-intelligence-report-12-december-2025/#:~:text=well%2Dstructured%20operations.-","pattern":"[url:value = 'https://www.cyfirma.com/news/weekly-intelligence-report-12-december-2025/#:~:text=well%2Dstructured%20operations.-']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34c49fb5-0385-92b0-37ef-00005d33e91d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.esentire.com/blog/threat-actors-deploy-sinobi-ransomware-via-compromised-sonicwall-ssl-vpn-credentials","pattern":"[url:value = 'https://www.esentire.com/blog/threat-actors-deploy-sinobi-ransomware-via-compromised-sonicwall-ssl-vpn-credentials']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93779301-2e7d-2608-8cc9-000061b9124c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.linkedin.com/feed/update/urn:li:activity:7401414126620884992/","pattern":"[url:value = 'https://www.linkedin.com/feed/update/urn:li:activity:7401414126620884992/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b59f0cbd-29c2-1e8b-25cb-0000f5f5e981","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/cant-stop-wont-stop-ta584-innovates-initial-access","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/cant-stop-wont-stop-ta584-innovates-initial-access']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9c562a5-bb01-ccb1-f032-00009700e5f6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fortra.com/resources/guides/scripted-sparrow-prolific-bec-threat-group","pattern":"[url:value = 'https://www.fortra.com/resources/guides/scripted-sparrow-prolific-bec-threat-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72a587c0-f4ff-22a2-7b43-0000b7a78a77","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.helpnetsecurity.com/2025/12/18/tracking-scripted-sparrow-phishing-campaigns/","pattern":"[url:value = 'https://www.helpnetsecurity.com/2025/12/18/tracking-scripted-sparrow-phishing-campaigns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67c9ef17-104e-f38c-6dfd-0000d641650b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.seqrite.com/blog/operation-cargotalon-ung0901-targets-russian-aerospace-defense-sector-using-eaglet-implant/","pattern":"[url:value = 'https://www.seqrite.com/blog/operation-cargotalon-ung0901-targets-russian-aerospace-defense-sector-using-eaglet-implant/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eacba9ef-b5d9-e948-bcd7-000025bbce41","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.koi.ai/blog/greedybear-650-attack-tools-one-coordinated-campaign","pattern":"[url:value = 'https://www.koi.ai/blog/greedybear-650-attack-tools-one-coordinated-campaign']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a0137c1-6d3f-a8d9-daa5-0000831b2971","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://redcanary.com/blog/threat-intelligence/mocha-manakin-nodejs-backdoor/","pattern":"[url:value = 'https://redcanary.com/blog/threat-intelligence/mocha-manakin-nodejs-backdoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04f4bfd0-04cf-b103-e6ce-0000a072f4e8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f599ccf2-4d98-b6cd-3e76-0000acaa5147","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-7237-targets-web-hosting-infra/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-7237-targets-web-hosting-infra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22486c24-3e72-814f-dc9c-00007a7d46b9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67a816d9-b63e-eeca-3423-0000b2bbd57b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--497330d0-dcb9-886b-72a2-00006fb566a2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.spixnet.com/cybersecurity-blog/2023/04/03/newly-exposed-apt43-hacking-group-targeting-us-orgs-since-2018/","pattern":"[url:value = 'https://www.spixnet.com/cybersecurity-blog/2023/04/03/newly-exposed-apt43-hacking-group-targeting-us-orgs-since-2018/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66ecb137-4af7-cf3a-93b5-000081308777","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://botcrawl.com/saudi-icon-data-breach/","pattern":"[url:value = 'https://botcrawl.com/saudi-icon-data-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cbf7b02-6cb6-e7f7-c2b9-000060e79fdc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://databreaches.net/2025/11/18/from-bad-to-worse-doctor-alliance-hacked-again-by-same-threat-actor/","pattern":"[url:value = 'https://databreaches.net/2025/11/18/from-bad-to-worse-doctor-alliance-hacked-again-by-same-threat-actor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56760dd3-45a1-a190-6fc9-0000777164d5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.hipaajournal.com/doctor-alliance-data-breach-claim/","pattern":"[url:value = 'https://www.hipaajournal.com/doctor-alliance-data-breach-claim/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0de2e1e9-efd1-78c3-0386-00005b24ef75","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://botcrawl.com/national-civil-service-commission-of-colombia-data-breach/","pattern":"[url:value = 'https://botcrawl.com/national-civil-service-commission-of-colombia-data-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97e307c5-d10e-04e1-8234-000015503497","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyfirma.com/research/cyber-threat-landscape-report-united-arab-emirates-uae/","pattern":"[url:value = 'https://www.cyfirma.com/research/cyber-threat-landscape-report-united-arab-emirates-uae/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c978cffa-9cf4-cb9b-773d-00005e9981ee","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cip.gov.ua/en/news/zlovmisniki-atakuyut-sili-oboroni-ukrayini-ta-organi-miscevogo-samovryaduvannya-vikoristovuyuchi-temu-protidiyi-rosiiskim-drg","pattern":"[url:value = 'https://cip.gov.ua/en/news/zlovmisniki-atakuyut-sili-oboroni-ukrayini-ta-organi-miscevogo-samovryaduvannya-vikoristovuyuchi-temu-protidiyi-rosiiskim-drg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f829288e-7e3e-ed58-6881-00000032451a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-8837/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-8837/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6386ccc-ab6c-181f-5f59-00008d89b669","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/i/how-ransomhub-ransomware-uses-edrkillshifter-to-disable-edr-and-.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/i/how-ransomhub-ransomware-uses-edrkillshifter-to-disable-edr-and-.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48d201cd-2e38-91f9-5acf-00001cc7c24c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.aryaka.com/blog/batshade-vampire-bot-social-engineering-malware/","pattern":"[url:value = 'https://www.aryaka.com/blog/batshade-vampire-bot-social-engineering-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b7e8540-e5d2-c078-638d-0000b777084b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: samsung-work.com","pattern":"[domain-name:value = 'samsung-work.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80e46087-8c33-5567-da14-0000d29605ed","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.volexity.com/blog/2025/10/08/apt-meets-gpt-targeted-operations-with-untamed-llms/","pattern":"[url:value = 'https://www.volexity.com/blog/2025/10/08/apt-meets-gpt-targeted-operations-with-untamed-llms/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--766b813f-a233-4b57-d20c-000023b9f6af","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.com/183222/apt/ukraine-sees-surge-in-ai-powered-cyberattacks-by-russia-linked-threat-actors.html","pattern":"[url:value = 'https://securityaffairs.com/183222/apt/ukraine-sees-surge-in-ai-powered-cyberattacks-by-russia-linked-threat-actors.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d197a7ec-15a1-b4df-a38e-0000dba34072","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cip.gov.ua/ua/news/novi-kiberzagrozi-kogo-i-yak-atakuyut-vorozhi-ugrupovannya","pattern":"[url:value = 'https://cip.gov.ua/ua/news/novi-kiberzagrozi-kogo-i-yak-atakuyut-vorozhi-ugrupovannya']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af5a3a77-792b-8545-8245-00000bdf5d47","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/ghostredirector-poisons-windows-servers-backdoors-side-potatoes/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/ghostredirector-poisons-windows-servers-backdoors-side-potatoes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceb9b1eb-1b21-8bb3-e0c6-00001ea2eef0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2025/10/09/investigating-targeted-payroll-pirate-attacks-affecting-us-universities/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2025/10/09/investigating-targeted-payroll-pirate-attacks-affecting-us-universities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b15de1f6-9851-dcf2-1dcb-00001780a599","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.silentpush.com/blog/poisonseed/","pattern":"[url:value = 'https://www.silentpush.com/blog/poisonseed/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77b63955-db44-faf2-ff3f-0000b2873281","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.nviso.eu/2025/08/12/shedding-light-on-poisonseeds-phishing-kit/","pattern":"[url:value = 'https://blog.nviso.eu/2025/08/12/shedding-light-on-poisonseeds-phishing-kit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94f99e29-03c5-3185-fc09-0000e849d579","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sophos.com/fr-fr/blog/doubled-dll-sideloading-dragon-breath","pattern":"[url:value = 'https://www.sophos.com/fr-fr/blog/doubled-dll-sideloading-dragon-breath']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--205ad2a5-f1ee-d0c6-6005-00001375c572","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/blog/ai-powered-gtg-1002-campaign/","pattern":"[url:value = 'https://socradar.io/blog/ai-powered-gtg-1002-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6c5e5af-b448-9b25-09d4-0000ee556e83","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybershafarat.com/2025/01/22/darkgaboon-targets-russian-finserv/","pattern":"[url:value = 'https://cybershafarat.com/2025/01/22/darkgaboon-targets-russian-finserv/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45e4102d-781a-4d31-078b-00002946a468","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/new-hacker-group-lockbit-target-russia","pattern":"[url:value = 'https://therecord.media/new-hacker-group-lockbit-target-russia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c2a311c-6122-ea71-0ca5-0000fcacd152","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/92183/","pattern":"[url:value = 'https://asec.ahnlab.com/en/92183/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dde7fcfd-ae77-1f36-476a-0000cf0d7c9a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/podcasts/eset-apt-activity-report-q4-2024q1-2025-malware-sharing-wipers-exploits/","pattern":"[url:value = 'https://www.welivesecurity.com/en/podcasts/eset-apt-activity-report-q4-2024q1-2025-malware-sharing-wipers-exploits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edd3a4e1-efa9-74e9-fe04-000089e70557","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/","pattern":"[url:value = 'https://research.checkpoint.com/2023/educated-manticore-iran-aligned-threat-actor-targeting-israel-via-improved-arsenal-of-tools/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf8fd87a-7728-41da-ea79-000099f67941","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.checkpoint.com/security/check-point-research-uncovers-rare-techniques-used-by-iranian-affiliated-threat-actor-targeting-israeli-entities/","pattern":"[url:value = 'https://blog.checkpoint.com/security/check-point-research-uncovers-rare-techniques-used-by-iranian-affiliated-threat-actor-targeting-israeli-entities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94f72d53-8d76-1371-8020-0000997fe883","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2025/iranian-educated-manticore-targets-leading-tech-academics","pattern":"[url:value = 'https://research.checkpoint.com/2025/iranian-educated-manticore-targets-leading-tech-academics']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e619267-8412-1087-2c49-0000c02c21c3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.varonis.com/blog/salesforce-vishing-threat-unc604","pattern":"[url:value = 'https://www.varonis.com/blog/salesforce-vishing-threat-unc604']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9701ad30-0b30-2a1b-0a0e-0000bcb3529b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/technical-analysis-vishing-threats/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/technical-analysis-vishing-threats/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffbfcb45-d2f3-d8da-cb1c-0000f1f7aae2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30909a6c-89d1-7253-cb79-0000ce1a860e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0441218-65bf-47fa-0fe0-0000ef06428c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5c59b47-f951-785a-f5a4-0000f818bbe0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a11ada3-488c-2776-f7f9-00005e51448b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.jamf.com/blog/chillyhell-a-modular-macos-backdoor/","pattern":"[url:value = 'https://www.jamf.com/blog/chillyhell-a-modular-macos-backdoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d2f415f-5b17-ccd8-240e-0000d1256fa3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ebfcc92-5edd-7b60-d320-000036701f41","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66877cd6-7fc7-083b-1c1e-00008d242c33","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/l/water-saci.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/l/water-saci.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a46e1b02-6d54-737a-a8df-0000f4ce16a1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/j/active-water-saci-campaign-whatsapp-update.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/j/active-water-saci-campaign-whatsapp-update.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--556ddae5-f184-6d82-bf22-0000815e3047","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: terra.com.br","pattern":"[domain-name:value = 'terra.com.br']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6361da0-9381-5dfb-5638-00001dd8e1ad","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.koi.ai/blog/4-million-browsers-infected-inside-shadypanda-7-year-malware-campaign","pattern":"[url:value = 'https://www.koi.ai/blog/4-million-browsers-infected-inside-shadypanda-7-year-malware-campaign']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--913ff91d-7316-5fca-945f-0000939002d5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.koi.ai/blog/darkspectre-unmasking-the-threat-actor-behind-7-8-million-infected-browsers","pattern":"[url:value = 'https://www.koi.ai/blog/darkspectre-unmasking-the-threat-actor-behind-7-8-million-infected-browsers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30d8a8ad-0794-af4c-5241-0000cb00e7aa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-9686/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-9686/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17740ea2-3e9a-4890-fec2-0000e761541c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secpod.com/blog/zero-day-crisis-cve-2025-20393-unpatched-on-cisco-email-gateways-exploited-by-china-linked-hackers/","pattern":"[url:value = 'https://www.secpod.com/blog/zero-day-crisis-cve-2025-20393-unpatched-on-cisco-email-gateways-exploited-by-china-linked-hackers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--996377d5-912e-ab20-1575-0000cbf16d3f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://botcrawl.com/chinese-apt-longnosedgoblin-targets-government-networks-in-southeast-asia-and-japan/","pattern":"[url:value = 'https://botcrawl.com/chinese-apt-longnosedgoblin-targets-government-networks-in-southeast-asia-and-japan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed999c99-db8b-d72a-891d-0000529328ca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12599885-40b6-ba24-a156-0000b8a77595","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d304ca7-6041-dd5e-8922-000052543ed3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/91139/","pattern":"[url:value = 'https://asec.ahnlab.com/en/91139/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a88ccfc9-7825-2d8e-2e76-0000c264ec43","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://meterpreter.org/anssi-exposes-houken-china-linked-apt-exploiting-ivanti-csa-zero-days-deploying-linux-rootkits/","pattern":"[url:value = 'https://meterpreter.org/anssi-exposes-houken-china-linked-apt-exploiting-ivanti-csa-zero-days-deploying-linux-rootkits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf2e3f08-42a6-40c5-3b16-00007e6d335a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-009/","pattern":"[url:value = 'https://www.cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-009/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89af6117-7948-58aa-2f57-0000d790144d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-new-threat-actor-targeting-geopolitical-hotbeds","pattern":"[url:value = 'https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-new-threat-actor-targeting-geopolitical-hotbeds']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d41d4d3-6926-5966-678f-00009f36bf87","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-evasion-persistence-hidden-hyper-v-virtual-machines","pattern":"[url:value = 'https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-evasion-persistence-hidden-hyper-v-virtual-machines']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e52740da-0bcf-0dfa-9007-0000211b0fc3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures","pattern":"[url:value = 'https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81d498b2-2342-e05d-90d9-00000a8a798e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9c5dd2f-a498-d9b6-020b-000018ffc9b7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/thewizards-apt-group-slaac-spoofing-adversary-in-the-middle-attacks/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/thewizards-apt-group-slaac-spoofing-adversary-in-the-middle-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--380a9749-97f9-570f-f497-000055e8061a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.com/182866/data-breach/cybercrime-group-claims-to-have-breached-red-hat-s-private-github-repositories.html","pattern":"[url:value = 'https://securityaffairs.com/182866/data-breach/cybercrime-group-claims-to-have-breached-red-hat-s-private-github-repositories.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--feb0025e-68fc-ceff-1069-00006b0397e4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.techzine.eu/news/security/135120/red-hat-hit-by-github-breach-570gb-stolen-including-client-info/","pattern":"[url:value = 'https://www.techzine.eu/news/security/135120/red-hat-hit-by-github-breach-570gb-stolen-including-client-info/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--653d9d9b-e88d-4d85-4b54-000099b7aa9c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybersecuritynews.com/red-hat-data-breach/","pattern":"[url:value = 'https://cybersecuritynews.com/red-hat-data-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fcd4ec6-083b-306d-dac3-0000ea7b73b5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6a8f55e-f5db-5066-7ec9-0000239278f0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--926d3878-e88c-e5cb-8aec-00008a08ddca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybersecuritynews.com/nighteagle-apt-exploiting-0-days/","pattern":"[url:value = 'https://cybersecuritynews.com/nighteagle-apt-exploiting-0-days/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a5a11e3-5776-158f-9ca7-000087b5b0c7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thehackernews.com/2025/07/nighteagle-apt-exploits-microsoft.html","pattern":"[url:value = 'https://thehackernews.com/2025/07/nighteagle-apt-exploits-microsoft.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9f86673-01e1-9eba-a6ef-000022002551","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.authentic8.com/blog/cyber-intel-brief-nighteagle-apt-ai-deepfakes-spnego-flaw","pattern":"[url:value = 'https://www.authentic8.com/blog/cyber-intel-brief-nighteagle-apt-ai-deepfakes-spnego-flaw']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27ea613f-ca92-9e1e-d44a-0000e778b6a4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47e7d91d-695b-612e-57df-00008e1c7c47","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6286942","pattern":"[url:value = 'https://cert.gov.ua/article/6286942']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6e30acf-d815-922d-9ef1-0000ad69cf4d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.aivd.nl/actueel/nieuws/2025/05/27/onbekende-russische-groep-achter-hacks-nederlandse-doelen","pattern":"[url:value = 'https://www.aivd.nl/actueel/nieuws/2025/05/27/onbekende-russische-groep-achter-hacks-nederlandse-doelen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6596939-3761-eca2-96a3-00007944a2c9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c031489-ff65-51db-4211-0000ad35e312","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/","pattern":"[url:value = 'https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9733a12a-2eca-0275-7a97-0000c9606ab1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityintelligence.com/posts/hive00117-fileless-malware-delivery-eastern-europe/","pattern":"[url:value = 'https://securityintelligence.com/posts/hive00117-fileless-malware-delivery-eastern-europe/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e2ede51-90e4-42c8-70fb-00005a65e449","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.eclecticiq.com/from-callback-phishing-to-extortion-luna-moth-abuse-reamaze-helpdesk-and-rmm-tools-against-u.s.-legal-and-financial-sectors","pattern":"[url:value = 'https://blog.eclecticiq.com/from-callback-phishing-to-extortion-luna-moth-abuse-reamaze-helpdesk-and-rmm-tools-against-u.s.-legal-and-financial-sectors']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db426649-4f4a-bbd8-c009-000020481fa7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.malwarebytes.com/blog/social-engineering/2020/09/malvertising-campaigns-come-back-in-full-swing","pattern":"[url:value = 'https://www.malwarebytes.com/blog/social-engineering/2020/09/malvertising-campaigns-come-back-in-full-swing']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c788ea7-8cf4-f8f1-2ea7-0000d39f42cc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2020/11/malsmoke-operators-abandon-exploit-kits-in-favor-of-social-engineering-scheme/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2020/11/malsmoke-operators-abandon-exploit-kits-in-favor-of-social-engineering-scheme/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--067df7a9-3c8e-e8cb-9d0c-0000579659bc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.malwarebytes.com/blog/news/2025/04/fake-social-security-statement-emails-trick-users-into-installing-remote-tool","pattern":"[url:value = 'https://www.malwarebytes.com/blog/news/2025/04/fake-social-security-statement-emails-trick-users-into-installing-remote-tool']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d9787fb-0018-beb4-060d-00000e6669ed","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: gomolatori.cyou","pattern":"[domain-name:value = 'gomolatori.cyou']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60b1dda7-37b4-a46e-9212-0000a0b13663","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.trailofbits.com/2025/04/17/mitigating-elusive-comet-zoom-remote-control-attacks/","pattern":"[url:value = 'https://blog.trailofbits.com/2025/04/17/mitigating-elusive-comet-zoom-remote-control-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6199c8b-1379-a450-9147-0000a089dcaf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.forescout.com/blog/threat-analysis-sap-vulnerability-exploited-in-the-wild-by-chinese-threat-actor/","pattern":"[url:value = 'https://www.forescout.com/blog/threat-analysis-sap-vulnerability-exploited-in-the-wild-by-chinese-threat-actor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c20407f3-e82a-57b1-bfcc-00000bd8da3b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cip.gov.ua/en/news/cert-ua-poperedzhaye-pro-cilespryamovani-ataki-na-sili-oboroni-z-vikoristannyam-novogo-bekdoru-cabinetrat","pattern":"[url:value = 'https://cip.gov.ua/en/news/cert-ua-poperedzhaye-pro-cilespryamovani-ataki-na-sili-oboroni-z-vikoristannyam-novogo-bekdoru-cabinetrat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94bf4c51-56f9-e98c-841f-00009e1aafa9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/tag-124-multi-layered-tds-infrastructure-extensive-user-base","pattern":"[url:value = 'https://www.recordedfuture.com/research/tag-124-multi-layered-tds-infrastructure-extensive-user-base']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddb6f485-fff2-b5e3-9ed2-0000415aae18","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/uncovering-mintsloader-with-recorded-future-malware-intelligence-hunting","pattern":"[url:value = 'https://www.recordedfuture.com/research/uncovering-mintsloader-with-recorded-future-malware-intelligence-hunting']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--194aed43-4881-ae7a-55ce-0000fb735301","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2025/04/23/understanding-the-threat-landscape-for-kubernetes-and-containerized-assets/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2025/04/23/understanding-the-threat-landscape-for-kubernetes-and-containerized-assets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--411eb45e-e826-9d00-8b3e-0000e8f2108a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/russia-carmoney-data-breach-ukrainian-cyber-alliance","pattern":"[url:value = 'https://therecord.media/russia-carmoney-data-breach-ukrainian-cyber-alliance']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43daa313-2d2c-1d84-9714-0000093a8c24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybersecurity88.com/news/algerias-ministry-of-pharmaceutical-industry-data-leaked-in-retaliatory-cyberattack/","pattern":"[url:value = 'https://cybersecurity88.com/news/algerias-ministry-of-pharmaceutical-industry-data-leaked-in-retaliatory-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32f451ea-97de-c85d-c036-000049734afa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/d/earth-kurma-apt-campaign.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/d/earth-kurma-apt-campaign.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4e999bb-5a71-820f-8ee6-000044283f64","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.infoblox.com/threat-intelligence/uncovering-actor-ttp-patterns-and-the-role-of-dns-in-investment-scams/","pattern":"[url:value = 'https://blogs.infoblox.com/threat-intelligence/uncovering-actor-ttp-patterns-and-the-role-of-dns-in-investment-scams/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a42cc749-4d03-3d73-8c91-00003d5ede2f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ibm.com/think/x-force/strela-stealer-todays-invoice-tomorrows-phish","pattern":"[url:value = 'https://www.ibm.com/think/x-force/strela-stealer-todays-invoice-tomorrows-phish']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c5c15ed-4857-bc7e-09e6-00000024fdaa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/detect-uac-0226-attacks-against-ukraine/","pattern":"[url:value = 'https://socprime.com/blog/detect-uac-0226-attacks-against-ukraine/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfe88a53-f334-65ba-4c34-0000f531cf03","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6282946","pattern":"[url:value = 'https://cert.gov.ua/article/6282946']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a62f8dc-22a3-2150-b15e-00000f3ce201","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/tihanyin/PSSW100AVB)","pattern":"[url:value = 'https://github.com/tihanyin/PSSW100AVB)']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a44e4c40-a483-f41b-24cd-00004944a454","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://s2w.inc/en/resource/detail/581","pattern":"[url:value = 'https://s2w.inc/en/resource/detail/581']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7d27b8b-8d25-9e7f-7856-0000bd00a2cd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://trojan-killer.net/how-to-remove-lilith-rat-complete-removal-guide/","pattern":"[url:value = 'https://trojan-killer.net/how-to-remove-lilith-rat-complete-removal-guide/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--505d9935-d167-d172-05f8-0000638f7e9f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/","pattern":"[url:value = 'https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b599da2-dda7-a877-63f3-0000f8d2d12c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.wiz.io/blog/postgresql-cryptomining","pattern":"[url:value = 'https://www.wiz.io/blog/postgresql-cryptomining']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ca867a3-3742-95d7-ccbc-0000ddf97021","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/c/deep-dive-into-water-gamayun.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--306e1fec-176c-c2f8-d5d3-000033de2e9b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/c/the-espionage-toolkit-of-earth-alux.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/c/the-espionage-toolkit-of-earth-alux.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8796e6e5-1088-9104-8af4-00004a173579","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/operation-forumtroll/115989/","pattern":"[url:value = 'https://securelist.com/operation-forumtroll/115989/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fc12e13-fa89-1b16-e172-00000d72a3c2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/detect-uac-0219-attacks-against-ukrainian-state-bodies","pattern":"[url:value = 'https://socprime.com/blog/detect-uac-0219-attacks-against-ukrainian-state-bodies']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ace98b4e-21bd-96dc-722b-00008fd3fe94","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6282902","pattern":"[url:value = 'https://cert.gov.ua/article/6282902']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73c56806-461d-a01d-b8bf-0000b6d1eeff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.security.com/threat-intelligence/jewelbug-apt-russia","pattern":"[url:value = 'https://www.security.com/threat-intelligence/jewelbug-apt-russia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b70b4e91-44af-9840-a56e-0000f18f2cdd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.elastic.co/security-labs/fragile-web-ref7707","pattern":"[url:value = 'https://www.elastic.co/security-labs/fragile-web-ref7707']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f6662a5-f28b-3167-4c8c-0000d8df17e2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cac50a20-bf10-5fd6-c4e6-0000dddadd31","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybershafarat.com/2025/03/10/dienet-and-shiite_harvest-claimed-responsibility-for-disabling-ten-significant-iraqi-websites/","pattern":"[url:value = 'https://cybershafarat.com/2025/03/10/dienet-and-shiite_harvest-claimed-responsibility-for-disabling-ten-significant-iraqi-websites/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68499b00-ccc5-84d5-2dfd-000069c3ef23","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.seqrite.com/blog/operation-hollowquill-russian-rd-networks-malware-pdf/","pattern":"[url:value = 'https://www.seqrite.com/blog/operation-hollowquill-russian-rd-networks-malware-pdf/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99ef4a29-ffbe-4080-db59-0000f9c9603e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f31bd80-19b7-356f-b501-000015f68ebe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.resecurity.com/blog/article/cybercriminals-attacked-national-social-security-fund-of-morocco-millions-of-digital-identities-at-risk-of-data-breach","pattern":"[url:value = 'https://www.resecurity.com/blog/article/cybercriminals-attacked-national-social-security-fund-of-morocco-millions-of-digital-identities-at-risk-of-data-breach']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d73477-97f1-3a24-e5df-000006558f39","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-5918-targets-critical-infra-in-taiwan/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-5918-targets-critical-infra-in-taiwan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e73a28c-d17f-2584-40e3-0000496459a9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/goffee-apt-new-attacks/116139/","pattern":"[url:value = 'https://securelist.com/goffee-apt-new-attacks/116139/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ab1a362-a4a7-bd69-1f86-0000866936ba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2025/04/03/threat-actors-leverage-tax-season-to-deploy-tax-themed-phishing-campaigns/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2025/04/03/threat-actors-leverage-tax-season-to-deploy-tax-themed-phishing-campaigns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f24cdd9-2137-70c9-3f71-0000347906dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.seqrite.com/blog/swan-vector-apt-targeting-taiwan-japan-dll-implants/","pattern":"[url:value = 'https://www.seqrite.com/blog/swan-vector-apt-targeting-taiwan-japan-dll-implants/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--624630ad-e19c-d280-1b16-0000652f59a9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/fingerprint-heists/","pattern":"[url:value = 'https://www.group-ib.com/blog/fingerprint-heists/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab33746e-f39c-e3bd-2364-000042bc7ecb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyjax.com/resources/blog/new-extortion-ransomware-group-linkc-emerges-what-you-need-to-know/","pattern":"[url:value = 'https://www.cyjax.com/resources/blog/new-extortion-ransomware-group-linkc-emerges-what-you-need-to-know/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--281fcd10-7c2d-2b4e-15ef-00001b0c4200","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyfirma.com/research/tracking-ransomware-february-2025/","pattern":"[url:value = 'https://www.cyfirma.com/research/tracking-ransomware-february-2025/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd40ebbd-5e0d-bdfd-22ab-0000f2a64387","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redhotcyber.com/en/post/linkc-ransomware-the-new-cybercriminal-group-targeting-artificial-intelligence-data/#google_vignette","pattern":"[url:value = 'https://www.redhotcyber.com/en/post/linkc-ransomware-the-new-cybercriminal-group-targeting-artificial-intelligence-data/#google_vignette']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8af5927-bf04-0d4e-4b84-0000e4644d07","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/","pattern":"[url:value = 'https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dba9220-1754-22b9-6881-0000a4f8b139","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/@knownsec404team/love-and-hate-under-war-the-gamacopy-organization-which-imitates-the-russian-gamaredon-uses-560ba5e633fa?source=rss-f1efd6b74751------2","pattern":"[url:value = 'https://medium.com/@knownsec404team/love-and-hate-under-war-the-gamacopy-organization-which-imitates-the-russian-gamaredon-uses-560ba5e633fa?source=rss-f1efd6b74751------2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aed2928-5ba5-4e1a-2cce-000058d55392","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c7bbdae-4503-2cbb-a06c-0000b12c4d89","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyfirma.com/research/tracking-ransomware-january-2025/","pattern":"[url:value = 'https://www.cyfirma.com/research/tracking-ransomware-january-2025/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34e4373a-9ee0-6bae-64b3-0000eaeaa389","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://services.google.com/fh/files/misc/threat_horizons_report_h1_2025.pdf","pattern":"[url:value = 'https://services.google.com/fh/files/misc/threat_horizons_report_h1_2025.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--650adc2c-e204-6328-c8ee-000008799942","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/b/updated-shadowpad-malware-leads-to-ransomware-deployment.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/b/updated-shadowpad-malware-leads-to-ransomware-deployment.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2327c5b-5ae5-890a-af0e-0000dfc2e327","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.virusbulletin.com/virusbulletin/2019/11/vb2019-paper-vine-climbing-over-great-firewall-longterm-attack-against-china/","pattern":"[url:value = 'https://www.virusbulletin.com/virusbulletin/2019/11/vb2019-paper-vine-climbing-over-great-firewall-longterm-attack-against-china/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7d60573-9768-044b-17c6-0000b00610a4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.antiy.net/p/greenspotoperations-grow-for-many-years/","pattern":"[url:value = 'https://www.antiy.net/p/greenspotoperations-grow-for-many-years/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--182b8fd0-3607-a93d-113d-000069580d42","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://hunt.io/blog/greenspot-apt-targets-163com-fake-downloads-spoofing","pattern":"[url:value = 'https://hunt.io/blog/greenspot-apt-targets-163com-fake-downloads-spoofing']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--679b9b49-80cf-8184-bc8a-00007e55ea9b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/86535/","pattern":"[url:value = 'https://asec.ahnlab.com/en/86535/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e422998e-aaf7-8792-8a55-00006a3e0377","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkowl.com/blog-content/what-are-cves/","pattern":"[url:value = 'https://www.darkowl.com/blog-content/what-are-cves/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c583be4c-04d8-5dec-b1fc-000083016063","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/cyber-anarchy-squad-attacks-with-uncommon-trojans/114990/","pattern":"[url:value = 'https://securelist.com/cyber-anarchy-squad-attacks-with-uncommon-trojans/114990/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--676d9f74-51d6-9106-7870-000062540e75","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/unit-42-ransomware-leak-site-data-analysis/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/unit-42-ransomware-leak-site-data-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cecb5217-6671-87ac-df39-00006924d47b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://catalyst.prodaft.com/public/report/larva-208/overview","pattern":"[url:value = 'https://catalyst.prodaft.com/public/report/larva-208/overview']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--132e847b-c262-93ae-875d-00002feb928c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.scworld.com/brief/over-600-organizations-subjected-to-global-encrypthub-attacks","pattern":"[url:value = 'https://www.scworld.com/brief/over-600-organizations-subjected-to-global-encrypthub-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f30f2d09-7822-ad9f-751a-00004b3239ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.microsoft.com/on-the-issues/2025/02/27/disrupting-cybercrime-abusing-gen-ai/","pattern":"[url:value = 'https://blogs.microsoft.com/on-the-issues/2025/02/27/disrupting-cybercrime-abusing-gen-ai/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--494bf52d-51eb-de12-9a9f-00004c261db4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-supply-chain-korean-vpn-service/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-supply-chain-korean-vpn-service/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9e3003a-c678-fd25-62fa-0000e4899683","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.morphisec.com/blog/sticky-werewolfs-aviation-attacks/","pattern":"[url:value = 'https://www.morphisec.com/blog/sticky-werewolfs-aviation-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1fab688-5c10-1759-76cc-0000f4a71d6b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/angry-likho-apt-attacks-with-lumma-stealer/115663/","pattern":"[url:value = 'https://securelist.com/angry-likho-apt-attacks-with-lumma-stealer/115663/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--951ef34d-85cc-b79c-22f8-000049aad4b5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/javaghost-cloud-phishing/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/javaghost-cloud-phishing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d70556a7-d805-c176-456e-0000b4ca00c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://go.crowdstrike.com/rs/281-OBQ-266/images/ebook-modern-adversaries-and-evasion-techniques-2023.pdf","pattern":"[url:value = 'https://go.crowdstrike.com/rs/281-OBQ-266/images/ebook-modern-adversaries-and-evasion-techniques-2023.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55fec824-ee46-b55f-6713-00009214299a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/adversaries/wandering-spider/","pattern":"[url:value = 'https://www.crowdstrike.com/adversaries/wandering-spider/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59137be9-e57d-e1c5-9f95-00001a304f3b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b7393e0-6c49-9beb-6688-0000cef46c3a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/-/media/files/us/reports/state-of-the-threat/secureworks-se-2023-sott-report.pdf","pattern":"[url:value = 'https://www.secureworks.com/-/media/files/us/reports/state-of-the-threat/secureworks-se-2023-sott-report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd8f71ee-42b3-80ed-ccc4-00001c296eff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/-/media/files/us/reports/ir-quarterly-reports/secureworks-learning-from-ir-jan-mar-2023.pdf","pattern":"[url:value = 'https://www.secureworks.com/-/media/files/us/reports/ir-quarterly-reports/secureworks-learning-from-ir-jan-mar-2023.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd4073b7-da7c-25e6-710b-000046a9c663","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/-/media/files/us/reports/secureworks-learning-from-incident-response-2022.pdf","pattern":"[url:value = 'https://www.secureworks.com/-/media/files/us/reports/secureworks-learning-from-incident-response-2022.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36c53442-df81-2ff3-4318-0000d74cd9fe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/-/media/Files/US/Reports/state%20of%20the%20threat/secureworks-state-of-the-threat-report-2024.ashx","pattern":"[url:value = 'https://www.secureworks.com/-/media/Files/US/Reports/state%20of%20the%20threat/secureworks-state-of-the-threat-report-2024.ashx']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1d82b08-aea7-14de-06c7-0000041db338","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/gold-rebellion","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/gold-rebellion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a832f113-75e5-6a5b-bc8a-0000daf62b21","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: issues.Other","pattern":"[domain-name:value = 'issues.Other']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0717b62-7f08-b87f-650a-00000ad0d5ad","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: others.GOLD","pattern":"[domain-name:value = 'others.GOLD']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab9f63c-3885-8a21-75b9-00002a7990b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: scheme.Several","pattern":"[domain-name:value = 'scheme.Several']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e558c06c-aeac-55a9-df31-00001bf17987","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://applied-gai-in-security.ghost.io/security-copilot-promptbook-threat-actor-profile/","pattern":"[url:value = 'https://applied-gai-in-security.ghost.io/security-copilot-promptbook-threat-actor-profile/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--375ee1bd-4833-a64d-0524-0000f2469684","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=U7p0J8aMZhM&t=193s","pattern":"[url:value = 'https://www.youtube.com/watch?v=U7p0J8aMZhM&t=193s']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cb78260-d88b-8768-d74f-0000a513b6c4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: access.This","pattern":"[domain-name:value = 'access.This']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c3cda48-e791-9667-dd91-0000de47c898","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/excobalt-gored-the-hidden-tunnel-technique","pattern":"[url:value = 'https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/excobalt-gored-the-hidden-tunnel-technique']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c17dbd9-e795-3b38-6794-00009731d20e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/fortigate-firewall-configs-cve-2022-40684-exploitation/","pattern":"[url:value = 'https://socradar.io/fortigate-firewall-configs-cve-2022-40684-exploitation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3c573a8-eb56-7421-63b5-0000cc0155bf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-data-posting","pattern":"[url:value = 'https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-data-posting']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--095ac6ce-db27-000a-4bae-0000795936cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-drbcontrol-uncovering-a-cyberespionage-campaign-targeting-gambling-companies-in-southeast-asia","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-drbcontrol-uncovering-a-cyberespionage-campaign-targeting-gambling-companies-in-southeast-asia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4403cf77-74c2-4273-7029-000070a3a104","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fortinet.com/blog/threat-research/catching-ec2-grouper-no-indicators-required","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/catching-ec2-grouper-no-indicators-required']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2c7c1f6-1f38-5132-bc57-000092defb62","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/eagerbee-backdoor/115175/","pattern":"[url:value = 'https://securelist.com/eagerbee-backdoor/115175/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--540edee4-b246-6e9b-d606-0000a29ef810","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cisoseries.com/cyber-security-news-cyber-trust-label-uk-deepfake-laws-treasury-attack-details/","pattern":"[url:value = 'https://cisoseries.com/cyber-security-news-cyber-trust-label-uk-deepfake-laws-treasury-attack-details/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c32b3d32-5573-b57c-c98a-000015cdc56d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/blog/2022-ics-ot-threat-landscape-recap-what-to-watch-for-this-year/","pattern":"[url:value = 'https://www.dragos.com/blog/2022-ics-ot-threat-landscape-recap-what-to-watch-for-this-year/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e2d305e-cacf-c683-27e2-000008cd2c0c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6281632","pattern":"[url:value = 'https://cert.gov.ua/article/6281632']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88907b86-7f2f-b932-48e7-00002d0a116d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.cyble.com/2023/02/16/altoufan-team-targets-the-middle-east/","pattern":"[url:value = 'https://blog.cyble.com/2023/02/16/altoufan-team-targets-the-middle-east/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce6fb2dc-d7d1-1cb6-57ac-00007b1b39c7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/en-us/blog/liminal-panda-telecom-sector-threats/","pattern":"[url:value = 'https://www.crowdstrike.com/en-us/blog/liminal-panda-telecom-sector-threats/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3ebd441-060f-c59a-2c73-000057a29961","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/burrowing-your-way-into-vpns","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/burrowing-your-way-into-vpns']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0287112-3419-9033-ad57-0000e845d23d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42ca36b9-5ce5-01e2-7464-0000cc543aa8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations","pattern":"[url:value = 'https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--768d77e1-a714-b3ca-1309-0000af21efe3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.silentpush.com/blog/aiz-retail-crypto-phishing/","pattern":"[url:value = 'https://www.silentpush.com/blog/aiz-retail-crypto-phishing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecd83cd9-42c6-0631-dfab-00008dd568e4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybershafarat.com/2024/07/22/hacking-group-anonymous-ksa-a-notorious-threat-actor-is-targeting-india-in-a-series-of-cyber-attacks/","pattern":"[url:value = 'https://cybershafarat.com/2024/07/22/hacking-group-anonymous-ksa-a-notorious-threat-actor-is-targeting-india-in-a-series-of-cyber-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cfcf7e9-7a96-924e-1aff-0000bdb367c0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x.com/DailyDarkWeb/status/1807783849608286296","pattern":"[url:value = 'https://x.com/DailyDarkWeb/status/1807783849608286296']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cd991ae-462b-02f6-40fc-0000b0c5e463","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyjax.com/resources/blog/take-me-down-to-funksec-town-funksec-ransomware-dls-emergence/","pattern":"[url:value = 'https://www.cyjax.com/resources/blog/take-me-down-to-funksec-town-funksec-ransomware-dls-emergence/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84006466-362d-4a4e-a980-0000b9bd5c1b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.techspot.com/news/105785-mas-developers-achieve-major-breakthrough-windows-office-cracking.html","pattern":"[url:value = 'https://www.techspot.com/news/105785-mas-developers-achieve-major-breakthrough-windows-office-cracking.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56220d86-b508-75ec-5e12-0000f5da18c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: massgrave.dev","pattern":"[domain-name:value = 'massgrave.dev']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca237179-d5e5-b1e0-7962-00003b152f7e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-peep-17-dark-web-hacker-forums-ransomware/","pattern":"[url:value = 'https://socradar.io/dark-peep-17-dark-web-hacker-forums-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39a62343-11c6-c98f-b936-000007b607b2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thehackernews.com/2025/09/chinese-hackers-rednovember-target.html","pattern":"[url:value = 'https://thehackernews.com/2025/09/chinese-hackers-rednovember-target.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f40833d-8e99-baa8-0ad9-0000beb7b97a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/tag-100-uses-open-source-tools-in-suspected-global-espionage-campaign","pattern":"[url:value = 'https://www.recordedfuture.com/research/tag-100-uses-open-source-tools-in-suspected-global-espionage-campaign']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e196b67-3809-dabc-85c6-00005b8c8229","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2024/11/22/microsoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2024/11/22/microsoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c7d4676-57ed-9673-2ea3-00002c9db462","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2024/gorilla_bericht.html","pattern":"[url:value = 'https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2024/gorilla_bericht.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89ca74b6-fabb-4299-69a8-0000054750d9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/k/water-barghest.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/k/water-barghest.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70260ea1-e5ed-adb5-60d5-00006042dafa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/","pattern":"[url:value = 'https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ace9c67-cfda-0255-d9a1-000018c6b2f0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyjax.com/resources/blog/an-elephant-in-kairos-data-leak-site-emerges-for-new-extortion-group/","pattern":"[url:value = 'https://www.cyjax.com/resources/blog/an-elephant-in-kairos-data-leak-site-emerges-for-new-extortion-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--819e0560-e951-5435-47c4-0000d661c409","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.clearskysec.com/irdreamjob24/","pattern":"[url:value = 'https://www.clearskysec.com/irdreamjob24/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fce9bb4-0f64-1d64-307c-0000d848af1b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.eclecticiq.com/inside-intelligence-center-financially-motivated-chinese-threat-actor-silkspecter-targeting-black-friday-shoppers","pattern":"[url:value = 'https://blog.eclecticiq.com/inside-intelligence-center-financially-motivated-chinese-threat-actor-silkspecter-targeting-black-friday-shoppers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35898fdd-dca8-3f03-6b99-000059585cf8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/china-nexus-tag-112-compromises-tibetan-websites","pattern":"[url:value = 'https://www.recordedfuture.com/research/china-nexus-tag-112-compromises-tibetan-websites']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf6b0be7-6ae1-0c8f-5f0c-0000614fe22f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.clearskysec.com/0d-vulnerability-exploited-in-the_wild/","pattern":"[url:value = 'https://www.clearskysec.com/0d-vulnerability-exploited-in-the_wild/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7be1cc6b-8ab6-7146-fa41-000000b62bb8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://quointelligence.eu/2024/06/analyzing-shift-in-ransomware-dynamics/","pattern":"[url:value = 'https://quointelligence.eu/2024/06/analyzing-shift-in-ransomware-dynamics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b234439-dace-c000-829a-0000e9be60a9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://jp.security.ntt/insights_resources/tech_blog/en-waterplum-ottercookie/","pattern":"[url:value = 'https://jp.security.ntt/insights_resources/tech_blog/en-waterplum-ottercookie/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb8c694d-c3c2-2db0-03c4-0000dc054463","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/d/russian-infrastructure-north-korean-cybercrime.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/d/russian-infrastructure-north-korean-cybercrime.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--930de953-3a92-3a3d-a57c-00006b81e1cc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fbf4a66-e4af-9eb0-5275-0000e964fba1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2024-q3-2024.pdf","pattern":"[url:value = 'https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-apt-activity-report-q2-2024-q3-2024.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9fc7829-65fb-a0af-207f-0000900775a1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://databreaches.net/2024/11/12/amazon-confirms-employee-data-breach-after-vendor-hack/","pattern":"[url:value = 'https://databreaches.net/2024/11/12/amazon-confirms-employee-data-breach-after-vendor-hack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6b8786d-ae5f-f572-e523-00009625d56b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-web-profile-spacebears/","pattern":"[url:value = 'https://socradar.io/dark-web-profile-spacebears/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ac8a507-2080-2a30-fcae-0000b7f6513f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thecyberexpress.com/killnet-2-0-and-sylhet-gang-hackers/","pattern":"[url:value = 'https://thecyberexpress.com/killnet-2-0-and-sylhet-gang-hackers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5b1f5e6-a709-a175-b277-00008cb47feb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.checkpoint.com/security/evolving-cyber-dynamics-amidst-the-israel-hamas-conflict/","pattern":"[url:value = 'https://blog.checkpoint.com/security/evolving-cyber-dynamics-amidst-the-israel-hamas-conflict/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1933d2d9-4b03-99c6-50c9-00007af08d83","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/mastercard-data-leak-new-fully-undetectable-ransomware-elusive-stealer-source-code-leak-and-more/","pattern":"[url:value = 'https://socradar.io/mastercard-data-leak-new-fully-undetectable-ransomware-elusive-stealer-source-code-leak-and-more/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebf145cb-d8c7-fbb8-1922-00002e38452e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x.com/MonThreat/status/1821478543001293136","pattern":"[url:value = 'https://x.com/MonThreat/status/1821478543001293136']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce7ec8a4-a32a-557f-0c26-00009e99b1a1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x.com/MonThreat/status/1851901195201163720","pattern":"[url:value = 'https://x.com/MonThreat/status/1851901195201163720']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5084b4d9-65bf-d60e-2fd0-00001c5267c4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyfirma.com/research/hamas-leadership-assassination-explainer/","pattern":"[url:value = 'https://www.cyfirma.com/research/hamas-leadership-assassination-explainer/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39e4b9fb-6e9f-7600-1df8-0000df87ea36","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.seqrite.com/blog/operation-cobalt-whisper-targets-industries-hong-kong-pakistan/","pattern":"[url:value = 'https://www.seqrite.com/blog/operation-cobalt-whisper-targets-industries-hong-kong-pakistan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--697cdb34-2486-3091-f6b0-0000ec6b2948","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/internet-archive-data-breach-and-ddos-attacks/","pattern":"[url:value = 'https://socradar.io/internet-archive-data-breach-and-ddos-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--777d0a1b-2ec9-7995-761a-0000305eec43","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityboulevard.com/?p=2033037","pattern":"[url:value = 'https://securityboulevard.com/?p=2033037']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07f19eeb-2004-14b2-94c0-000074b91ff6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.radware.com/security/threat-advisories-and-attack-reports/six-day-web-ddos-attack-campaign/","pattern":"[url:value = 'https://www.radware.com/security/threat-advisories-and-attack-reports/six-day-web-ddos-attack-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cee20d7e-b9d1-70c7-5ced-000051b3fd23","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thecyberexpress.com/sn-blackmeta-claim-snapchat-cyberattack/","pattern":"[url:value = 'https://thecyberexpress.com/sn-blackmeta-claim-snapchat-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0658ae7e-8aad-0d29-be9f-0000ff2d4853","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dailydarkweb.net/darkraas-allegedly-breached-a-major-oil-and-gas-company/","pattern":"[url:value = 'https://dailydarkweb.net/darkraas-allegedly-breached-a-major-oil-and-gas-company/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef62feb8-12d0-b952-6473-000016b826ae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberpress.org/darkraas-ransomware-intelligence-data/","pattern":"[url:value = 'https://cyberpress.org/darkraas-ransomware-intelligence-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd0b4b64-fd38-fed5-2ef3-00003ff769c9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberpress.org/darkraas-ransomware-oil-gas-company/","pattern":"[url:value = 'https://cyberpress.org/darkraas-ransomware-oil-gas-company/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aafc0247-327e-eff7-4d85-0000079e02f4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://nao-sec.org/2024/10/IcePeony-with-the-996-work-culture.html","pattern":"[url:value = 'https://nao-sec.org/2024/10/IcePeony-with-the-996-work-culture.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9a14df1-7940-f21e-536a-0000a476fe86","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6281076","pattern":"[url:value = 'https://cert.gov.ua/article/6281076']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2506901-da90-b023-e33c-00002ae0ae41","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyble.com/blog/phishing-campaign-targeting-ukraine-uac-0215/","pattern":"[url:value = 'https://cyble.com/blog/phishing-campaign-targeting-ukraine-uac-0215/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba18a4b1-4a23-263b-f1af-0000e9ed3088","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/j/water-makara-uses-obfuscated-javascript-in-spear-phishing-campai.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/j/water-makara-uses-obfuscated-javascript-in-spear-phishing-campai.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f32aa23-f44d-8634-ae54-00005242b8eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f405058-8d1a-29f8-7ae8-00005abe26fd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.scworld.com/brief/austria-subjected-to-pro-russian-ddos-intrusions","pattern":"[url:value = 'https://www.scworld.com/brief/austria-subjected-to-pro-russian-ddos-intrusions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--793e943c-2dc4-1c41-9876-00000d4b0b96","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/biggest-education-industry-attacks-in-2024/","pattern":"[url:value = 'https://socradar.io/biggest-education-industry-attacks-in-2024/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f3ddd67-047f-9493-7ae6-0000d5106fc7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dailydarkweb.net/lulzsec-black-claims-cyberattacks-on-emirati-government-and-other-sector-targets/","pattern":"[url:value = 'https://dailydarkweb.net/lulzsec-black-claims-cyberattacks-on-emirati-government-and-other-sector-targets/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aeda5d1-41ae-823b-b2d2-000075f6ccaa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyjax.com/the-hacktivist-response-to-uk-foreign-policy/","pattern":"[url:value = 'https://www.cyjax.com/the-hacktivist-response-to-uk-foreign-policy/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4df3cbd2-ebd2-89a5-caef-000076c1099e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.radware.com/blog/security/2024/08/megamedusa-rippersec-public-web-ddos-attack-tool/","pattern":"[url:value = 'https://www.radware.com/blog/security/2024/08/megamedusa-rippersec-public-web-ddos-attack-tool/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--813a98e6-d8f3-fecd-9b89-0000268d309d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.checkpoint.com/security/hacktivists-call-for-release-of-telegram-founder-with-freedurov-ddos-campaign/","pattern":"[url:value = 'https://blog.checkpoint.com/security/hacktivists-call-for-release-of-telegram-founder-with-freedurov-ddos-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7527761b-acc7-2c1e-beff-0000386a6251","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bitdefender.com/en-us/blog/hotforsecurity/us-offers-10-million-bounty-for-members-of-iranian-hacking-gang/","pattern":"[url:value = 'https://www.bitdefender.com/en-us/blog/hotforsecurity/us-offers-10-million-bounty-for-members-of-iranian-hacking-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5727a4d-4f94-841e-f928-0000e7efdaf4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityonline.info/shahid-hemmat-hackers-10m-reward-offered-by-us/","pattern":"[url:value = 'https://securityonline.info/shahid-hemmat-hackers-10m-reward-offered-by-us/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f546e5f7-ac3e-cb6d-e653-0000f84bc302","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/","pattern":"[url:value = 'https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72e22331-0049-2fed-21c3-000021723e4e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/","pattern":"[url:value = 'https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51726e02-118e-0056-38b7-0000b287c7a8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.theregister.com/2024/09/25/china_anonymous_64_taiwan_accusations/","pattern":"[url:value = 'https://www.theregister.com/2024/09/25/china_anonymous_64_taiwan_accusations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec51ae87-2128-fa45-4dcd-00003ce4b842","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/?utm_source=rss&utm_medium=rss&utm_campaign=apt-group-targeting-governmental-agencies-in-east-asia","pattern":"[url:value = 'https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/?utm_source=rss&utm_medium=rss&utm_campaign=apt-group-targeting-governmental-agencies-in-east-asia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--307e8232-34d8-a600-5f1b-00006d91d292","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/task/","pattern":"[url:value = 'https://www.group-ib.com/blog/task/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23dd0471-7097-4f03-d2ca-00007c62ff52","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: BackDoor.RemShell","pattern":"[domain-name:value = 'BackDoor.RemShell']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24bd7d9e-2d50-eeee-9654-00002cba18fa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.ptsecurity.com/upload/corporate/ww-en/analytics/APT-Attacks-eng.pdf","pattern":"[url:value = 'http://www.ptsecurity.com/upload/corporate/ww-en/analytics/APT-Attacks-eng.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf33fb08-6298-a284-d7e9-0000b2fd4dc9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/separating-bee-panda-ceranakeeper-making-beeline-thailand/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/separating-bee-panda-ceranakeeper-making-beeline-thailand/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59f0f31c-69e8-6309-45bf-000063665f81","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://bi.zone/eng/expertise/blog/core-werewolf-protiv-opk-i-kriticheskoy-infrastruktury/","pattern":"[url:value = 'https://bi.zone/eng/expertise/blog/core-werewolf-protiv-opk-i-kriticheskoy-infrastruktury/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bb9b8b4-de32-9180-077b-0000a8803c81","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/awaken-likho-apt-new-implant-campaign/114101/","pattern":"[url:value = 'https://securelist.com/awaken-likho-apt-new-implant-campaign/114101/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fd9a68d-7ff1-4adb-f13c-00001ac9bc2d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/@criminalip/skidsec-hacker-group-announces-plans-to-spread-north-korean-propaganda-through-hacked-printers-in-fdd314178dc4","pattern":"[url:value = 'https://medium.com/@criminalip/skidsec-hacker-group-announces-plans-to-spread-north-korean-propaganda-through-hacked-printers-in-fdd314178dc4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2a0ea39-47c2-8b6b-9ddb-0000ad8b239d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-peep-7-shadows-of-betrayal-and-leadership-in-flux/","pattern":"[url:value = 'https://socradar.io/dark-peep-7-shadows-of-betrayal-and-leadership-in-flux/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90028336-65cf-135c-9f71-00002a3076b8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/unc1860-iran-middle-eastern-networks","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/unc1860-iran-middle-eastern-networks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a30065a-f723-286d-c11a-0000e5de79c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/cosmicbeetle-steps-up-probation-period-ransomhub/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/cosmicbeetle-steps-up-probation-period-ransomhub/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e42d8226-a070-6831-fc25-000084dcd9a4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://intezer.com/blog/research/stealth-wiper-israeli-infrastructure/","pattern":"[url:value = 'https://intezer.com/blog/research/stealth-wiper-israeli-infrastructure/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7701469-d687-deb9-cd0d-0000cddb138f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.trellix.com/blogs/research/handalas-wiper-targets-israel/","pattern":"[url:value = 'https://www.trellix.com/blogs/research/handalas-wiper-targets-israel/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--baa6b9aa-0242-949e-4c1d-00002a2b8e8e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--122274e4-79a5-56e8-274e-0000c4aec0d6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thecyberexpress.com/azzasec-noname-join-hands-to-target-ukriane/","pattern":"[url:value = 'https://thecyberexpress.com/azzasec-noname-join-hands-to-target-ukriane/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34dadfe5-7ec2-6ae9-c03b-00003bf9b5cb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-peep-16-play-ransomware-lockbits-alliance-breachforums-leak-and-cyberniggers-revival/","pattern":"[url:value = 'https://socradar.io/dark-peep-16-play-ransomware-lockbits-alliance-breachforums-leak-and-cyberniggers-revival/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3bbe674-2153-2bc3-a64b-0000f319bb8f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.techtarget.com/searchsecurity/news/366547445/CrowdStrike-observes-massive-spike-in-identity-based-attacks","pattern":"[url:value = 'https://www.techtarget.com/searchsecurity/news/366547445/CrowdStrike-observes-massive-spike-in-identity-based-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41541965-0fd1-a05e-7b3b-00004d6c70d1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/dragon-rank-seo-poisoning/","pattern":"[url:value = 'https://blog.talosintelligence.com/dragon-rank-seo-poisoning/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0486d978-c8b6-fb0c-eed1-0000fab52401","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x.com/MsftSecIntel/status/1836456406276342215","pattern":"[url:value = 'https://x.com/MsftSecIntel/status/1836456406276342215']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d459bf9-2d50-fda5-b6e6-0000da60ebb2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cisoseries.com/cybersecurity-news-inc-targets-healthcare-providence-schools-cyberattack-apple-ipads-bricked/","pattern":"[url:value = 'https://cisoseries.com/cybersecurity-news-inc-targets-healthcare-providence-schools-cyberattack-apple-ipads-bricked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9aa208e-61ff-fcbc-5ec1-0000bc5a1d99","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.cloudflare.com/unraveling-sloppylemming-operations/","pattern":"[url:value = 'https://blog.cloudflare.com/unraveling-sloppylemming-operations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abcb5000-279a-0fe9-654b-0000427b0369","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt","pattern":"[url:value = 'https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-baxia-uses-spear-phishing-and-geoserver-exploit-to-target-apac/IOCs%20-%20Earth%20Baxia%20Uses%20Spear-Phishing%20and%20GeoServer%20Exploit%20to%20Target%20APAC.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8b4938e-5bd9-f57c-fcd4-000089bddda0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/i/earth-baxia-spear-phishing-and-geoserver-exploit.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/i/earth-baxia-spear-phishing-and-geoserver-exploit.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f744451-9fc7-5981-8ef7-00005a753e72","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://jp.security.ntt/tech_blog/appdomainmanager-injection","pattern":"[url:value = 'https://jp.security.ntt/tech_blog/appdomainmanager-injection']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c47c1d37-8063-936b-ad02-0000738de774","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.tgsoft.it/news/news_archivio.asp?id=1568","pattern":"[url:value = 'https://www.tgsoft.it/news/news_archivio.asp?id=1568']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cd7b460-32e1-c2ae-9c08-000024bfa249","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dailydarkweb.net/sensitive-israeli-ministry-data-allegedly-leaked-on-dark-web/","pattern":"[url:value = 'https://dailydarkweb.net/sensitive-israeli-ministry-data-allegedly-leaked-on-dark-web/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b67fa22-e40e-25e0-defd-0000f23a2af7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://hackread.com/hacker-leaks-data-of-vk-users-russian-social-network/","pattern":"[url:value = 'https://hackread.com/hacker-leaks-data-of-vk-users-russian-social-network/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2af8fc32-959b-ac93-407a-0000d8f6a0e5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyble.com/blog/analysing-the-utg-q-010-campaign/","pattern":"[url:value = 'https://cyble.com/blog/analysing-the-utg-q-010-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffe3169a-d041-ae30-bd80-000021697e62","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://malware.news/t/playstation-5-hacked-twice/54441/1","pattern":"[url:value = 'https://malware.news/t/playstation-5-hacked-twice/54441/1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fc15e7d-c5a6-2ac9-95a2-000060043c0e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://arstechnica.com/gaming/2021/11/uncovered-ps5-encryption-keys-are-the-first-step-to-unlocking-the-console/","pattern":"[url:value = 'https://arstechnica.com/gaming/2021/11/uncovered-ps5-encryption-keys-are-the-first-step-to-unlocking-the-console/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01448c99-7d77-b7f0-aa19-0000e033941e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.0x7d0.dev/history/how-the-nintendo-wii-security-was-defeated/","pattern":"[url:value = 'https://blog.0x7d0.dev/history/how-the-nintendo-wii-security-was-defeated/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--586efaaa-6c27-6ef1-7d3c-000064c0d828","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/","pattern":"[url:value = 'https://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32088a0f-392e-3256-eb27-0000309dfa52","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/","pattern":"[url:value = 'https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23da7aac-1d6c-d1b4-d8ef-000097c24b3f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.risky.biz/risky-biz-news-doppelganger-gets-a-kick-in-the-butt-from-uncle-sam/","pattern":"[url:value = 'https://news.risky.biz/risky-biz-news-doppelganger-gets-a-kick-in-the-butt-from-uncle-sam/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cd874ef-ecfe-5e59-5ebd-0000959334ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://flashpoint.io/blog/pro-kremlin-hacktivist-groups/","pattern":"[url:value = 'https://flashpoint.io/blog/pro-kremlin-hacktivist-groups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--266f886a-4412-8859-6609-00009f6165f4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.scmagazine.com/brief/significant-ransom-payment-by-major-iranian-it-firm-underway","pattern":"[url:value = 'https://www.scmagazine.com/brief/significant-ransom-payment-by-major-iranian-it-firm-underway']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a72ac4e-ed97-c0fa-5b59-000032cb06db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybershafarat.com/2024/09/04/major-ir-leaks/","pattern":"[url:value = 'https://cybershafarat.com/2024/09/04/major-ir-leaks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09def911-f27d-f9bd-20bc-00004d8729c7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.oodaloop.com/briefs/2024/01/04/pilfered-data-from-iranian-insurance-and-food-delivery-firms-leaked-online/","pattern":"[url:value = 'https://www.oodaloop.com/briefs/2024/01/04/pilfered-data-from-iranian-insurance-and-food-delivery-firms-leaked-online/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--509dc804-1df1-f99f-f906-00007ee25f9d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cisoseries.com/cyber-security-headlines-google-5b-suit-settled-orbit-chain-loses-80m-fda-cyber-agreement/","pattern":"[url:value = 'https://cisoseries.com/cyber-security-headlines-google-5b-suit-settled-orbit-chain-loses-80m-fda-cyber-agreement/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6f50a14-dd6c-5b29-129d-0000d861a0dd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.hackread.com/iranian-food-delivery-snappfood-cyber-attack/","pattern":"[url:value = 'https://www.hackread.com/iranian-food-delivery-snappfood-cyber-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0235e272-58dc-db14-5870-000099f8acdf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.securonix.com/blog/securonix-threat-labs-monthly-intelligence-insights-september-2023/","pattern":"[url:value = 'https://www.securonix.com/blog/securonix-threat-labs-monthly-intelligence-insights-september-2023/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b257c3c-394d-be97-795d-00001189bb6c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.googlecloudcommunity.com/gc/Community-Blog/Finding-Malware-Unveiling-NUMOZYLOD-with-Google-Security/ba-p/789551","pattern":"[url:value = 'https://www.googlecloudcommunity.com/gc/Community-Blog/Finding-Malware-Unveiling-NUMOZYLOD-with-Google-Security/ba-p/789551']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f6a79ef-03de-eb15-eb47-000005529885","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dailydarkweb.net/a-threat-actor-alleged-breach-of-sri-lankan-farmers-community-database/","pattern":"[url:value = 'https://dailydarkweb.net/a-threat-actor-alleged-breach-of-sri-lankan-farmers-community-database/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--603a7cd1-bd7f-c134-55b9-00003dbbf581","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dailydarkweb.net/threat-actor-claimed-to-breach-database-of-dimecuba/","pattern":"[url:value = 'https://dailydarkweb.net/threat-actor-claimed-to-breach-database-of-dimecuba/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e958a9d-28b9-2956-0137-000040b47989","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dailydarkweb.net/threat-actor-claims-breach-of-siam-cement-group-database/","pattern":"[url:value = 'https://dailydarkweb.net/threat-actor-claims-breach-of-siam-cement-group-database/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72f2a4a1-c46e-7d9f-244c-00008b548704","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: DimeCuba.com","pattern":"[domain-name:value = 'DimeCuba.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1427491f-0d68-5ab1-95a4-000067bde0d0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adf3c666-c4ba-b671-b10e-0000013821ff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.oodaloop.com/briefs/2024/08/21/toyota-customer-employee-data-leaked-in-confirmed-data-breach/","pattern":"[url:value = 'https://www.oodaloop.com/briefs/2024/08/21/toyota-customer-employee-data-leaked-in-confirmed-data-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4280c508-30a4-387c-520b-0000a150b47f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://siliconangle.com/2024/08/20/toyota-alleges-stolen-customer-data-published-hacking-site-came-outside-supplier/","pattern":"[url:value = 'https://siliconangle.com/2024/08/20/toyota-alleges-stolen-customer-data-published-hacking-site-came-outside-supplier/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3612b2e7-40b8-f984-9614-00007d913ecf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://nsfocusglobal.com/new-apt-group-actor240524-a-closer-look-at-its-cyber-tactics-against-azerbaijan-and-israel/","pattern":"[url:value = 'https://nsfocusglobal.com/new-apt-group-actor240524-a-closer-look-at-its-cyber-tactics-against-azerbaijan-and-israel/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad487715-8ff3-aa36-fd9a-0000f6e2020b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/e/earth-ammit.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/e/earth-ammit.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbbe4e57-deb5-3d51-1c32-0000dfa68120","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/i/tidrone-targets-military-and-satellite-industries-in-taiwan.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/i/tidrone-targets-military-and-satellite-industries-in-taiwan.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6666775-9462-a39a-7991-00002821d6ae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/suspected-chinese-persist-sonicwall","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/suspected-chinese-persist-sonicwall']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f17b85d3-0f27-b46b-d120-0000fa9a0a8c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityintelligence.com/x-force/hive0137-on-ai-journey/","pattern":"[url:value = 'https://securityintelligence.com/x-force/hive0137-on-ai-journey/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf2f4cca-c907-b15e-a96c-00009f536bd7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/adversaries/curly-spider/","pattern":"[url:value = 'https://www.crowdstrike.com/adversaries/curly-spider/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4338384b-140e-3cfe-ad59-0000b72423a9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://go.crowdstrike.com/rs/281-OBQ-266/images/CrowdStrikeGlobalThreatReport2025.pdf","pattern":"[url:value = 'https://go.crowdstrike.com/rs/281-OBQ-266/images/CrowdStrikeGlobalThreatReport2025.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02248e08-9a05-e39f-7e82-000063664500","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/walmartglobaltech/qbot-is-back-connect-2d774052369f","pattern":"[url:value = 'https://medium.com/walmartglobaltech/qbot-is-back-connect-2d774052369f']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94da5656-adde-70b9-acdf-000016a0d620","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x.com/Unit42_Intel/status/1880368272610050459","pattern":"[url:value = 'https://x.com/Unit42_Intel/status/1880368272610050459']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f493d23-7efc-a324-154e-0000ab950c02","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://services.google.com/fh/files/misc/m-trends-2024.pdf","pattern":"[url:value = 'https://services.google.com/fh/files/misc/m-trends-2024.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc646185-c670-0045-063f-000025b163de","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://services.google.com/fh/files/misc/m_trends_2023_report.pdf","pattern":"[url:value = 'https://services.google.com/fh/files/misc/m_trends_2023_report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4909889-16dd-5b28-8385-00005305f603","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/phish-click-breach-hunting-for-a-sophisticated-cyber-attack/4267916","pattern":"[url:value = 'https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/phish-click-breach-hunting-for-a-sophisticated-cyber-attack/4267916']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6e4166a-4ddc-66f5-5cd2-00000ac99828","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x.com/MsftSecIntel/status/1881751635598139714","pattern":"[url:value = 'https://x.com/MsftSecIntel/status/1881751635598139714']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d24cd7dc-3543-5ffa-b0ce-0000c1f6d74b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.esentire.com/security-advisories/ongoing-email-bombing-campaigns-leading-to-remote-access-and-post-exploitation","pattern":"[url:value = 'https://www.esentire.com/security-advisories/ongoing-email-bombing-campaigns-leading-to-remote-access-and-post-exploitation']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--078c1105-d1a7-8c7c-29d6-0000456a6b59","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/","pattern":"[url:value = 'https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95085b9a-bff4-9322-92c8-0000536674b0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/detecting-disrupting-malvertising-backdoors/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/detecting-disrupting-malvertising-backdoors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0f99517-a367-0d51-3b7d-00002548c46c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.security.com/threat-intelligence/black-basta-ransomware-zero-day","pattern":"[url:value = 'https://www.security.com/threat-intelligence/black-basta-ransomware-zero-day']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dc6d15e-c7db-a611-0703-00007870d5a2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbe119c0-34c6-0ab6-09a3-000029d4a8c3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/hacktivist-usdod-claims-to-have-leaked-threat-actor-list/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/hacktivist-usdod-claims-to-have-leaked-threat-actor-list/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56a64648-4a76-f87f-e21f-0000136977de","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://hackread.com/hacker-scrapes-publishes-crowdstrike-ioc-list/","pattern":"[url:value = 'https://hackread.com/hacker-scrapes-publishes-crowdstrike-ioc-list/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5ef46c5-7ac3-d144-266c-0000f58406ba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x.com/MsftSecIntel/status/1849518751080644921","pattern":"[url:value = 'https://x.com/MsftSecIntel/status/1849518751080644921']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b18c88c-72ad-b1b9-bbe6-00000c166261","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:Python/CVE-2024-1709.A!dha&ThreatID=2147903327","pattern":"[url:value = 'https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:Python/CVE-2024-1709.A!dha&ThreatID=2147903327']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--931e965e-62fc-584b-f6ba-00004f405678","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce635c28-004c-8dcc-e980-0000009d7082","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/ta4903-actor-spoofs-us-government-small-businesses-phishing-bec-bids","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/ta4903-actor-spoofs-us-government-small-businesses-phishing-bec-bids']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c56c8b5a-232d-a276-414f-0000092e82fe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/apt45-north-korea-digital-military-machine","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/apt45-north-korea-digital-military-machine']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7739a13-5de6-4b79-fb6d-0000a8b41a36","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/4928679","pattern":"[url:value = 'https://cert.gov.ua/article/4928679']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1a9a626-0874-c08a-fa81-00009fe17f6e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/uac-0102-phishing-attack-detection-hackers-steal-authentication-data-impersonating-the-ukr-net-web-service/","pattern":"[url:value = 'https://socprime.com/blog/uac-0102-phishing-attack-detection-hackers-steal-authentication-data-impersonating-the-ukr-net-web-service/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00a57da5-0bc0-7fb2-6a0a-000017e88af9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2024/stargazers-ghost-network/","pattern":"[url:value = 'https://research.checkpoint.com/2024/stargazers-ghost-network/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbfecf24-746e-1bbf-3cc9-0000dd55bfb3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/4697016","pattern":"[url:value = 'https://cert.gov.ua/article/4697016']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62cee236-300a-65be-7916-0000c404a237","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/uac-0063-attack-detection-hackers-target-ukrainian-research-institutions-using-hatvibe-cherryspy-and-cve-2024-23692/","pattern":"[url:value = 'https://socprime.com/blog/uac-0063-attack-detection-hackers-target-ukrainian-research-institutions-using-hatvibe-cherryspy-and-cve-2024-23692/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e80865c-b6c1-4a4b-8dae-000011b12ee9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/@DoingFedTime/80-000-records-exposed-in-shell-data-breach-by-threat-actor-888-64c407dfac94","pattern":"[url:value = 'https://medium.com/@DoingFedTime/80-000-records-exposed-in-shell-data-breach-by-threat-actor-888-64c407dfac94']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c4bc47f-0634-d5c2-7959-0000e543e08d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/H4ckManac/status/1810569160180515171","pattern":"[url:value = 'https://twitter.com/H4ckManac/status/1810569160180515171']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f25624c3-5ab7-6349-4614-0000147f7822","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cloudways.com/blog/hacker-allegedly-leaks-data-from-shopify-breach-on-breachforums/","pattern":"[url:value = 'https://www.cloudways.com/blog/hacker-allegedly-leaks-data-from-shopify-breach-on-breachforums/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--095b5d8c-94ad-28fd-fe3e-0000eff50c26","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybersecuritynews.com/threats-claimimg-breach/","pattern":"[url:value = 'https://cybersecuritynews.com/threats-claimimg-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3ea8353-6e4b-8192-bdc6-0000cafd150a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/nullbulge-threat-actor-masquerades-as-hacktivist-group-rebelling-against-ai/","pattern":"[url:value = 'https://www.sentinelone.com/labs/nullbulge-threat-actor-masquerades-as-hacktivist-group-rebelling-against-ai/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b1af58a-687a-4edd-922e-00008c7d3761","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.risky.biz/risky-biz-news-us-takes-down-rts-twitter-bot-farm/","pattern":"[url:value = 'https://news.risky.biz/risky-biz-news-us-takes-down-rts-twitter-bot-farm/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a16b3d3e-b0c1-e362-2c61-00006a0b7dfb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://rt-solar.ru/solar-4rays/blog/4506/","pattern":"[url:value = 'https://rt-solar.ru/solar-4rays/blog/4506/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eaead9e1-0b92-bca6-ee13-00004c738ae3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://sysdig.com/blog/crystalray-rising-threat-actor-exploiting-oss-tools/","pattern":"[url:value = 'https://sysdig.com/blog/crystalray-rising-threat-actor-exploiting-oss-tools/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50b052aa-18a4-f421-c44e-000063751112","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/g/CVE-2024-38112-void-banshee.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/g/CVE-2024-38112-void-banshee.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0c8e6b7-faeb-f634-fd52-0000a9fcb333","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/blog/from-the-front-lines-8220-gang-massively-expands-cloud-botnet-to-30000-infected-hosts/","pattern":"[url:value = 'https://www.sentinelone.com/blog/from-the-front-lines-8220-gang-massively-expands-cloud-botnet-to-30000-infected-hosts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc0b1cee-555a-c147-8473-000026af3c6d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.aquasec.com/8220-gang-confluence-vulnerability-cve-2022-26134","pattern":"[url:value = 'https://blog.aquasec.com/8220-gang-confluence-vulnerability-cve-2022-26134']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01a5fe5a-9e9c-24f8-7ad6-0000b9de759d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da40e821-93b7-fed5-8c5b-00002d8251d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/51568/","pattern":"[url:value = 'https://asec.ahnlab.com/en/51568/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c580aa1-1042-6799-ada8-0000b39343a9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.imperva.com/blog/imperva-detects-undocumented-8220-gang-activities/","pattern":"[url:value = 'https://www.imperva.com/blog/imperva-detects-undocumented-8220-gang-activities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--856cfc14-3084-1ce5-565a-00001354cd45","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.uptycs.com/blog/8220-gang-cryptomining-cloud-based-infrastructure-cyber-threat","pattern":"[url:value = 'https://www.uptycs.com/blog/8220-gang-cryptomining-cloud-based-infrastructure-cyber-threat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--451ffa04-1866-6509-9177-00009024e9f5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/e/decoding-8220-latest-obfuscation-tricks.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/e/decoding-8220-latest-obfuscation-tricks.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7434ab2-f30a-c361-b386-0000d7efd8d2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc5bb709-2915-d964-9914-0000ac9ace9e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/cloudsorcerer-new-apt-cloud-actor/113056/","pattern":"[url:value = 'https://securelist.com/cloudsorcerer-new-apt-cloud-actor/113056/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09785ce1-208a-b24e-a975-000014861466","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/boolka/","pattern":"[url:value = 'https://www.group-ib.com/blog/boolka/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2966a1fc-2fab-d413-2be9-00005b6586f6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/","pattern":"[url:value = 'https://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76c18ec3-04ee-b402-78b3-00002efc2a22","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://quointelligence.eu/2024/06/european-election-at-risk-analysis/","pattern":"[url:value = 'https://quointelligence.eu/2024/06/european-election-at-risk-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89c936ed-b227-1bce-1a5b-00003ee8edb5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/prc-dragonbridge-influence-elections/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/prc-dragonbridge-influence-elections/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18b5261a-3251-1aa3-9ecd-00009d12a737","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://meterpreter.org/cybersecurity-firm-hacked-sensitive-data-on-sale/","pattern":"[url:value = 'https://meterpreter.org/cybersecurity-firm-hacked-sensitive-data-on-sale/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbe6e338-0f42-90df-5849-0000e234165f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.com/164263/cyber-crime/pandabuy-extorted-again.html","pattern":"[url:value = 'https://securityaffairs.com/164263/cyber-crime/pandabuy-extorted-again.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74e2d803-6687-4d68-cadf-0000f1d537c0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.malwarebytes.com/blog/news/2024/06/was-t-mobile-compromised-by-a-zero-day-in-jira","pattern":"[url:value = 'https://www.malwarebytes.com/blog/news/2024/06/was-t-mobile-compromised-by-a-zero-day-in-jira']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cd14e2f-10ca-f200-6b46-00005849c4f6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cysecurity.news/2024/06/infamous-hacker-intelbroker-breaches.html","pattern":"[url:value = 'https://www.cysecurity.news/2024/06/infamous-hacker-intelbroker-breaches.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2bcaaa1-7720-bb69-2a1d-0000baf3d98f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ics-cert.kaspersky.com/publications/reports/2024/04/02/apt-and-financial-attacks-on-industrial-organizations-in-h2-2023/","pattern":"[url:value = 'https://ics-cert.kaspersky.com/publications/reports/2024/04/02/apt-and-financial-attacks-on-industrial-organizations-in-h2-2023/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ead72baa-dcee-2424-2738-00004e5e27ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/hellhounds-operation-lahat-part-2/","pattern":"[url:value = 'https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/hellhounds-operation-lahat-part-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19d9cc25-737a-c372-f18d-000052b0338e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.csoonline.com/article/3684668/cyberattacks-against-governments-jumped-95-in-last-half-of-2022-cloudsek-says.html","pattern":"[url:value = 'https://www.csoonline.com/article/3684668/cyberattacks-against-governments-jumped-95-in-last-half-of-2022-cloudsek-says.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6aba97b-f7af-735a-e6f5-00009213bf69","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberint.com/blog/research/bluehornet-one-apt-to-terrorize-them-all/","pattern":"[url:value = 'https://cyberint.com/blog/research/bluehornet-one-apt-to-terrorize-them-all/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75071466-c4e0-5949-0ee6-000008e6b0bf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/sg-vhive-attackers-escalate-take-control-of-furniture-retailers-email-server/","pattern":"[url:value = 'https://www.databreaches.net/sg-vhive-attackers-escalate-take-control-of-furniture-retailers-email-server/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34570314-3d0e-31e6-e0d4-0000317bd9a2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/sg-vhive-alerts-consumers-to-cyberattack/","pattern":"[url:value = 'https://www.databreaches.net/sg-vhive-alerts-consumers-to-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99ae5ee9-ab39-5f03-8668-00004713502d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/singapore-real-estate-firm-breached-by-altdos/","pattern":"[url:value = 'https://www.databreaches.net/singapore-real-estate-firm-breached-by-altdos/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae560384-e8db-745e-281d-0000bb6f515e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/advisories-are-published-but-are-enough-entities-reading-them-and-taking-precautions/","pattern":"[url:value = 'https://www.databreaches.net/advisories-are-published-but-are-enough-entities-reading-them-and-taking-precautions/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffeb8201-04de-fc65-83e0-0000cbd9ee5f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/altdos-claims-to-have-hacked-one-of-malaysias-biggest-conglomerates/","pattern":"[url:value = 'https://www.databreaches.net/altdos-claims-to-have-hacked-one-of-malaysias-biggest-conglomerates/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd045d6b-d961-a6f7-8065-0000b88c86d2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/singapore-corporations-making-progress-in-preventing-cyberattacks/","pattern":"[url:value = 'https://www.databreaches.net/singapore-corporations-making-progress-in-preventing-cyberattacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--919ce068-6a05-6b8f-a22d-00001575f324","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/sneakychef-sugarghost-rat/","pattern":"[url:value = 'https://blog.talosintelligence.com/sneakychef-sugarghost-rat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0f63c45-47c6-b29f-b3f8-0000a50a24e3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/redjuliett-intensifies-taiwanese-cyber-espionage-via-network-perimeter","pattern":"[url:value = 'https://www.recordedfuture.com/redjuliett-intensifies-taiwanese-cyber-espionage-via-network-perimeter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfebe328-4081-a286-a51e-000080a3c9e6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/pypi-phishing-campaign-juiceledger-threat-actor-pivots-from-fake-apps-to-supply-chain-attacks/","pattern":"[url:value = 'https://www.sentinelone.com/labs/pypi-phishing-campaign-juiceledger-threat-actor-pivots-from-fake-apps-to-supply-chain-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e23b7863-4712-657b-78e2-00006d27b39f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: pypi.org","pattern":"[domain-name:value = 'pypi.org']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d7cd6f3-a689-88f7-41cf-0000cd25d7d4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.co/wordpress/133881/data-breach/mbda-alleged-data-breach.html","pattern":"[url:value = 'https://securityaffairs.co/wordpress/133881/data-breach/mbda-alleged-data-breach.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--128e0207-5d2c-545b-9ca1-0000c90f9f9c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybershafarat.com/2022/07/31/adrastea-hackers-claim-leading-european-designer-and-manufacturer-of-missile-systems-mbda-hacked/","pattern":"[url:value = 'https://cybershafarat.com/2022/07/31/adrastea-hackers-claim-leading-european-designer-and-manufacturer-of-missile-systems-mbda-hacked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5aaa1c25-9f79-d744-50af-00001a84d654","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.itsecurityguru.org/2022/09/14/documents-for-sale-on-the-dark-web/","pattern":"[url:value = 'https://www.itsecurityguru.org/2022/09/14/documents-for-sale-on-the-dark-web/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6e398cf-63be-4b21-87a6-0000ee1e27c5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cysecurity.news/2022/11/missile-supplier-mbda-breach-disclosed.html","pattern":"[url:value = 'https://www.cysecurity.news/2022/11/missile-supplier-mbda-breach-disclosed.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f568c65-2c25-b5d6-b9ee-0000af546f7c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/the-travels-of-markopolo-self-proclaimed-meeting-software-vortax-spreads-infostealers","pattern":"[url:value = 'https://www.recordedfuture.com/the-travels-of-markopolo-self-proclaimed-meeting-software-vortax-spreads-infostealers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8d02880-0da9-a0aa-4f69-0000cecd2298","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkreading.com/remote-workforce/vortax-meeting-software-branding-spreads-infostealers","pattern":"[url:value = 'https://www.darkreading.com/remote-workforce/vortax-meeting-software-branding-spreads-infostealers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--234a5bb6-e109-d6a7-dc0c-0000fae3eb3e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/f/behind-the-great-wall-void-arachne-targets-chinese-speaking-user.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/f/behind-the-great-wall-void-arachne-targets-chinese-speaking-user.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a0339fb-eca7-e81a-8a1d-000053a241fe","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: TEMP.Vermin","pattern":"[domain-name:value = 'TEMP.Vermin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ceabd8f-c9ff-e6e6-d515-00000fabc29c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6279600","pattern":"[url:value = 'https://cert.gov.ua/article/6279600']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50c61f0f-02eb-9099-7376-000040776bd8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/russian-vermin-hackers-target-ukraine","pattern":"[url:value = 'https://therecord.media/russian-vermin-hackers-target-ukraine']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a848e68a-a517-1076-cce4-000068f74698","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/vermin-uac-0020-hacking-collective-hits-ukrainian-government-and-military-with-spectr-malware/","pattern":"[url:value = 'https://socprime.com/blog/vermin-uac-0020-hacking-collective-hits-ukrainian-government-and-military-with-spectr-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce1203f8-77ed-f9ac-9ae8-000097354583","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/","pattern":"[url:value = 'https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1619560-f988-d04b-6073-00008a22a1de","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.akamai.com/blog/security/the-bondnet-army","pattern":"[url:value = 'https://www.akamai.com/blog/security/the-bondnet-army']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06ae01fb-9757-e8b3-afb6-000065926637","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/66662/","pattern":"[url:value = 'https://asec.ahnlab.com/en/66662/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e94f20e5-9ac4-fa3c-2a1a-000028b82faf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta571-delivers-icedid-forked-loader","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta571-delivers-icedid-forked-loader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1098576b-7c8c-835a-fd6c-0000bbdab19a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cysecurity.news/2024/06/truist-bank-confirms-data-breach-after.html","pattern":"[url:value = 'https://www.cysecurity.news/2024/06/truist-bank-confirms-data-breach-after.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55af2293-ddf6-0623-8d0f-0000eaf8bb0b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2024/17th-june-threat-intelligence-report/","pattern":"[url:value = 'https://research.checkpoint.com/2024/17th-june-threat-intelligence-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--739b575c-334d-4411-7399-000003f71356","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-gitloker-attacks-wipe-github-repos-in-extortion-scheme/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-gitloker-attacks-wipe-github-repos-in-extortion-scheme/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c36459ff-7907-f90d-7c4d-00006b4832dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.itsecurityguru.org/2024/06/13/guest-blog-proactive-application-security-learning-from-the-recent-github-extortion-campaigns/","pattern":"[url:value = 'https://www.itsecurityguru.org/2024/06/13/guest-blog-proactive-application-security-learning-from-the-recent-github-extortion-campaigns/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f176222-dcfc-4d70-3e07-00001ba75bbd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ti.qianxin.com/blog/articles/Operation-Veles-Decade-Long-Espionage-Targeting-the-Global-Research-and-Education-Sector-EN/","pattern":"[url:value = 'https://ti.qianxin.com/blog/articles/Operation-Veles-Decade-Long-Espionage-Targeting-the-Global-Research-and-Education-Sector-EN/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ae0b18f-a15f-22e8-06d9-000043cb64c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-web-profile-hunt3r-kill3rs/","pattern":"[url:value = 'https://socradar.io/dark-web-profile-hunt3r-kill3rs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f71ec46d-8329-f605-39d7-0000e1e03203","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/lilacsquid/","pattern":"[url:value = 'https://blog.talosintelligence.com/lilacsquid/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c6231f8-042e-a2f1-1956-00002a40601c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkreading.com/threat-intelligence/sexi-ransomware-desires-vmware-hypervisors","pattern":"[url:value = 'https://www.darkreading.com/threat-intelligence/sexi-ransomware-desires-vmware-hypervisors']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--308fb97f-f199-658e-1691-0000e3dbe1b3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://heimdalsecurity.com/blog/powerhosts-esxi-servers-encrypted-with-new-sexi-ransomware/","pattern":"[url:value = 'https://heimdalsecurity.com/blog/powerhosts-esxi-servers-encrypted-with-new-sexi-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3416100a-e123-c424-7945-000047f7674c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cybersecurity-insiders.com/proven-data-restores-powerhosts-vmware-backups-after-sexi-ransomware-attack/","pattern":"[url:value = 'https://www.cybersecurity-insiders.com/proven-data-restores-powerhosts-vmware-backups-after-sexi-ransomware-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9160f3bb-b5e2-ae4c-e227-00004f5e87e8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cloudflare.com/threat-intelligence/research/report/disrupting-flyingyetis-campaign-targeting-ukrainev/","pattern":"[url:value = 'https://www.cloudflare.com/threat-intelligence/research/report/disrupting-flyingyetis-campaign-targeting-ukrainev/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d077c103-cffd-579e-5416-0000eab0f9b7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39e244f5-9f65-9d6c-f9b8-00009d68fdf9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.cloudflare.com/disrupting-flyingyeti-campaign-targeting-ukraine","pattern":"[url:value = 'https://blog.cloudflare.com/disrupting-flyingyeti-campaign-targeting-ukraine']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--451a9740-34c9-39c2-439f-0000478e2d8c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkowl.com/blog-content/2-month-review-of-cyber-activities-in-the-israel-hamas-conflict/","pattern":"[url:value = 'https://www.darkowl.com/blog-content/2-month-review-of-cyber-activities-in-the-israel-hamas-conflict/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bea31f87-21f5-622b-0ef1-00009289b4d9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/reflections-of-the-israel-palestine-conflict-on-the-cyber-world/","pattern":"[url:value = 'https://socradar.io/reflections-of-the-israel-palestine-conflict-on-the-cyber-world/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a68fe38-f028-b11f-ede4-00001758d4e5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/unfading-sea-haze-hackers-hide-on-military-and-govt-networks-for-6-years/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/unfading-sea-haze-hackers-hide-on-military-and-govt-networks-for-6-years/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c064c4f-cb79-e131-a584-00003a1f2a03","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.securityweek.com/newly-detected-chinese-group-targeting-military-government-entities/","pattern":"[url:value = 'https://www.securityweek.com/newly-detected-chinese-group-targeting-military-government-entities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5262286-d0d6-c64b-7d12-00006471e184","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://www.sentinelone.com/blog/ransomware-evolution-how-cheated-affiliates-are-recycling-victim-data-for-profit/","pattern":"[url:value = 'https://www.sentinelone.com/blog/ransomware-evolution-how-cheated-affiliates-are-recycling-victim-data-for-profit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c262e63-7a09-1010-4a19-000067edbc2a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://forescoutstage.wpengine.com/blog/analysis-a-new-ransomware-group-emerges-from-the-change-healthcare-cyber-attack/","pattern":"[url:value = 'https://forescoutstage.wpengine.com/blog/analysis-a-new-ransomware-group-emerges-from-the-change-healthcare-cyber-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b755ebc-19b5-c7d9-b78d-00003c65b7f8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://symantec-enterprise-blogs.security.com/threat-intelligence/ransomhub-knight-ransomware","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/threat-intelligence/ransomhub-knight-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97bb7ebc-ce12-8dde-b183-0000d53d7c31","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f58c758e-af5e-2c0f-292d-0000a99b3169","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/","pattern":"[url:value = 'https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1e1005b-04dc-7689-e5d3-0000439256a0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cysecurity.news/2024/04/cryptocurrency-chaos-el-salvadors.html","pattern":"[url:value = 'https://www.cysecurity.news/2024/04/cryptocurrency-chaos-el-salvadors.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd3b1801-4204-a202-02dc-0000c6a45e39","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.com/162790/data-breach/el-salvador-massive-leak-biometric-data.html","pattern":"[url:value = 'https://securityaffairs.com/162790/data-breach/el-salvador-massive-leak-biometric-data.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf49bcf3-9d5b-920d-17f0-000004849018","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyble.com/blog/head-mare-deploys-phantomcore-against-russia/","pattern":"[url:value = 'https://cyble.com/blog/head-mare-deploys-phantomcore-against-russia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f902da4-f2da-07d9-e346-0000fa227936","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/head-mare-hacktivists/113555/","pattern":"[url:value = 'https://securelist.com/head-mare-hacktivists/113555/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c498d42-8f8a-9916-909e-00000645035e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.facct.ru/blog/phantomdl-loader","pattern":"[url:value = 'https://www.facct.ru/blog/phantomdl-loader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3c0d46c-b73e-c7e3-6871-0000cb8bb5b2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/russian-researchers-winrar-bug-ukraine-espionage","pattern":"[url:value = 'https://therecord.media/russian-researchers-winrar-bug-ukraine-espionage']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--629ec2c9-6762-02cb-47af-00008473e38c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/e/water-orthrus-new-campaigns-deliver-rootkit-and-phishing-modules.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/e/water-orthrus-new-campaigns-deliver-rootkit-and-phishing-modules.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db1ee30c-0210-c76e-83bc-00007230215d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://krebsonsecurity.com/2023/09/fbi-hacker-dropped-stolen-airbus-data-on-9-11/","pattern":"[url:value = 'https://krebsonsecurity.com/2023/09/fbi-hacker-dropped-stolen-airbus-data-on-9-11/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54045e79-88d4-dd39-7c9b-00008c03a2e6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cysecurity.news/2023/09/transunion-refutes-data-breach-reports.html","pattern":"[url:value = 'https://www.cysecurity.news/2023/09/transunion-refutes-data-breach-reports.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3108311-a05e-e6b1-8110-0000e48b57d6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.hackread.com/us-environmental-protection-agency-hacked-data-leaked/","pattern":"[url:value = 'https://www.hackread.com/us-environmental-protection-agency-hacked-data-leaked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb1b9a16-6200-40a3-a73e-0000ed1631fb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/6277849","pattern":"[url:value = 'https://cert.gov.ua/article/6277849']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c38c2490-78f9-8d05-55d5-00001c83d330","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/uac-0149-attack-detection-hackers-launch-a-targeted-attack-against-the-armed-forces-of-ukraine-as-cert-ua-reports/","pattern":"[url:value = 'https://socprime.com/blog/uac-0149-attack-detection-hackers-launch-a-targeted-attack-against-the-armed-forces-of-ukraine-as-cert-ua-reports/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f4d96f6-baae-5dd7-a07b-00006a495a22","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.enigmasoftware.com/cve20243400vulnerability-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/cve20243400vulnerability-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f77d885-728d-99ce-bb98-000094083762","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.resecurity.com/blog/article/cybercriminals-leaked-massive-volumes-of-stolen-pii-data-from-thailand-in-dark-web","pattern":"[url:value = 'https://www.resecurity.com/blog/article/cybercriminals-leaked-massive-volumes-of-stolen-pii-data-from-thailand-in-dark-web']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--544abeed-6dda-bf6f-f24f-0000b9032db1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.com/162136/cyber-crime/hackers-threaten-leak-world-check.html","pattern":"[url:value = 'https://securityaffairs.com/162136/cyber-crime/hackers-threaten-leak-world-check.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44e07331-62f5-14f5-9391-000077113438","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: Breachforums.is","pattern":"[domain-name:value = 'Breachforums.is']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf75c9df-b9d2-1463-5a29-000048f4ded8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/hackers-claim-to-breach-russia-prosecutor-general-database","pattern":"[url:value = 'https://therecord.media/hackers-claim-to-breach-russia-prosecutor-general-database']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93a43ddb-f985-ad35-8a6e-0000cef9b0a3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/starry-addax/","pattern":"[url:value = 'https://blog.talosintelligence.com/starry-addax/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe17ebe8-6098-e1b6-2597-00006dde6ba8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://sysdig.com/blog/rubycarp-romanian-botnet-group/","pattern":"[url:value = 'https://sysdig.com/blog/rubycarp-romanian-botnet-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1608497a-9565-bace-3083-00008270d440","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/coralraider-targets-socialmedia-accounts/","pattern":"[url:value = 'https://blog.talosintelligence.com/coralraider-targets-socialmedia-accounts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--984fa669-ad6c-00f1-3517-0000ad4ef2f7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-update-pro-ukraine-hacktivists-breach-russian-isp-as-revenge-for-kyivstar-attack/","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-update-pro-ukraine-hacktivists-breach-russian-isp-as-revenge-for-kyivstar-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37c90715-3819-46f2-ffe0-00004362c8d1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.securityweek.com/destructive-ics-malware-fuxnet-used-by-ukraine-against-russian-infrastructure/","pattern":"[url:value = 'https://www.securityweek.com/destructive-ics-malware-fuxnet-used-by-ukraine-against-russian-infrastructure/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c92da9e-e929-402b-2f15-0000662d0fc5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.enigmasoftware.com/fuxneticsmalware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/fuxneticsmalware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af5cc263-efcb-8b82-edde-000025f6986b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.resecurity.com/blog/article/Smishing-Triad-Impersonates-Emirates-Post-Target-UAE-Citizens","pattern":"[url:value = 'https://www.resecurity.com/blog/article/Smishing-Triad-Impersonates-Emirates-Post-Target-UAE-Citizens']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82d7479f-17c0-8881-77c5-0000a5b62454","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2024/agent-tesla-targeting-united-states-and-australia/","pattern":"[url:value = 'https://research.checkpoint.com/2024/agent-tesla-targeting-united-states-and-australia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea248b0e-7980-c5e6-6566-00001a9ccd1f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-web-profile-cyberniggers/","pattern":"[url:value = 'https://socradar.io/dark-web-profile-cyberniggers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9051faa-d39d-5a18-fc73-00009da967b0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/u-s-faces-cyber-onslaught-fico-breach-id-cc-military-data-sale/","pattern":"[url:value = 'https://socradar.io/u-s-faces-cyber-onslaught-fico-breach-id-cc-military-data-sale/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7d298f9-3ba7-5d58-77ca-00009f26bedc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/acuity-federal-breach-okta-leak-dcrat-exploit/","pattern":"[url:value = 'https://socradar.io/acuity-federal-breach-okta-leak-dcrat-exploit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2be3f9ba-500a-c530-4ac7-0000c0c2d775","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/initial-access-brokers-exploit-f5-screenconnect","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/initial-access-brokers-exploit-f5-screenconnect']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--480ed233-c0d1-2de8-a1c0-000086ed94b5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://rhisac.org/threat-intelligence/f5-big-ip-and-screenconnect-cves/","pattern":"[url:value = 'https://rhisac.org/threat-intelligence/f5-big-ip-and-screenconnect-cves/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72932189-e0ca-e9db-6cc2-0000ff0bb2ce","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/","pattern":"[url:value = 'https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e848d360-d6cc-b8a4-6f15-00006eb3d118","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.chronline.com/stories/a-hacking-slugfest-between-iran-and-its-foes-sparks-fears-of-a-wider-cyberwar","pattern":"[url:value = 'https://www.chronline.com/stories/a-hacking-slugfest-between-iran-and-its-foes-sparks-fears-of-a-wider-cyberwar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f1daeb9-55b5-1acc-30bc-00006d7b7db0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.com/142172/hacktivism/iranian-state-tv-hacked.html","pattern":"[url:value = 'https://securityaffairs.com/142172/hacktivism/iranian-state-tv-hacked.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4b3f1c3-e8bd-b588-3555-000038505f89","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/","pattern":"[url:value = 'https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77f390a4-a79b-ffd6-12d2-00007ff299d9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.resecurity.com/blog/article/the-aviation-and-aerospace-sectors-face-skyrocketing-cyber-threats","pattern":"[url:value = 'https://www.resecurity.com/blog/article/the-aviation-and-aerospace-sectors-face-skyrocketing-cyber-threats']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3617d62-13a1-e646-94de-00001f010c26","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a4f9acb-05d3-d5f9-5689-0000044102b4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-china-linked-earth-krahang-apt-breached-70-organizations-in-23-nations-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-china-linked-earth-krahang-apt-breached-70-organizations-in-23-nations-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1017444-cbd3-1993-18c1-0000bfb1ec17","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.sophos.com/en-us/2025/12/05/sharpening-the-knife-gold-blades-strategic-evolution/","pattern":"[url:value = 'https://news.sophos.com/en-us/2025/12/05/sharpening-the-knife-gold-blades-strategic-evolution/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2c56d15-46eb-f8dd-bdb4-0000d5c60722","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39f26ea2-4014-82c6-afc4-000086471980","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyble.com/blog/cyble-chronicles-february-1-latest-findings-recommendations-for-the-cybersecurity-community/","pattern":"[url:value = 'https://cyble.com/blog/cyble-chronicles-february-1-latest-findings-recommendations-for-the-cybersecurity-community/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35e18701-0b45-0fcf-5df9-0000567bf3ce","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://logrhythm.com/blog/how-government-agencies-can-defend-against-exfiltration-tactics/","pattern":"[url:value = 'https://logrhythm.com/blog/how-government-agencies-can-defend-against-exfiltration-tactics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7489263c-0257-f409-6b8a-00008ebde18e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/epic-games-zero-evidence-we-were-hacked-by-mogilevich-gang/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/epic-games-zero-evidence-we-were-hacked-by-mogilevich-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72298163-0524-3260-fdc4-0000decd01c3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/ireland-dfa-no-evidence-of-cybersecurity-breach","pattern":"[url:value = 'https://therecord.media/ireland-dfa-no-evidence-of-cybersecurity-breach']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe137b7b-b7ed-ae3c-9f51-0000e4a72302","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.checkpoint.com/research/iranian-threat-actor-nimbus-manticore-expands-campaigns-into-europe-with-advanced-malware-and-fake-job-lures/","pattern":"[url:value = 'https://blog.checkpoint.com/research/iranian-threat-actor-nimbus-manticore-expands-campaigns-into-europe-with-advanced-malware-and-fake-job-lures/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c99e7760-1244-938d-bf8c-0000cb68df35","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe","pattern":"[url:value = 'https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b797c80-ec3a-a099-d56f-0000bf10a137","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65a0de3c-af7f-986d-884d-0000106a1246","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.morphisec.com/unveiling-uac-0184-the-remcos-rat-steganography-saga","pattern":"[url:value = 'https://blog.morphisec.com/unveiling-uac-0184-the-remcos-rat-steganography-saga']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4caedcd-e5ab-739a-3127-0000fd60e676","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader","pattern":"[url:value = 'https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35867abd-ba86-dfef-3daa-0000e8fb9fb1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/goldfactory-ios-trojan/","pattern":"[url:value = 'https://www.group-ib.com/blog/goldfactory-ios-trojan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61c2c53c-0b7a-36a6-73a4-000060b539ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: Cyber.Anarchy.Squad","pattern":"[domain-name:value = 'Cyber.Anarchy.Squad']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3f3030d-61dd-220b-7ddd-0000f337266b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/proukraine-hackers-claim-to-take-down-russian-isp","pattern":"[url:value = 'https://therecord.media/proukraine-hackers-claim-to-take-down-russian-isp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c934a304-55e0-247d-2d7f-000057e1f624","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://srslyriskybiz.substack.com/p/russias-extradition-wars-are-not","pattern":"[url:value = 'https://srslyriskybiz.substack.com/p/russias-extradition-wars-are-not']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6443899f-de78-dbc4-80bd-000007ad892f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.phishlabs.com/blog/phishing-service-profile-labhost-threat-actor-group","pattern":"[url:value = 'https://www.phishlabs.com/blog/phishing-service-profile-labhost-threat-actor-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f743da0-f70f-ac84-9c1f-0000108ee50a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/shadowsyndicate-raas/","pattern":"[url:value = 'https://www.group-ib.com/blog/shadowsyndicate-raas/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcb9d106-07ac-979d-635b-0000da65c696","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/resumelooters/","pattern":"[url:value = 'https://www.group-ib.com/blog/resumelooters/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--926c4ea7-79a4-b981-5ea9-000002bf4121","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/adversaries/banished-kitten/","pattern":"[url:value = 'https://www.crowdstrike.com/adversaries/banished-kitten/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d709e4a-64e1-e859-bde0-000036bc9b4d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/copacabana-barcelona-cross-continental-threat-brazilian-banking-malware","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/copacabana-barcelona-cross-continental-threat-brazilian-banking-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5ba5446-9577-432d-875f-0000750276fb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://blog.trendmicro.com/trendlabs-security-intelligence/osx_dok-mac-malware-emmental-hijacks-user-network-traffic/","pattern":"[url:value = 'http://blog.trendmicro.com/trendlabs-security-intelligence/osx_dok-mac-malware-emmental-hijacks-user-network-traffic/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08caf11b-a7f2-5372-98d5-00009213f265","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/18/h/the-urpage-connection-to-bahamut-confucius-and-patchwork.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/18/h/the-urpage-connection-to-bahamut-confucius-and-patchwork.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--892923a9-207e-d339-24b6-0000dec4ccc5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/b/invitation-to-secret-event-uncovering-earth-yako-campaigns.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/b/invitation-to-secret-event-uncovering-earth-yako-campaigns.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--878ef40f-ad66-4985-e837-000085fa888a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_my/research/18/h/supply-chain-attack-operation-red-signature-targets-south-korean-organizations.html","pattern":"[url:value = 'https://www.trendmicro.com/en_my/research/18/h/supply-chain-attack-operation-red-signature-targets-south-korean-organizations.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9da08204-501b-2c29-3a46-00002c1cb4ce","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decoded.avast.io/threatintel/avast-finds-backdoor-on-us-government-commission-network/?utm_source=rss&utm_medium=rss&utm_campaign=avast-finds-backdoor-on-us-government-commission-network","pattern":"[url:value = 'https://decoded.avast.io/threatintel/avast-finds-backdoor-on-us-government-commission-network/?utm_source=rss&utm_medium=rss&utm_campaign=avast-finds-backdoor-on-us-government-commission-network']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f42b4126-eb9e-7de0-6454-00008d68f80c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/operation-ghoul-targeted-attacks-on-industrial-and-engineering-organizations/75718/","pattern":"[url:value = 'https://securelist.com/operation-ghoul-targeted-attacks-on-industrial-and-engineering-organizations/75718/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f388afcb-07a2-146b-054c-0000a37097c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/kaspersky-security-bulletin-2016-executive-summary/76858/","pattern":"[url:value = 'https://securelist.com/kaspersky-security-bulletin-2016-executive-summary/76858/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4090251a-cc9f-6eb8-4298-0000fd3b20eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/operation-triangulation-catching-wild-triangle/110916/","pattern":"[url:value = 'https://securelist.com/operation-triangulation-catching-wild-triangle/110916/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12b570bf-3ce1-c207-4f09-0000ae40c264","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices","pattern":"[url:value = 'https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c19e4e11-fc1e-8abb-2914-000090df50e0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835","pattern":"[url:value = 'https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d320fbf9-3b99-6a11-dfc4-00008245159c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/","pattern":"[url:value = 'https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35eee860-f877-86b2-71a4-00006db43820","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f4c6655-5eab-1ad5-c723-0000d2cc6820","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf","pattern":"[url:value = 'https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccb739b5-c00f-63b9-af8c-00006c62d20c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/","pattern":"[url:value = 'https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c0b9427-c5ea-45ca-5f52-00004b8b8371","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf","pattern":"[url:value = 'https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deeab77d-d4cc-78b7-4480-000043048d6a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/","pattern":"[url:value = 'https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53510cf0-22d8-002e-5626-0000f16b1843","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/revengehotels/95229/","pattern":"[url:value = 'https://securelist.com/revengehotels/95229/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4fd2f3f-61e2-e936-ff96-00000a51517b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-review-of-the-year/89117/","pattern":"[url:value = 'https://securelist.com/apt-review-of-the-year/89117/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6f1717f-7bdf-4339-62bd-00005745e008","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-trends-report-q3-2019/94530/","pattern":"[url:value = 'https://securelist.com/apt-trends-report-q3-2019/94530/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--600098f0-ef28-028f-c82e-0000f82a360c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/ksb-2019-review-of-the-year/95394/","pattern":"[url:value = 'https://securelist.com/ksb-2019-review-of-the-year/95394/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2b1808b-06e1-6048-f235-00009ef3aa3c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/","pattern":"[url:value = 'https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cc725ee-629f-ada8-e5b1-0000baf93ffc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-trends-report-q1-2022/106351/","pattern":"[url:value = 'https://securelist.com/apt-trends-report-q1-2022/106351/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--726ddc31-0a69-df90-fcf4-0000cf515d8d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-trends-report-q2-2022/106995/","pattern":"[url:value = 'https://securelist.com/apt-trends-report-q2-2022/106995/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53de5861-fd19-150c-21f8-0000ae6acc65","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76a0a052-65f9-9d23-4fc5-0000e39fa007","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-spoofs-philippine-government-covid-19-health-data-widespread","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-spoofs-philippine-government-covid-19-health-data-widespread']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8259e5a-2337-7882-037c-0000319b9de3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/ta2552-uses-oauth-access-token-phishing-exploit-read-only-risks","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/ta2552-uses-oauth-access-token-phishing-exploit-read-only-risks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f383d04-c367-7a2a-5213-0000b1951d1d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MsftSecIntel/status/1712936244987019704?lang=en","pattern":"[url:value = 'https://twitter.com/MsftSecIntel/status/1712936244987019704?lang=en']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f034420-1f63-93d4-d01a-0000c127d86a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bridewell.com/insights/blogs/detail/analysing-widespread-microsoft365-credential-harvesting-campaign","pattern":"[url:value = 'https://www.bridewell.com/insights/blogs/detail/analysing-widespread-microsoft365-credential-harvesting-campaign']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74e0fc9b-e7e6-2ecf-dbe2-00001d335e02","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.linkedin.com/pulse/cyber-criminals-using-evilproxy-phishing-kit-target-senior-soral/","pattern":"[url:value = 'https://www.linkedin.com/pulse/cyber-criminals-using-evilproxy-phishing-kit-target-senior-soral/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38675864-038c-50e9-92cb-0000b026acdf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: indeed.com","pattern":"[domain-name:value = 'indeed.com']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1ec6a14-1e16-3633-2e25-0000d9f763dd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-widely-abused-msix-app-installer-disabled-by-microsoft-active-iocs/","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-widely-abused-msix-app-installer-disabled-by-microsoft-active-iocs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94beaa47-47b0-31b4-68f9-0000f9921497","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/cglyer/status/1546297609215696897","pattern":"[url:value = 'https://twitter.com/cglyer/status/1546297609215696897']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac3cace9-72ab-a948-d132-00007f98214f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://readme.security/cybercrime-is-more-of-a-threat-than-nation-state-hackers-6f6cccf47721","pattern":"[url:value = 'https://readme.security/cybercrime-is-more-of-a-threat-than-nation-state-hackers-6f6cccf47721']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--105391b3-8b07-692d-247b-0000a956bee2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/east-tennessee-childrens-hospital-updates-information-on-ransomware-incident/","pattern":"[url:value = 'https://www.databreaches.net/east-tennessee-childrens-hospital-updates-information-on-ransomware-incident/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--562511d6-35fb-91dc-1099-000065affb2d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.enigmasoftware.com/nwgenransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/nwgenransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c1e3737-eb94-da39-644c-0000bf5a2ba0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decoded.avast.io/threatresearch/avast-q2-2023-threat-report/","pattern":"[url:value = 'https://decoded.avast.io/threatresearch/avast-q2-2023-threat-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af895b9a-312b-a13f-f44b-0000c9d9c73c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape","pattern":"[url:value = 'https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da4ed1e6-78f2-b82a-4c34-0000505e71af","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/research/akira-ransomware.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/research/akira-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20a894eb-bc2d-5640-d86f-00009ce11e0b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/crimeware-report-fakesg-akira-amos/111483/","pattern":"[url:value = 'https://securelist.com/crimeware-report-fakesg-akira-amos/111483/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e15c660a-37e0-799a-473f-0000a89b1167","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.sophos.com/en-us/2023/12/20/cryptoguard-an-asymmetric-approach-to-the-ransomware-battle/","pattern":"[url:value = 'https://news.sophos.com/en-us/2023/12/20/cryptoguard-an-asymmetric-approach-to-the-ransomware-battle/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fa9dfbf-de8c-b5e6-6728-000093de3e60","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.microsoft.com/on-the-issues/2023/12/13/cybercrime-cybersecurity-storm-1152-fraudulent-accounts/","pattern":"[url:value = 'https://blogs.microsoft.com/on-the-issues/2023/12/13/cybercrime-cybersecurity-storm-1152-fraudulent-accounts/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15cda5c3-4132-e2fe-89c4-0000513a9b03","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityboulevard.com/2023/12/microsoft-storm-1152-crackdown-stopping-threat-actors/","pattern":"[url:value = 'https://securityboulevard.com/2023/12/microsoft-storm-1152-crackdown-stopping-threat-actors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b7d5874-b5ca-24da-9a03-0000fb585f64","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/monthly-news-november-2023/ba-p/3970796","pattern":"[url:value = 'https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/monthly-news-november-2023/ba-p/3970796']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c893740-e2ac-b973-ca3d-0000808f53b2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-update-microsoft-warns-of-emerging-threat-by-storm-0539-behind-gift-card-frauds/","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-update-microsoft-warns-of-emerging-threat-by-storm-0539-behind-gift-card-frauds/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19969320-1f24-d76c-344a-00008f3becff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.picussecurity.com/resource/h0lygh0st-north-korean-threat-group-strikes-back-with-new-ransomware","pattern":"[url:value = 'https://www.picussecurity.com/resource/h0lygh0st-north-korean-threat-group-strikes-back-with-new-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--520ea704-b2a6-ff9f-cc27-0000f581ea09","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19b9712b-51ab-259a-4a29-000044f7af29","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.blackberry.com/en/2022/08/h0lygh0st-ransomware","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/08/h0lygh0st-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa1646e0-5e28-26c8-64a2-00000f63c826","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d32a0db7-d907-03f9-99fe-00005a721a73","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.microsoft.com/on-the-issues/2023/12/07/russia-ukraine-digital-threat-celebrity-cameo-mtac/","pattern":"[url:value = 'https://blogs.microsoft.com/on-the-issues/2023/12/07/russia-ukraine-digital-threat-celebrity-cameo-mtac/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--031c87a4-94b9-460a-c05b-00004ac4e2d2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://circleid.com/posts/20230824-signs-of-muddywater-developments-found-in-the-dns","pattern":"[url:value = 'https://circleid.com/posts/20230824-signs-of-muddywater-developments-found-in-the-dns']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb5a7378-ba31-a39a-8fdf-00002138ee72","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://services.google.com/fh/files/misc/m-trends-2025-en.pdf","pattern":"[url:value = 'https://services.google.com/fh/files/misc/m-trends-2025-en.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fccdcaab-47c3-4c8a-cfd2-0000f59b761a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.enigmasoftware.com/moneybirdransomware-removal/","pattern":"[url:value = 'https://www.enigmasoftware.com/moneybirdransomware-removal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a6f83c2-641c-9e09-b083-0000abfeb0eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/iran-linked-hackers-target-israel-education-tech-sectors","pattern":"[url:value = 'https://therecord.media/iran-linked-hackers-target-israel-education-tech-sectors']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73a6938a-150b-3adf-ba13-00007d0d048f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/agonizing-serpens-attack-detection-iran-backed-hackers-target-israeli-tech-firms-and-educational-institutions/","pattern":"[url:value = 'https://socprime.com/blog/agonizing-serpens-attack-detection-iran-backed-hackers-target-israeli-tech-firms-and-educational-institutions/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--307b3c65-45db-95be-2f45-00000e4e9d1e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.oodaloop.com/archive/2024/01/02/critical-infrastructure-remains-the-brass-ring-for-cyber-attackers-in-2024/","pattern":"[url:value = 'https://www.oodaloop.com/archive/2024/01/02/critical-infrastructure-remains-the-brass-ring-for-cyber-attackers-in-2024/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2deed75-57d8-d289-6d50-00002cf79dc5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MsftSecIntel/status/1730383711437283757","pattern":"[url:value = 'https://twitter.com/MsftSecIntel/status/1730383711437283757']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8935e7a-ec18-a6e3-ac51-0000e02e1ae4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://gbhackers.com/vedalia-apt-group-exploits/","pattern":"[url:value = 'https://gbhackers.com/vedalia-apt-group-exploits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16df7c5a-536d-4d1b-dfae-000000bb1761","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.securonix.com/blog/stiffbizon-detection-new-attack-campaign-observed/","pattern":"[url:value = 'https://www.securonix.com/blog/stiffbizon-detection-new-attack-campaign-observed/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05b70544-cccd-f2ce-3546-0000ab97b2dd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-konni-apt-group-active-iocs-11","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-konni-apt-group-active-iocs-11']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ba37036-16db-d1ba-acf7-0000b4705763","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://paper.seebug.org/3031/","pattern":"[url:value = 'https://paper.seebug.org/3031/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d615610b-dd60-3a04-02f4-0000e9181494","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb7a0be3-0c02-0e42-891f-00000cf66a45","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MsftSecIntel/status/1696273952870367320","pattern":"[url:value = 'https://twitter.com/MsftSecIntel/status/1696273952870367320']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d990c5c1-c9dd-5848-61e1-00002299094f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/monthly-news-july-2023/ba-p/3860740","pattern":"[url:value = 'https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/monthly-news-july-2023/ba-p/3860740']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c31dced7-3de5-e557-34aa-00004acff0c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MsftSecIntel/status/1570911625841983489","pattern":"[url:value = 'https://twitter.com/MsftSecIntel/status/1570911625841983489']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afeaa5ac-d39c-ba73-c15e-0000b7bba2cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.microsoft.com/on-the-issues/2020/11/13/health-care-cyberattacks-covid-19-paris-peace-forum/","pattern":"[url:value = 'https://blogs.microsoft.com/on-the-issues/2020/11/13/health-care-cyberattacks-covid-19-paris-peace-forum/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74747e9d-7e37-9375-396b-0000e7698f24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MsftSecIntel/status/1535417776290111489","pattern":"[url:value = 'https://twitter.com/MsftSecIntel/status/1535417776290111489']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b42d48a8-34f0-cb5d-04dd-00005e62d0ba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://riskybiznews.substack.com/p/risky-biz-news-google-shuts-down","pattern":"[url:value = 'https://riskybiznews.substack.com/p/risky-biz-news-google-shuts-down']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d03fa29-9002-413a-83d4-0000b4b06011","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityboulevard.com/2022/10/analysis-of-cisa-releases-advisory-on-top-cves-exploited-chinese-state-sponsored-groups/","pattern":"[url:value = 'https://securityboulevard.com/2022/10/analysis-of-cisa-releases-advisory-on-top-cves-exploited-chinese-state-sponsored-groups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb3e05fb-8ade-3c85-b25f-0000f1f1308a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/","pattern":"[url:value = 'https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--befdf51b-c955-8e7f-a47e-00004ec292d8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2","pattern":"[url:value = 'https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e18e347a-c948-60ec-f16b-00001c3af519","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation","pattern":"[url:value = 'https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1ae4de8-43c0-f33b-37b3-0000273e7ba0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94e5a23c-3336-38d3-6fac-000095569152","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thehackernews.com/2022/03/second-new-isaacwiper-data-wiper.html","pattern":"[url:value = 'https://thehackernews.com/2022/03/second-new-isaacwiper-data-wiper.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0247f405-226c-e16e-ef2a-00006ad577cd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/ESETresearch/status/1503436420886712321","pattern":"[url:value = 'https://twitter.com/ESETresearch/status/1503436420886712321']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c7e74f9-afbe-c440-09e3-0000b28ded04","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/","pattern":"[url:value = 'http://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b05e83e2-553c-2b22-df11-0000c26df6ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/defender-experts-chronicles-a-deep-dive-into-storm-0867/ba-p/3911769","pattern":"[url:value = 'https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/defender-experts-chronicles-a-deep-dive-into-storm-0867/ba-p/3911769']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5dea29ba-4b08-1823-2742-00003826aab8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e4befc9-55de-e6d0-47aa-000052e09f44","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/","pattern":"[url:value = 'https://www.welivesecurity.com/2021/11/16/strategic-web-compromises-middle-east-pinch-candiru/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba06d3ea-5e79-9227-3f83-00001375238b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/","pattern":"[url:value = 'https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6649e43a-88f7-1308-e4ff-0000e898ea52","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/","pattern":"[url:value = 'https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e276a6a6-1fe4-eb1f-41f4-000068b8abf8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decoded.avast.io/threatresearch/avast-q2-2022-threat-report/","pattern":"[url:value = 'https://decoded.avast.io/threatresearch/avast-q2-2022-threat-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7361f0a-bd6f-9141-c60b-0000fb015b98","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/unc4990-evolution-usb-malware","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/unc4990-evolution-usb-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed531b9f-ae1f-f974-47a0-0000596d715a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/","pattern":"[url:value = 'https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba8f9e92-0833-cbbd-07d7-0000982410af","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec725af6-4a7b-7988-2007-0000bb60efee","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/monthly-news-december-2023/ba-p/3998431","pattern":"[url:value = 'https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/monthly-news-december-2023/ba-p/3998431']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c915b0a4-2a31-3b7f-de43-0000a31ffa88","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/security/blog/2021/11/18/iranian-targeting-of-it-sector-on-the-rise/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2021/11/18/iranian-targeting-of-it-sector-on-the-rise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff5a67df-2aa6-4834-80bf-0000d3a172d6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2023/11/09/microsoft-shares-threat-intelligence-at-cyberwarcon-2023/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2023/11/09/microsoft-shares-threat-intelligence-at-cyberwarcon-2023/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87276546-a4c3-416c-2ee5-00003de19ed2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://precisionpconline.com/a-unified-front-against-cyber-mercenaries/","pattern":"[url:value = 'https://precisionpconline.com/a-unified-front-against-cyber-mercenaries/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58dba230-ecbf-9e3d-4d3a-00005d2d7551","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8912a98e-3463-7ca8-a427-000093a10545","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/threats-of-commercialized-malware-knotweed/","pattern":"[url:value = 'https://socradar.io/threats-of-commercialized-malware-knotweed/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1165e05-1126-a7f5-865e-00002251423f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.thezdi.com/blog/2023/1/23/activation-context-cache-poisoning-exploiting-csrss-for-privilege-escalation","pattern":"[url:value = 'https://www.thezdi.com/blog/2023/1/23/activation-context-cache-poisoning-exploiting-csrss-for-privilege-escalation']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bce11e5f-dd2d-8389-77fe-000090dac1ae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.sonicwall.com/en-us/2024/01/blackwood-apt-group-has-a-new-dll-loader/","pattern":"[url:value = 'https://blog.sonicwall.com/en-us/2024/01/blackwood-apt-group-has-a-new-dll-loader/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ddcbadf-e707-fa2b-1bb1-0000e3ecef53","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1f9a0f1-6523-91c0-1b36-00002a16aae9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/business/security-insider/threat-briefs/iran-response-for-charlie-hebdo-attacks/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/business/security-insider/threat-briefs/iran-response-for-charlie-hebdo-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a952ac98-0819-7476-7642-000080a16f72","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ic3.gov/Media/News/2022/220126.pdf","pattern":"[url:value = 'https://www.ic3.gov/Media/News/2022/220126.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cc92719-259e-0499-a09c-0000dffc152c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.microsoft.com/on-the-issues/2023/02/03/dtac-charlie-hebdo-hack-iran-neptunium/","pattern":"[url:value = 'https://blogs.microsoft.com/on-the-issues/2023/02/03/dtac-charlie-hebdo-hack-iran-neptunium/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfa965bf-75e6-1592-6726-00008df47892","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.sekoia.io/iran-cyber-threat-overview/","pattern":"[url:value = 'https://blog.sekoia.io/iran-cyber-threat-overview/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ecde49a-a9e5-2716-d451-0000db35f023","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-uses-spanish-language-lures-distribute-seldom-observed-bandook","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-uses-spanish-language-lures-distribute-seldom-observed-bandook']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14bcdf25-2c1b-5dcb-0522-00000e87e7c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/this-app-will-self-destruct-how-belarusian-hackers-created-an-alternative-telegram-for-activists/","pattern":"[url:value = 'https://therecord.media/this-app-will-self-destruct-how-belarusian-hackers-created-an-alternative-telegram-for-activists/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd8c36b8-2718-79bd-6c7b-00005229b4c5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/pro-ukraine-hackers-leak-russian-data-in-hopes-someone-will-make-sense-of-it/","pattern":"[url:value = 'https://therecord.media/pro-ukraine-hackers-leak-russian-data-in-hopes-someone-will-make-sense-of-it/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acc36c5b-6557-4c3f-4e98-00005fba33f2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/cyber-partisans-belarusian-state-university-attack","pattern":"[url:value = 'https://therecord.media/cyber-partisans-belarusian-state-university-attack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4062cee-103c-679c-f9b6-00008758767b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://riskybiznews.substack.com/p/risky-biz-news-cyber-partisans-hack","pattern":"[url:value = 'https://riskybiznews.substack.com/p/risky-biz-news-cyber-partisans-hack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--674a8324-f26a-e2e3-2dac-00004d95c8f3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.sekoia.io/the-transportation-sector-cyber-threat-overview/","pattern":"[url:value = 'https://blog.sekoia.io/the-transportation-sector-cyber-threat-overview/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc21588f-aaaf-db86-c66d-00002014dedd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/global-threat-report/","pattern":"[url:value = 'https://www.crowdstrike.com/global-threat-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11cb5b10-f97b-33a2-801b-0000bda97968","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0812d06e-053e-59bf-7244-0000c4be17db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/blog/china-linked-tag-28-targets-indias-the-times-group","pattern":"[url:value = 'https://www.recordedfuture.com/blog/china-linked-tag-28-targets-indias-the-times-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e7d671-a1ba-1ea7-59e4-0000484952ef","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/","pattern":"[url:value = 'https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--075967b3-e27e-fefe-11f0-00000b6511d0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://quointelligence.eu/2024/01/unc5221-unreported-and-undetected-wirefire-web-shell-variant/","pattern":"[url:value = 'https://quointelligence.eu/2024/01/unc5221-unreported-and-undetected-wirefire-web-shell-variant/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d3c7b2b-e115-e420-c97b-000023ca3078","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-advisory-ivanti-vpn-zero-days-weaponized-by-unc5221-threat-actors-to-deploy-multiple-malware-families-active-iocs/","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-advisory-ivanti-vpn-zero-days-weaponized-by-unc5221-threat-actors-to-deploy-multiple-malware-families-active-iocs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4901006f-af61-84de-0aa0-0000c0faf96c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.securityweek.com/palestinian-hackers-hit-100-israeli-organizations-in-destructive-attacks/","pattern":"[url:value = 'https://www.securityweek.com/palestinian-hackers-hit-100-israeli-organizations-in-destructive-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e7cf8ff-2295-0410-73b8-0000cf38277f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.polyswarm.io/2023-recap-cyber-activity-in-the-gaza-conflict","pattern":"[url:value = 'https://blog.polyswarm.io/2023-recap-cyber-activity-in-the-gaza-conflict']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7530507-cd54-e289-96ba-00007e2ca7d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2023/11th-december-threat-intelligence-report/","pattern":"[url:value = 'https://research.checkpoint.com/2023/11th-december-threat-intelligence-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd20a3eb-5eaa-77f6-2555-0000ef85b5f0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-web-profile-cyber-toufan-al-aqsa/","pattern":"[url:value = 'https://socradar.io/dark-web-profile-cyber-toufan-al-aqsa/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c57a389f-5c28-ae0b-cfad-0000a5769e7f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkreading.com/cyberattacks-data-breaches/-cyber-toufan-hacktivists-leaked-100-plus-israeli-orgs-in-one-month","pattern":"[url:value = 'https://www.darkreading.com/cyberattacks-data-breaches/-cyber-toufan-hacktivists-leaked-100-plus-israeli-orgs-in-one-month']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12934a18-0f8f-ddd2-df42-000085d3d205","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2021/10/11/iran-linked-dev-0343-targeting-defense-gis-and-maritime-sectors/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2021/10/11/iran-linked-dev-0343-targeting-defense-gis-and-maritime-sectors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c27f75c-686d-9801-344a-00006f275077","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.deepinstinct.com/blog/threat-actor-uac-0099-continues-to-target-ukraine","pattern":"[url:value = 'https://www.deepinstinct.com/blog/threat-actor-uac-0099-continues-to-target-ukraine']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08b22a7c-b401-93fd-b739-0000e399ca1a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/4818341","pattern":"[url:value = 'https://cert.gov.ua/article/4818341']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--691a03e5-4573-b833-4f4a-00008d10fd35","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--277f2280-cbe1-4eb1-9dd3-0000724b7484","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.attackiq.com/2022/09/23/attack-graph-response-to-us-cert-alert-aa22-264a-iranian-state-actors-conduct-cyber-operations-against-the-government-of-albania/","pattern":"[url:value = 'https://www.attackiq.com/2022/09/23/attack-graph-response-to-us-cert-alert-aa22-264a-iranian-state-actors-conduct-cyber-operations-against-the-government-of-albania/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7329eca-7b3e-82a1-fe62-00004f5ba0db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.picussecurity.com/resource/blog/cisa-alert-aa22-264a-iranian-homeland-justice-apt-groups-ttp","pattern":"[url:value = 'https://www.picussecurity.com/resource/blog/cisa-alert-aa22-264a-iranian-homeland-justice-apt-groups-ttp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a8bb4f1-4662-afd2-f7a3-0000bab36d27","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ibtimes.com/anonymous-challenges-russias-supposed-cyber-prowess-repeat-rosatom-breach-leaks-data-3505131","pattern":"[url:value = 'https://www.ibtimes.com/anonymous-challenges-russias-supposed-cyber-prowess-repeat-rosatom-breach-leaks-data-3505131']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5644beaa-cdf3-4b5d-69a1-00002b6e9bf1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/bits-n-pieces-trozos-y-piezas-31/","pattern":"[url:value = 'https://www.databreaches.net/bits-n-pieces-trozos-y-piezas-31/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f8d08f9-d54a-6270-3c5e-000015b3783b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.privacyaffairs.com/kelvinsecurity-hacking-group-morena/","pattern":"[url:value = 'https://www.privacyaffairs.com/kelvinsecurity-hacking-group-morena/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c17d7a7f-471d-cb2d-1607-000050bff6ff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/kaspersky-security-bulletin-apt-predictions-2024/111048/","pattern":"[url:value = 'https://securelist.com/kaspersky-security-bulletin-apt-predictions-2024/111048/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b01d1cbf-c175-93c3-ead7-0000bf05cdb7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.newslocker.com/en-uk/profession/security/ohio-schools-get-new-cybersecurity-resource/","pattern":"[url:value = 'https://www.newslocker.com/en-uk/profession/security/ohio-schools-get-new-cybersecurity-resource/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fd33b6a-5942-97aa-9f1c-0000925e6721","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityonline.info/esentire-vs-phantom-unveiling-the-cyber-spooks-dance-of-darkness/","pattern":"[url:value = 'https://securityonline.info/esentire-vs-phantom-unveiling-the-cyber-spooks-dance-of-darkness/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74577ef4-08a2-c1e1-e922-000002080ef9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.esentire.com/blog/operation-phantomcontrol","pattern":"[url:value = 'https://www.esentire.com/blog/operation-phantomcontrol']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--061fa52c-1750-77d2-b596-00009b59bf75","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.esentire.com/blog/phantomcontrol-returns-with-ande-loader-and-swaetrat","pattern":"[url:value = 'https://www.esentire.com/blog/phantomcontrol-returns-with-ande-loader-and-swaetrat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6459b235-85e9-08ca-62ea-0000129247db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/badbazaar-espionage-tool-targets-android-users-trojanized-signal-telegram-apps/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/badbazaar-espionage-tool-targets-android-users-trojanized-signal-telegram-apps/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--886deca2-6bf8-4559-a5f6-0000ef426d2d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/gambleforce-gang/","pattern":"[url:value = 'https://www.group-ib.com/blog/gambleforce-gang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68da20bf-797f-72a0-721e-0000c9f6e383","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e55a70c6-774e-269e-71d2-0000c5d56ea5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://dev.ua/ru/news/atakovali-suspilne-provaiderov-i-minrazvitiya-obschin-kto-stoit-za-rossiiskoi-gruppirovkoi-solntsepek-kotoraya-aktivizirovala-napadeniya-na-ukrainskie-struktury","pattern":"[url:value = 'https://dev.ua/ru/news/atakovali-suspilne-provaiderov-i-minrazvitiya-obschin-kto-stoit-za-rossiiskoi-gruppirovkoi-solntsepek-kotoraya-aktivizirovala-napadeniya-na-ukrainskie-struktury']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--922ec7ea-e6f4-1ca8-af0b-0000086e5c0c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://kyivindependent.com/sbu-russian-hacker-group-reponsible-for-kyiv-star-cyberattack/","pattern":"[url:value = 'https://kyivindependent.com/sbu-russian-hacker-group-reponsible-for-kyiv-star-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e323f00f-3641-0ef1-7e3c-000049f192bf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67bf314f-bd2c-b6fd-f0af-00001233269b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group","pattern":"[url:value = 'https://www.securityjoes.com/post/bibi-linux-a-new-wiper-dropped-by-pro-hamas-hacktivist-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8095c672-3a7c-4495-2756-0000bec6ee13","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thehackernews.com/2023/11/new-bibi-windows-wiper-targets-windows.html","pattern":"[url:value = 'https://thehackernews.com/2023/11/new-bibi-windows-wiper-targets-windows.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--672cbfeb-9223-6fec-7251-00000044a41c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/knight0x07/BiBi-Windows-Wiper-Analysis?tab=readme-ov-file","pattern":"[url:value = 'https://github.com/knight0x07/BiBi-Windows-Wiper-Analysis?tab=readme-ov-file']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e78a12f-049b-cbf7-5142-00002ea530db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/ESETresearch/status/1719437301900595444","pattern":"[url:value = 'https://twitter.com/ESETresearch/status/1719437301900595444']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--394e422e-be19-33ba-973e-0000958e6f6d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/","pattern":"[url:value = 'https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe2eccca-58ff-1b75-a49c-0000d3d7c34b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/sandman-apt-china-based-adversaries-embrace-lua/","pattern":"[url:value = 'https://www.sentinelone.com/labs/sandman-apt-china-based-adversaries-embrace-lua/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37c88e0e-0967-751b-0124-0000ce5797d4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/3804703","pattern":"[url:value = 'https://cert.gov.ua/article/3804703']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0b3377f-e9b1-4947-8738-000069b42871","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/new-phishing-attack-detection-attributed-to-the-uac-0050-and-uac-0096-groups-spreading-remcos-spyware/","pattern":"[url:value = 'https://socprime.com/blog/new-phishing-attack-detection-attributed-to-the-uac-0050-and-uac-0096-groups-spreading-remcos-spyware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e373dfd0-59e5-feb9-a35a-0000b653892b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/remcos-rat-detection-uac-0050-hackers-launch-phishing-attacks-impersonating-the-security-service-of-ukraine/","pattern":"[url:value = 'https://socprime.com/blog/remcos-rat-detection-uac-0050-hackers-launch-phishing-attacks-impersonating-the-security-service-of-ukraine/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b895a64-e006-e9cd-7243-00006f98a823","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/3931296","pattern":"[url:value = 'https://cert.gov.ua/article/3931296']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b430cfc4-caf6-3994-d7e0-0000086b80ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://outpost24.com/blog/ics-attack-classifications/","pattern":"[url:value = 'https://outpost24.com/blog/ics-attack-classifications/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8aeb184-a490-1ebe-858f-0000defae72c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://spixnet.at/cybersecurity-blog/2022/11/15/russian-hacktivists-hit-ukrainian-orgs-with-ransomware-but-no-ransom-demands/","pattern":"[url:value = 'https://spixnet.at/cybersecurity-blog/2022/11/15/russian-hacktivists-hit-ukrainian-orgs-with-ransomware-but-no-ransom-demands/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eccfbf1c-85aa-d5c1-edbb-000089cc7200","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/somnia-malware-detection-uac-0118-aka-frwl-launches-cyber-attacks-against-organizations-in-ukraine-using-enhanced-malware-strains/","pattern":"[url:value = 'https://socprime.com/blog/somnia-malware-detection-uac-0118-aka-frwl-launches-cyber-attacks-against-organizations-in-ukraine-using-enhanced-malware-strains/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a62cec3-7065-94a2-c0bf-0000915a9789","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-espionage-campaign-in-israel.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2021/08/unc215-chinese-espionage-campaign-in-israel.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--413e26cf-d1fc-1f35-4adc-00006c3a0a1d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.esentire.com/security-advisories/ransomware-hackers-attack-a-top-safety-testing-org-using-tactics-and-techniques-borrowed-from-chinese-espionage-groups","pattern":"[url:value = 'https://www.esentire.com/security-advisories/ransomware-hackers-attack-a-top-safety-testing-org-using-tactics-and-techniques-borrowed-from-chinese-espionage-groups']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6f9e2f8-5452-b6de-2dd0-0000e788bcd6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-financially-motivated-aggressive-group-carrying-out-ransomware-campaigns-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-financially-motivated-aggressive-group-carrying-out-ransomware-campaigns-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58e5d409-2532-ca54-13bf-0000ce936895","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://internal-www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html","pattern":"[url:value = 'http://internal-www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69ed014d-3735-fa21-1711-00004b94f4d0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:02-04:00","name":"url: https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65dfdd7b-b5e4-d156-844c-00008e28b66d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.esentire.com/blog/hacker-infrastructure-used-in-cisco-breach-discovered-attacking-a-top-workforce-management-corporation-russias-evil-corp-gang-suspected-reports-esentire","pattern":"[url:value = 'https://www.esentire.com/blog/hacker-infrastructure-used-in-cisco-breach-discovered-attacking-a-top-workforce-management-corporation-russias-evil-corp-gang-suspected-reports-esentire']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3f15c12-7099-6331-83c2-00003760e2b1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/","pattern":"[url:value = 'https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48b19ca8-01eb-24bc-a150-0000428f0f32","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.blackberry.com/en/2023/11/aeroblade-on-the-hunt-targeting-us-aerospace-industry","pattern":"[url:value = 'https://blogs.blackberry.com/en/2023/11/aeroblade-on-the-hunt-targeting-us-aerospace-industry']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dca3ae9f-99c0-91b7-c610-00007d62d98a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://internal-www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html","pattern":"[url:value = 'http://internal-www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9751a597-eb31-c4df-b5dc-0000c336c282","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c439db63-329b-62c2-a410-0000832ea4cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/update-daixin-leaks-more-data-from-bluewater-health-and-other-hospitals-databases-yet-to-be-leaked/","pattern":"[url:value = 'https://www.databreaches.net/update-daixin-leaks-more-data-from-bluewater-health-and-other-hospitals-databases-yet-to-be-leaked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7bba2cf-b540-efe6-6bb0-0000ae07207b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://titaniam.io/ransomware-prevention-daixin-team-ransomware-group/","pattern":"[url:value = 'https://titaniam.io/ransomware-prevention-daixin-team-ransomware-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--684c690a-e873-53f5-05b7-000032b41d45","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/b-files-leaked/","pattern":"[url:value = 'https://www.databreaches.net/b-files-leaked/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00c99f43-12bb-331e-2014-000092cb9af6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=467c2374-9c18-4fb0-b5a7-155dfca4d611","pattern":"[url:value = 'https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=467c2374-9c18-4fb0-b5a7-155dfca4d611']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7f70b99-d1a9-09aa-70be-0000c6997852","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-294a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-294a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75ec7f60-4583-f7c7-de76-0000bdba4591","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.malwarebytes.com/blog/threat-intelligence/2023/11/associated-press-espn-cbs-among-top-sites-serving-fake-virus-alerts","pattern":"[url:value = 'https://www.malwarebytes.com/blog/threat-intelligence/2023/11/associated-press-espn-cbs-among-top-sites-serving-fake-virus-alerts']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01305d1f-9a63-7462-b3e0-0000cac0b257","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.confiant.com/exploring-scamclub-payloads-via-deobfuscation-using-abstract-syntax-trees-65ef7f412537","pattern":"[url:value = 'https://blog.confiant.com/exploring-scamclub-payloads-via-deobfuscation-using-abstract-syntax-trees-65ef7f412537']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e6e718d-3787-a36c-cb7d-000081b5c99b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/","pattern":"[url:value = 'https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14c574b9-3278-6703-e3b7-00009ea40ae8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/operation-tunnelsnake/","pattern":"[url:value = 'https://www.redpacketsecurity.com/operation-tunnelsnake/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aae3286-00f9-b8b3-7f10-0000cdd0f848","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/","pattern":"[url:value = 'https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86c3ce23-ed6b-392c-d09b-00009969d45b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/wildpressure-targets-industrial-related-entities-in-the-middle-east/","pattern":"[url:value = 'https://www.redpacketsecurity.com/wildpressure-targets-industrial-related-entities-in-the-middle-east/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fff3203-93ee-f1a5-4968-000036424054","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/wildpressure-targets-macos/103072/","pattern":"[url:value = 'https://securelist.com/wildpressure-targets-macos/103072/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e258ed9-e286-0d08-5a5e-0000982a2a0d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/it-threat-evolution-q3-2021/","pattern":"[url:value = 'https://www.redpacketsecurity.com/it-threat-evolution-q3-2021/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6006b2d6-f60d-6c7e-229f-000042e26543","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://intezer.com/blog/research/wildcard-evolution-of-sysjoker-cyber-threat/","pattern":"[url:value = 'https://intezer.com/blog/research/wildcard-evolution-of-sysjoker-cyber-threat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd826ad4-c504-ad79-6eaf-0000e252b9ae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://checkmarx.com/blog/a-beautiful-factory-for-malicious-packages/","pattern":"[url:value = 'https://checkmarx.com/blog/a-beautiful-factory-for-malicious-packages/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3274c9af-f003-6061-9b21-00006b0286e3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--853c200a-8e01-e7e9-2816-0000430a98d8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/unc2891-overview","pattern":"[url:value = 'https://www.mandiant.com/resources/unc2891-overview']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f836c83-4683-27a1-349b-0000aafc1679","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fortinet.com/blog/threat-research/guidance-on-hacktivist-operation-opspatuk-by-dragonforce","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/guidance-on-hacktivist-operation-opspatuk-by-dragonforce']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf32d1af-7da1-3def-66b2-000076a6fae2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.radware.com/security/ddos/2022/08/this-was-h1-2022-part-3-beyond-the-war/","pattern":"[url:value = 'https://blog.radware.com/security/ddos/2022/08/this-was-h1-2022-part-3-beyond-the-war/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5b5ad6a-20dd-9473-8364-000011948e3a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.radware.com/security/threat-advisories-and-attack-reports/opisrael-a-decade-in-review/","pattern":"[url:value = 'https://www.radware.com/security/threat-advisories-and-attack-reports/opisrael-a-decade-in-review/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1542ec1e-2262-ed08-f2ca-000088d7579d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securitybrief.asia/story/dragonforce-malaysia-attacks-israeli-institutions-radware","pattern":"[url:value = 'https://securitybrief.asia/story/dragonforce-malaysia-attacks-israeli-institutions-radware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--088e0359-2e76-a605-ada1-0000b636ad7d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.radware.com/security/2023/05/india-one-of-the-most-targeted-countries-for-hacktivist-groups/","pattern":"[url:value = 'https://blog.radware.com/security/2023/05/india-one-of-the-most-targeted-countries-for-hacktivist-groups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d66be80f-70c7-b538-1715-0000b3edc371","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/","pattern":"[url:value = 'https://www.darkowl.com/blog-content/hacktivist-groups-use-defacements-in-the-israel-hamas-conflict/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28186c95-5659-e9f4-5f7b-0000d58a8360","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms","pattern":"[url:value = 'https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f6c443f-c612-0e0e-e272-00000b50400e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/buhti-ransomware-gang-switches-tactics-utilizes-leaked-lockbit-and-babuk-code/","pattern":"[url:value = 'https://www.redpacketsecurity.com/buhti-ransomware-gang-switches-tactics-utilizes-leaked-lockbit-and-babuk-code/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4cea8426-93a6-928f-187c-0000d7862999","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/new-buhti-ransomware-gang-uses-leaked-windows-linux-encryptors/","pattern":"[url:value = 'https://www.redpacketsecurity.com/new-buhti-ransomware-gang-uses-leaked-windows-linux-encryptors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60aed758-1682-cc49-181c-000069cee7f1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://fortiguard.fortinet.com/threat-signal-report/5170","pattern":"[url:value = 'https://fortiguard.fortinet.com/threat-signal-report/5170']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd71e15e-6436-6aae-e873-0000f233c5ee","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/buhti-ransomware","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/buhti-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66dad091-2d48-de90-9bef-0000ef9969da","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/unc2165-shifts-to-evade-sanctions","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/unc2165-shifts-to-evade-sanctions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cb7f412-2985-020c-a52a-0000ce01305a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.prodaft.com/resource/detail/silverfish-global-cyber-espionage-campaign-case-report","pattern":"[url:value = 'https://www.prodaft.com/resource/detail/silverfish-global-cyber-espionage-campaign-case-report']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9334bd84-0813-11dc-f339-00006295d221","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.truesec.com/hub/blog/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies","pattern":"[url:value = 'https://www.truesec.com/hub/blog/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15d7b82b-da95-0269-7776-0000f4c58f7d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa6b9201-5034-818a-eda5-00006ca37f2b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/ta402-uses-complex-ironwind-infection-chains-target-middle-east-based-government","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/ta402-uses-complex-ironwind-infection-chains-target-middle-east-based-government']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85d42c45-fc24-ac3d-bbd4-00003aa87763","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cybersecurityintelligence.com/blog/outsourced-cyber-spying-5335.html","pattern":"[url:value = 'https://www.cybersecurityintelligence.com/blog/outsourced-cyber-spying-5335.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5577580a-c649-7a10-59b0-000045e2f3ee","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-gimmick-malware-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-gimmick-malware-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c72f432b-effe-0a49-3fc9-0000b0ebcdf7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.volexity.com/blog/2020/03/31/storm-cloud-unleashed-tibetan-community-focus-of-highly-targeted-fake-flash-campaign/","pattern":"[url:value = 'https://www.volexity.com/blog/2020/03/31/storm-cloud-unleashed-tibetan-community-focus-of-highly-targeted-fake-flash-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--295d02d3-af6d-39c3-1b0f-00005c558125","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/media-center/press-releases/oldgremlin/","pattern":"[url:value = 'https://www.group-ib.com/media-center/press-releases/oldgremlin/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1bc9c6f-60e3-d7f4-7bf5-0000a8def3f3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/oldgremlin-comeback/","pattern":"[url:value = 'https://www.group-ib.com/blog/oldgremlin-comeback/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01251c78-93bd-9fc1-5cd4-000003e7f55d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-new-ransomware-actor-oldgremlin-hits-multiple-organizations","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-new-ransomware-actor-oldgremlin-hits-multiple-organizations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--683e5fca-e947-4fbb-7258-0000940c0a60","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59fd93a5-f335-3c5e-cef0-0000b2a58d04","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.fox-it.com/2021/11/08/ta505-exploits-solarwinds-serv-u-vulnerability-cve-2021-35211-for-initial-access/","pattern":"[url:value = 'https://blog.fox-it.com/2021/11/08/ta505-exploits-solarwinds-serv-u-vulnerability-cve-2021-35211-for-initial-access/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21060ad2-8a7e-21b8-2c3d-000069f7e96e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/sockdetour/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/sockdetour/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3659e3af-3c5d-594b-f599-000041b616ba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/","pattern":"[url:value = 'https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c7a1116-90de-3d83-63ed-00000fd42162","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://mybroadband.co.za/news/security/443090-cybercriminals-love-south-africa-study.html","pattern":"[url:value = 'https://mybroadband.co.za/news/security/443090-cybercriminals-love-south-africa-study.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e398bdc8-bc01-b40e-f825-0000c4754936","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cisoseries.com/cyber-security-headlines-march-21-2022/","pattern":"[url:value = 'https://cisoseries.com/cyber-security-headlines-march-21-2022/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8018ebc-0e02-7bf2-56d9-0000ea35c771","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://mybroadband.co.za/news/security/438982-how-bank-customers-can-protect-themselves-after-hackers-leak-transunion-data.html","pattern":"[url:value = 'https://mybroadband.co.za/news/security/438982-how-bank-customers-can-protect-themselves-after-hackers-leak-transunion-data.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--996aea8e-7a4e-c42c-f63a-0000162be09d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.polyswarm.io/space-pirates-target-russian-aerospace","pattern":"[url:value = 'https://blog.polyswarm.io/space-pirates-target-russian-aerospace']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--962abc81-c82d-2b7e-dccc-0000874a1ced","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-a-look-into-the-group-s-unconventional-techniques-new-attack-vectors-and-tools/","pattern":"[url:value = 'https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-a-look-into-the-group-s-unconventional-techniques-new-attack-vectors-and-tools/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0095d0d-526b-f782-827e-00008a674db0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats","pattern":"[url:value = 'http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/webworm-espionage-rats']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e9fd477-b598-c260-9ad0-0000202cb5cb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.scarletshark.com/perswaysion-threat-actor-updates-their-techniques-and-infrastructure-e9465157a653","pattern":"[url:value = 'https://blog.scarletshark.com/perswaysion-threat-actor-updates-their-techniques-and-infrastructure-e9465157a653']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8e7f4f8-9bbd-cfaa-64b6-0000011f344c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.group-ib.com/perswaysion","pattern":"[url:value = 'https://blog.group-ib.com/perswaysion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64310d65-1ce8-f104-38a0-00005e1a3276","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityintelligence.com/posts/ransomexx-upgrades-rust/","pattern":"[url:value = 'https://securityintelligence.com/posts/ransomexx-upgrades-rust/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a3bcd3a-a8aa-73d6-000f-000012d565d5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2022/28th-november-threat-intelligence-report/","pattern":"[url:value = 'https://research.checkpoint.com/2022/28th-november-threat-intelligence-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8685fb0f-52a9-eae0-b63a-000095b04dcc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.co/wordpress/138933/malware/ransomexx-ransomware-rust-language.html","pattern":"[url:value = 'https://securityaffairs.co/wordpress/138933/malware/ransomexx-ransomware-rust-language.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1069c69-228d-7572-34f9-000087e7d593","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.blackberry.com/en/2023/02/newspenguin-a-previously-unknown-threat-actor-targets-pakistan-with-advanced-espionage-tool","pattern":"[url:value = 'https://blogs.blackberry.com/en/2023/02/newspenguin-a-previously-unknown-threat-actor-targets-pakistan-with-advanced-espionage-tool']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2223c67-e9d7-1e17-c5e3-00001f7da0e2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-newspenguin-threat-actors-targeting-pakistani-entities-with-malicious-campaign-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-newspenguin-threat-actors-targeting-pakistani-entities-with-malicious-campaign-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42f63ce0-4b48-5331-5c1c-00007ab9bb9a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/4555802","pattern":"[url:value = 'https://cert.gov.ua/article/4555802']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca16289c-888c-5ef2-3adf-0000a9f61f0b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/smokeloader-malware-detection-uac-0006-group-reemerges-to-launch-phishing-attacks-against-ukraine-using-financial-subject-lures/","pattern":"[url:value = 'https://socprime.com/blog/smokeloader-malware-detection-uac-0006-group-reemerges-to-launch-phishing-attacks-against-ukraine-using-financial-subject-lures/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--949a97a7-b313-5863-e352-0000069b6858","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/latest-threats/detect-smokeloader-malware-uac-0006-strikes-again-to-target-ukraine-in-a-series-of-phishing-attacks/","pattern":"[url:value = 'https://socprime.com/blog/latest-threats/detect-smokeloader-malware-uac-0006-strikes-again-to-target-ukraine-in-a-series-of-phishing-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc640d56-0dd0-e51d-0980-00006336cc1c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/detecting-smokeloader-campaign-uac-0006-keep-targeting-ukrainian-financial-institutions-in-a-series-of-phishing-attacks/","pattern":"[url:value = 'https://socprime.com/blog/detecting-smokeloader-campaign-uac-0006-keep-targeting-ukrainian-financial-institutions-in-a-series-of-phishing-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--399b1dad-d123-aa08-90d6-0000bd67ad74","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/smokeloader-malware-detection-uac-0006-hackers-launch-a-wave-of-phishing-attacks-against-ukraine-targeting-accountants/","pattern":"[url:value = 'https://socprime.com/blog/smokeloader-malware-detection-uac-0006-hackers-launch-a-wave-of-phishing-attacks-against-ukraine-targeting-accountants/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19a8e9b5-bed8-7a34-bec9-000060521a33","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/smokeloader-detection-uac-0006-group-launches-a-new-phishing-campaign-against-ukraine/","pattern":"[url:value = 'https://socprime.com/blog/smokeloader-detection-uac-0006-group-launches-a-new-phishing-campaign-against-ukraine/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49c35961-7fa7-6210-4426-0000d47791e7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkreading.com/remote-workforce/north-korea-apt-swindled-1b-crypto-investors-2022","pattern":"[url:value = 'https://www.darkreading.com/remote-workforce/north-korea-apt-swindled-1b-crypto-investors-2022']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bc03f43-3a71-38d2-035a-000045109ed0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberscoop.com/north-korean-cryptocurrency-hackers-education-government/","pattern":"[url:value = 'https://cyberscoop.com/north-korean-cryptocurrency-hackers-education-government/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44cae4de-b472-10af-9e8e-000032c24096","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/cyber-awakeness-month-takedown-of-trigona-hive-ransomware-resurges-ransomedforum-and-new-raas-qbit/","pattern":"[url:value = 'https://socradar.io/cyber-awakeness-month-takedown-of-trigona-hive-ransomware-resurges-ransomedforum-and-new-raas-qbit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed37c491-5d28-2017-a432-00001f8c20c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/","pattern":"[url:value = 'https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a18d4df9-30f1-28aa-46ca-000098bdc385","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/mass-spreading-campaign-targeting-zimbra-users/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/mass-spreading-campaign-targeting-zimbra-users/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3fd2ad5-2cab-ec06-95bc-0000d353f04f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.microsoft.com/en-us/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/","pattern":"[url:value = 'http://www.microsoft.com/en-us/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89a48271-8356-7535-c8de-0000794bda78","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/phantom-taurus/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/phantom-taurus/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaaab43e-741c-2c7c-1955-00006c29acd4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/operation-diplomatic-specter/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/operation-diplomatic-specter/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29af9042-a11b-9ed9-85eb-0000b040284a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/","pattern":"[url:value = 'https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bea2b34d-491b-ee70-b074-00007b04643c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_1_5_leon-chang_theo-chen_en.pdf","pattern":"[url:value = 'https://jsac.jpcert.or.jp/archive/2025/pdf/JSAC2025_1_5_leon-chang_theo-chen_en.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--830b5d7d-f2dd-461a-9761-0000309844bf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://mandiant.widen.net/s/qwlxddwdg6/barracuda-cve-2023-2868-hardening","pattern":"[url:value = 'https://mandiant.widen.net/s/qwlxddwdg6/barracuda-cve-2023-2868-hardening']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5de07f30-4c27-9333-e20f-0000d8b02722","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.barracuda.com/company/legal/esg-vulnerability","pattern":"[url:value = 'https://www.barracuda.com/company/legal/esg-vulnerability']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84f1ec45-8e4e-5b9e-e97e-0000ba56746b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/sites/default/files/2023-09/MAR-10454006.r5.v1.CLEAR__0.pdf","pattern":"[url:value = 'https://www.cisa.gov/sites/default/files/2023-09/MAR-10454006.r5.v1.CLEAR__0.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a53fc86-a83c-4c7a-6921-00005ba58ce9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/sites/default/files/2023-08/MAR-10454006.r4.v2.CLEAR_.pdf","pattern":"[url:value = 'https://www.cisa.gov/sites/default/files/2023-08/MAR-10454006.r4.v2.CLEAR_.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24893e94-cc41-6c17-76e6-0000dbcd755f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/sites/default/files/2023-08/MAR-10459736.r1.v1.CLEAR_.pdf","pattern":"[url:value = 'https://www.cisa.gov/sites/default/files/2023-08/MAR-10459736.r1.v1.CLEAR_.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e65c9eb2-fe86-1771-2e0e-0000bfb3d57d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/sites/default/files/2023-07/MAR-10454006.r1.v2.CLEAR_.pdf","pattern":"[url:value = 'https://www.cisa.gov/sites/default/files/2023-07/MAR-10454006.r1.v2.CLEAR_.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80bf263b-adad-5bdf-cabf-000044486266","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/sites/default/files/2023-07/MAR-10454006.r2.v1.CLEAR_.pdf","pattern":"[url:value = 'https://www.cisa.gov/sites/default/files/2023-07/MAR-10454006.r2.v1.CLEAR_.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3944fdd3-02b5-b088-8dc6-0000ab1ad487","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/sites/default/files/2023-07/MAR-10454006.r3.v1.CLEAR_.pdf","pattern":"[url:value = 'https://www.cisa.gov/sites/default/files/2023-07/MAR-10454006.r3.v1.CLEAR_.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--149a5104-fefe-4991-1dc0-00004005fb29","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://sansorg.egnyte.com/dd/8ekLJCPHPj/","pattern":"[url:value = 'https://sansorg.egnyte.com/dd/8ekLJCPHPj/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a21f93ce-758d-be89-4f79-0000b8232a6a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=4zaStuUdvrE","pattern":"[url:value = 'https://www.youtube.com/watch?v=4zaStuUdvrE']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4e1d8ee-e1bf-4066-1c7f-0000c9e62529","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=PSaix1C-UMI","pattern":"[url:value = 'https://www.youtube.com/watch?v=PSaix1C-UMI']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64f56ca3-a002-a253-5454-00002bd784cb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://i.blackhat.com/Asia-24/Presentations/Asia-24-Chen-Chinese-APT.pdf","pattern":"[url:value = 'https://i.blackhat.com/Asia-24/Presentations/Asia-24-Chen-Chinese-APT.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f3811b3-f0a9-2fd6-1d7d-000048b59e66","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34545d64-425f-a5f8-73b6-0000d8bb9092","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation/","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4baf7a85-f0ff-4e21-4385-00008031b38b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://zimpstage.wpengine.com/blog/we-smell-a-ratmilad-mobile-spyware/","pattern":"[url:value = 'https://zimpstage.wpengine.com/blog/we-smell-a-ratmilad-mobile-spyware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d87d2a12-7fff-929c-27e2-0000aa0bf3c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-earth-kitsune-tracking-slub-s-current-operations/","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-earth-kitsune-tracking-slub-s-current-operations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e86c042a-dc7c-9f81-ea6a-0000e1c46e07","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/j/operation-earth-kitsune-a-dance-of-two-new-backdoors.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/j/operation-earth-kitsune-a-dance-of-two-new-backdoors.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf1bce98-8bf3-38a0-c425-0000d86a9f05","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/l/who-is-the-threat-actor-behind-operation-earth-kitsune-.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/l/who-is-the-threat-actor-behind-operation-earth-kitsune-.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26a1e7e9-7bc8-5790-afdb-0000e2ab58f2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/b/earth-kitsune-delivers-new-whiskerspy-backdoor.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/b/earth-kitsune-delivers-new-whiskerspy-backdoor.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00df36c5-b0d3-f12a-bfc3-0000fc624f35","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyfirma.com/?post_type=out-of-band&p=17003","pattern":"[url:value = 'https://www.cyfirma.com/?post_type=out-of-band&p=17003']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22c3b68a-fcfa-3f6e-360e-0000a82641ee","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/","pattern":"[url:value = 'https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--634889c2-9b96-580f-e284-0000f41bed43","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/espionage-group-using-usb-devices-to-hack-targets-in-southeast-asia/","pattern":"[url:value = 'https://therecord.media/espionage-group-using-usb-devices-to-hack-targets-in-southeast-asia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccd53a84-1139-f97d-1b26-0000c15a0e1c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/china-nexus-espionage-southeast-asia","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/china-nexus-espionage-southeast-asia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b619591d-f077-1e9d-6dd6-0000ef9a3be6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/driftingcloud-apt-group-exploits-zero-day-in-sophos-firewall/","pattern":"[url:value = 'https://socradar.io/driftingcloud-apt-group-exploits-zero-day-in-sophos-firewall/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ee315dc-34d2-8b6f-c4d2-00007e53dcb2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-murenshark-apt-threat-actors-aka-actor210426-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-murenshark-apt-threat-actors-aka-actor210426-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b148f73d-9ca8-30a1-b15a-0000fb3f8d04","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/blog/responding-to-chernovites-pipedream-with-dragos-global-services/","pattern":"[url:value = 'https://www.dragos.com/blog/responding-to-chernovites-pipedream-with-dragos-global-services/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d84f0b5-23d1-e5c6-6f18-0000c98adfdc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/threats/the-2022-ics-ot-vulnerability-briefing-recap/","pattern":"[url:value = 'https://www.dragos.com/threats/the-2022-ics-ot-vulnerability-briefing-recap/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b76c1cc-37f5-a821-5076-000007441897","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/blog/industry-news/chernovite-pipedream-malware-targeting-industrial-control-systems/","pattern":"[url:value = 'https://www.dragos.com/blog/industry-news/chernovite-pipedream-malware-targeting-industrial-control-systems/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a456c733-900e-477e-befa-0000d4e8ab8b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/blog/pipedream-mousehole-opcua-module/","pattern":"[url:value = 'https://www.dragos.com/blog/pipedream-mousehole-opcua-module/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10410c30-92ec-57b3-5c72-00007d739e24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.enigmasoftware.com/indonesian-sudanese-cyber-threats-continue-grow-size-scope/","pattern":"[url:value = 'https://www.enigmasoftware.com/indonesian-sudanese-cyber-threats-continue-grow-size-scope/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f6cacb6-eaa0-f6ed-c4a2-0000731319b5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.cyble.com/2023/04/28/indian-ideology-targeted-by-hacktivists-reprisal-hacktivism-draws-more-attacks/","pattern":"[url:value = 'https://blog.cyble.com/2023/04/28/indian-ideology-targeted-by-hacktivists-reprisal-hacktivism-draws-more-attacks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--343674d4-0c4f-7b4c-93a3-0000fa1ff11d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://web-assets.esetstatic.com/wls/2023/01/eset_apt_activity_report_t32022.pdf","pattern":"[url:value = 'https://web-assets.esetstatic.com/wls/2023/01/eset_apt_activity_report_t32022.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca63bd2d-9a92-c7c6-aa54-0000413370c0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://nusenu.medium.com/is-kax17-performing-de-anonymization-attacks-against-tor-users-42e566defce8","pattern":"[url:value = 'https://nusenu.medium.com/is-kax17-performing-de-anonymization-attacks-against-tor-users-42e566defce8']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55e4231f-6e50-e9e7-7e46-0000fac2f0b6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://darknetlive.com/post/who-is-responsible-for-running-hundreds-of-malicious-tor-relays/","pattern":"[url:value = 'https://darknetlive.com/post/who-is-responsible-for-running-hundreds-of-malicious-tor-relays/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e4e86c5-3313-81a9-36dc-00009faf4221","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/a-mysterious-threat-actor-is-running-hundreds-of-malicious-tor-relays","pattern":"[url:value = 'https://therecord.media/a-mysterious-threat-actor-is-running-hundreds-of-malicious-tor-relays']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77f00286-64fa-8e26-9ec7-00009e45b275","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.malwarebytes.com/blog/news/2021/12/was-threat-actor-kax17-de-anonymizing-the-tor-network/amp","pattern":"[url:value = 'https://www.malwarebytes.com/blog/news/2021/12/was-threat-actor-kax17-de-anonymizing-the-tor-network/amp']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d532ff8-41db-f06b-0a38-0000afdf5fb8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/CyberAmyHB/status/1532398956918890500","pattern":"[url:value = 'https://twitter.com/CyberAmyHB/status/1532398956918890500']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--513aeafd-051b-322f-8852-00002bf767a8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.infoblox.com/cyber-threat-intelligence/prolific-puma-shadowy-link-shortening-service-enables-cybercrime/","pattern":"[url:value = 'https://blogs.infoblox.com/cyber-threat-intelligence/prolific-puma-shadowy-link-shortening-service-enables-cybercrime/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ff87a8c-e5d2-78d1-3c04-00007aef4c87","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://nsfocusglobal.com/the-new-apt-group-darkcasino-and-the-global-surge-in-winrar-0-day-exploits/","pattern":"[url:value = 'https://nsfocusglobal.com/the-new-apt-group-darkcasino-and-the-global-surge-in-winrar-0-day-exploits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--393395c6-1002-bf54-d960-0000d2b2b02c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-web-profile-killnet-russian-hacktivist-group/","pattern":"[url:value = 'https://socradar.io/dark-web-profile-killnet-russian-hacktivist-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f46f371-07ca-7874-e082-0000016b113d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://channellife.com.au/story/the-increasing-presence-of-pro-russia-hacktivists","pattern":"[url:value = 'https://channellife.com.au/story/the-increasing-presence-of-pro-russia-hacktivists']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7311f8c3-ec36-c4bd-b28e-0000d14a2683","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.reversinglabs.com/blog/the-week-in-security-possible-colonial-pipeline-2.0-ransomware-hurts-small-american-eateries","pattern":"[url:value = 'https://www.reversinglabs.com/blog/the-week-in-security-possible-colonial-pipeline-2.0-ransomware-hurts-small-american-eateries']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d436f7cc-0926-99a1-83bb-0000f884c8bd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyfirma.com/?post_type=out-of-band&p=17397","pattern":"[url:value = 'https://www.cyfirma.com/?post_type=out-of-band&p=17397']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--456a179f-f415-56dc-ee27-0000aaddb6f6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/killnet-new-capabilities-older-tactics","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/killnet-new-capabilities-older-tactics']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4869da7-7846-6562-b1c3-0000e875dcdd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/gru-disruptive-playbook","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/gru-disruptive-playbook']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26ca33fd-cc25-421d-592e-0000c6b0eb95","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/gru-rise-telegram-minions","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/gru-rise-telegram-minions']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f99f50e-bef2-fe1b-18dd-00001ef05683","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/suspected-iran-nexus-tag-56-uses-uae-forum-lure-for-credential-theft-against-us-think-tank","pattern":"[url:value = 'https://www.recordedfuture.com/suspected-iran-nexus-tag-56-uses-uae-forum-lure-for-credential-theft-against-us-think-tank']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--731bcfc6-2cc3-a597-ba7d-0000a753ad42","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-web-profile-apt42-iranian-cyber-espionage-group/","pattern":"[url:value = 'https://socradar.io/dark-web-profile-apt42-iranian-cyber-espionage-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--744e393b-cbe0-7c9c-87e6-000043a8ae86","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/j/water-labbu-abuses-malicious-dapps-to-steal-cryptocurrency.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/j/water-labbu-abuses-malicious-dapps-to-steal-cryptocurrency.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66673d2c-b2b9-1060-8e9e-00007c1f4609","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ctfiot.com/138538.html","pattern":"[url:value = 'https://www.ctfiot.com/138538.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1f06668-d400-c84b-e0a5-00003ca8e1aa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://deform.co/hacker-group-caracal-kitten-targets-kdp-activists-with-malware/","pattern":"[url:value = 'https://deform.co/hacker-group-caracal-kitten-targets-kdp-activists-with-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62507fca-9511-5791-a1ab-0000ab826297","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/","pattern":"[url:value = 'https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a1162ba-d7bf-cb0a-eaa5-000001c417f5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.msspalert.com/news/managed-security-services-provider-mssp-market-news-30-october-2023","pattern":"[url:value = 'https://www.msspalert.com/news/managed-security-services-provider-mssp-market-news-30-october-2023']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08334e97-8330-73e5-b38d-0000dd00e84e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberwarzone.com/tasnim-news-hacked-by-weredevils/","pattern":"[url:value = 'https://cyberwarzone.com/tasnim-news-hacked-by-weredevils/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d0d0cb8-27a2-e516-1493-0000ed3fd9aa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/","pattern":"[url:value = 'http://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d8086aa-3fc0-50e5-06c5-0000a0f821d8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://sysdig.com/blog/cloud-breach-terraform-data-theft/","pattern":"[url:value = 'https://sysdig.com/blog/cloud-breach-terraform-data-theft/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0cb6c9f-f0fc-c083-84db-0000c7c78510","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/hackers-escalate-leak-200k-ccsd-students-data-claim-to-still-have-access-to-ccsd-email-system/","pattern":"[url:value = 'https://www.databreaches.net/hackers-escalate-leak-200k-ccsd-students-data-claim-to-still-have-access-to-ccsd-email-system/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ccc4e5d-e973-c5dc-fc6b-00006c3a14c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2023/30th-october-threat-intelligence-report/","pattern":"[url:value = 'https://research.checkpoint.com/2023/30th-october-threat-intelligence-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4b91d2c-02d5-9417-92a5-000088f09daa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/jeffco-public-schools-hit-by-the-same-threat-actors-that-hit-clark-county-school-district-and-via-the-same-way/","pattern":"[url:value = 'https://www.databreaches.net/jeffco-public-schools-hit-by-the-same-threat-actors-that-hit-clark-county-school-district-and-via-the-same-way/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42c003cc-468e-b927-94df-0000dc8abbbb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/","pattern":"[url:value = 'https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91086955-35cc-a029-1f6b-000024e5f1b8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/47455/","pattern":"[url:value = 'https://asec.ahnlab.com/en/47455/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dffe3ed-8fc5-bed5-89f1-00000d1d4992","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/56236/","pattern":"[url:value = 'https://asec.ahnlab.com/en/56236/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0f0e4ae-fa3d-4a82-6901-0000a03ff1c0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/56941/","pattern":"[url:value = 'https://asec.ahnlab.com/en/56941/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4cefc88-73b3-8adb-cbc8-0000df854e54","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa","pattern":"[url:value = 'http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7340fef-c8fa-6e13-f41b-0000f0e43aae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.lacework.com/blog/androxghost-the-python-malware-exploiting-your-aws-keys/","pattern":"[url:value = 'https://www.lacework.com/blog/androxghost-the-python-malware-exploiting-your-aws-keys/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f2c9a3e-d8db-7bc1-d545-000063f58348","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/?utm_source=rss&utm_medium=rss&utm_campaign=operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links","pattern":"[url:value = 'https://www.redpacketsecurity.com/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/?utm_source=rss&utm_medium=rss&utm_campaign=operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e072862-d766-1c41-5983-00007c1c61b7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-annual-review-what-the-worlds-threat-actors-got-up-to-in-2020/99574/","pattern":"[url:value = 'https://securelist.com/apt-annual-review-what-the-worlds-threat-actors-got-up-to-in-2020/99574/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a383126a-8ac0-3690-3178-0000bd73a9b2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7cebdec-d9ec-5e0f-9d1b-00007939538f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85f3595e-f2fe-1f27-d02d-0000dd99032a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.nsfocus.net/aptconfuciuspakistanibo/","pattern":"[url:value = 'https://blog.nsfocus.net/aptconfuciuspakistanibo/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b68061c-8d68-2e52-dc68-0000f479511d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/@knownsec404team/apt-k-47-mysterious-elephant-a-new-apt-organization-in-south-asia-5c66f954477","pattern":"[url:value = 'https://medium.com/@knownsec404team/apt-k-47-mysterious-elephant-a-new-apt-organization-in-south-asia-5c66f954477']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb660095-06ba-c0d5-4a9d-0000ab7ffb63","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://seclists.org/dataloss/2021/q4/81","pattern":"[url:value = 'https://seclists.org/dataloss/2021/q4/81']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ef0fc22-bc6d-dce1-2ed6-0000ca0b8ba3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/thai-entities-continue-to-fall-prey-to-cyberattacks-and-leaks/","pattern":"[url:value = 'https://www.databreaches.net/thai-entities-continue-to-fall-prey-to-cyberattacks-and-leaks/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b45dee84-44ed-e34d-f9f2-0000c76d056d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/recent-cyberattacks-put-thai-citizens-privacy-and-data-security-at-greater-risk/","pattern":"[url:value = 'https://www.databreaches.net/recent-cyberattacks-put-thai-citizens-privacy-and-data-security-at-greater-risk/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90c381f7-0bdf-e545-237e-000064081a6b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/major-indonesia-tollroad-operator-hacked-by-desorden/","pattern":"[url:value = 'https://www.databreaches.net/major-indonesia-tollroad-operator-hacked-by-desorden/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a3b3483-1408-26bb-18fd-00001d24face","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/customer-data-from-hundreds-of-indonesian-and-malaysian-restaurants-hacked-by-desorden/","pattern":"[url:value = 'https://www.databreaches.net/customer-data-from-hundreds-of-indonesian-and-malaysian-restaurants-hacked-by-desorden/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2fcf720-627f-e84b-7488-000023cdcae1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/thailands-the-icon-group-hacked-by-desorden/","pattern":"[url:value = 'https://www.databreaches.net/thailands-the-icon-group-hacked-by-desorden/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9ee7dfb-ef60-b922-d719-000090c411b2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/johnson-fitness-and-wellness-hit-by-desorden-group/","pattern":"[url:value = 'https://www.databreaches.net/johnson-fitness-and-wellness-hit-by-desorden-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a872c251-3a04-942c-b02b-0000decfa45d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/malaysian-online-stock-brokerage-firm-victim-of-cyberattack/","pattern":"[url:value = 'https://www.databreaches.net/malaysian-online-stock-brokerage-firm-victim-of-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba558674-2deb-02d4-d4dd-0000d1561f2e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/one-month-later-ranhill-still-hasnt-fully-recovered-from-cyberattack/","pattern":"[url:value = 'https://www.databreaches.net/one-month-later-ranhill-still-hasnt-fully-recovered-from-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e241d775-0f35-92ec-5948-000069eecd29","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/major-malaysian-water-utilities-company-hit-by-hackers-ranhill-offline-hackers-claim-databases-and-backups-deleted/","pattern":"[url:value = 'https://www.databreaches.net/major-malaysian-water-utilities-company-hit-by-hackers-ranhill-offline-hackers-claim-databases-and-backups-deleted/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b986732-14d6-96e4-065c-000007f192dd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityintelligence.com/x-force/gootbot-gootloaders-new-approach-to-post-exploitation/","pattern":"[url:value = 'https://securityintelligence.com/x-force/gootbot-gootloaders-new-approach-to-post-exploitation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f74f6cf8-0caf-559d-e62a-0000608a1f9b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/new-gootloader-variant-gootbot-changes-the-game-in-malware-tactics/","pattern":"[url:value = 'https://socradar.io/new-gootloader-variant-gootbot-changes-the-game-in-malware-tactics/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9014852-bef6-d6c9-d9e1-0000d4e94a52","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0991b7d1-1321-3dc5-6798-000054b1810d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.csoonline.com/article/3193397/security/no-netflix-is-not-a-victim-of-ransomware.html","pattern":"[url:value = 'http://www.csoonline.com/article/3193397/security/no-netflix-is-not-a-victim-of-ransomware.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24d53019-3078-0b2f-ff85-0000ce7ecddd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://securityaffairs.co/wordpress/64782/data-breach/london-bridge-plastic-surgery-hack.html","pattern":"[url:value = 'http://securityaffairs.co/wordpress/64782/data-breach/london-bridge-plastic-surgery-hack.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6115c104-cb57-a2dd-7d86-00004c43eff7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.databreaches.net/peachtree-orthopedics-alerts-patients-of-cyberattack-third-patient-data-breach-in-seven-years/","pattern":"[url:value = 'https://www.databreaches.net/peachtree-orthopedics-alerts-patients-of-cyberattack-third-patient-data-breach-in-seven-years/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2737868-8109-1a5d-90b7-00009c580cbc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-targeting-brazil","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-targeting-brazil']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b53e28cc-660c-8e53-3799-0000f0ff993e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee1735bc-9915-73e4-1b72-000019d00545","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://us-cert.cisa.gov/ncas/alerts/aa22-108a","pattern":"[url:value = 'https://us-cert.cisa.gov/ncas/alerts/aa22-108a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6aa3338-e3a7-404a-0a18-00001c66dea6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/north-korea-supply-chain","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/north-korea-supply-chain']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fd34100-452b-6f5f-fa7e-000002ceb8db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://vulners.com/thn/THN:4C1C2CD10F20E08DD74D465450DF3F17?utm_source=rss&utm_medium=rss&utm_campaign=rss","pattern":"[url:value = 'https://vulners.com/thn/THN:4C1C2CD10F20E08DD74D465450DF3F17?utm_source=rss&utm_medium=rss&utm_campaign=rss']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af29a696-e25b-f421-46cc-0000b7070240","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/39253","pattern":"[url:value = 'https://cert.gov.ua/article/39253']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1713bf4e-069f-e74c-622f-0000699116da","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/dark-peep-2-war-and-a-piece-of-hilarity/","pattern":"[url:value = 'https://socradar.io/dark-peep-2-war-and-a-piece-of-hilarity/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3630956-0370-9d74-c6cc-0000993e9cf4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil/","pattern":"[url:value = 'https://socradar.io/cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52c66533-573b-febb-60a3-0000b8d6e652","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/","pattern":"[url:value = 'https://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f288f5e8-dd96-12fd-0bd2-0000d92fdaae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/scandinavian-airlines-cyberattack-anonymous-sudan/","pattern":"[url:value = 'https://therecord.media/scandinavian-airlines-cyberattack-anonymous-sudan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8854b2f7-924b-4af0-17b3-0000fe0879a4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175885","pattern":"[url:value = 'https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175885']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb5416f0-a8a0-7dcc-4002-0000312c168f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/","pattern":"[url:value = 'https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96ef621d-5975-d102-93c3-000087f683d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.justice.gov/usao-wdwa/pr/alleged-french-cybercriminal-appear-seattle-indictment-conspiracy-computer-intrusion","pattern":"[url:value = 'https://www.justice.gov/usao-wdwa/pr/alleged-french-cybercriminal-appear-seattle-indictment-conspiracy-computer-intrusion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81029784-cf34-e8f5-dcf1-0000c2448b82","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bitdefender.com/blog/hotforsecurity/pizza-hut-australia-leaks-one-million-customers-details-claims-shinyhunters-hacking-group/","pattern":"[url:value = 'https://www.bitdefender.com/blog/hotforsecurity/pizza-hut-australia-leaks-one-million-customers-details-claims-shinyhunters-hacking-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6dcf54d-3130-374b-453b-00006a9ad08c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberwarzone.com/shinyhunters-22-year-old-member-pleads-guilty-to-cyber-extortion-causing-6-million-in-damage/","pattern":"[url:value = 'https://cyberwarzone.com/shinyhunters-22-year-old-member-pleads-guilty-to-cyber-extortion-causing-6-million-in-damage/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--630d1173-694a-9566-c87c-00008fa9cc69","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/the-israel-hamas-war-cyber-domain-state-sponsored-activity-of-interest/","pattern":"[url:value = 'https://www.sentinelone.com/labs/the-israel-hamas-war-cyber-domain-state-sponsored-activity-of-interest/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ea7eee3-03f5-795c-3d47-0000d79dc300","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/introducing-shrouded-snooper/","pattern":"[url:value = 'https://blog.talosintelligence.com/introducing-shrouded-snooper/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0436d09-b45b-a8a6-7fe6-0000c4217b31","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/@Sebdraven/malicious-document-targets-vietnamese-officials-acb3b9d8b80a","pattern":"[url:value = 'https://medium.com/@Sebdraven/malicious-document-targets-vietnamese-officials-acb3b9d8b80a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0a85992-ec4f-1f89-e85d-0000b995e427","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://securityaffairs.co/wordpress/49876/hacking/china-1937cn-team-vietnam.html","pattern":"[url:value = 'http://securityaffairs.co/wordpress/49876/hacking/china-1937cn-team-vietnam.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27389247-3410-b4ea-3383-0000ead68eca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/international-hacktivism-analysis/","pattern":"[url:value = 'https://www.recordedfuture.com/international-hacktivism-analysis/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3983e1c1-656e-6baa-efb1-000057cfa9d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/b/earth-zhulong-familiar-patterns-target-southeast-asian-firms.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/b/earth-zhulong-familiar-patterns-target-southeast-asian-firms.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a2773fb-e936-782a-c6bc-0000ecff46eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://nsi-globalcounterintelligence.com/cyber-security/pro-iran-hackers-target-israel-airports-authority-website/","pattern":"[url:value = 'https://nsi-globalcounterintelligence.com/cyber-security/pro-iran-hackers-target-israel-airports-authority-website/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41f6803c-db9b-4c6b-11b7-0000b65a9679","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.hackread.com/pro-iran-altahrea-hit-port-of-london-website-ddos-attack/","pattern":"[url:value = 'https://www.hackread.com/pro-iran-altahrea-hit-port-of-london-website-ddos-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5bd0ebb-ccd7-3688-c98b-0000162eb635","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.presstv.ir/Detail/2022/07/27/686324/Iraqi-hacker-group--ALtahrea-Team--targets-Israeli-IT","pattern":"[url:value = 'https://www.presstv.ir/Detail/2022/07/27/686324/Iraqi-hacker-group--ALtahrea-Team--targets-Israeli-IT']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c89075e9-107f-34a1-e5f7-0000f002b0be","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://techmonitor.ai/technology/cybersecurity/alahrea-team-power-plant-fire-israel","pattern":"[url:value = 'https://techmonitor.ai/technology/cybersecurity/alahrea-team-power-plant-fire-israel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7715174-566e-9c07-6ac8-0000232ca83a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.timesofisrael.com/cyberattack-on-health-ministry-website-blocks-overseas-access/","pattern":"[url:value = 'https://www.timesofisrael.com/cyberattack-on-health-ministry-website-blocks-overseas-access/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81d6010d-6511-24bd-8bd1-00008a0590dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/ddos-attacks-in-q2-2022/107025/","pattern":"[url:value = 'https://securelist.com/ddos-attacks-in-q2-2022/107025/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed42d2c7-62a8-d797-d2f0-00004b4a42a7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94dfa2fb-6402-99c0-247a-0000c7bac825","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/a-hack-in-hand-is-worth-two-in-the-bush/110794/","pattern":"[url:value = 'https://securelist.com/a-hack-in-hand-is-worth-two-in-the-bush/110794/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64c973dd-8767-c9b0-9bc6-0000978db388","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberwarzone.com/hacking-group-cyber-av3ngers-claims-responsibility-for-yavne-power-outages-what-you-need-to-know/","pattern":"[url:value = 'https://cyberwarzone.com/hacking-group-cyber-av3ngers-claims-responsibility-for-yavne-power-outages-what-you-need-to-know/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac0a80b9-ccae-a647-bcd3-0000e5aff1c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberwarzone.com/cyber-av3ngers-claims-infiltration-of-israeli-water-treatment-stations-amid-ongoing-conflict/","pattern":"[url:value = 'https://cyberwarzone.com/cyber-av3ngers-claims-infiltration-of-israeli-water-treatment-stations-amid-ongoing-conflict/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26b5a481-08d5-1b75-0b38-000065e10ad1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol","pattern":"[url:value = 'https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc01876b-c363-3bb0-d092-0000b3315fa9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/","pattern":"[url:value = 'https://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--102240e8-6cab-7785-a837-0000769eca47","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thecyberexpress.com/kromsec-sells-iran-ministry-database-dark-web/","pattern":"[url:value = 'https://thecyberexpress.com/kromsec-sells-iran-ministry-database-dark-web/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--711f5c2f-774b-24f7-94c3-00005c615baf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.virusbulletin.com/conference/vb2018/abstracts/nomadic-octopus-cyber-espionage-central-asia/","pattern":"[url:value = 'https://www.virusbulletin.com/conference/vb2018/abstracts/nomadic-octopus-cyber-espionage-central-asia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e71811e-3e01-0084-22ef-0000e754237a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.prodaft.com/m/reports/PAPERBUG_TLPWHITE-1.pdf","pattern":"[url:value = 'https://www.prodaft.com/m/reports/PAPERBUG_TLPWHITE-1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e17de1e-ad64-035b-37eb-00007ea6a6fc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/mexican-army-spyware","pattern":"[url:value = 'https://therecord.media/mexican-army-spyware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2b7e71d-b64b-4bc1-aaeb-0000a4b2363b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyberscoop.com/central-american-hacking-group-releases-emails/","pattern":"[url:value = 'https://www.cyberscoop.com/central-american-hacking-group-releases-emails/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a1b00a9-6d23-0e01-5164-0000a8baeac7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2022/3rd-october-threat-intelligence-report/","pattern":"[url:value = 'https://research.checkpoint.com/2022/3rd-october-threat-intelligence-report/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41682475-4d62-ac81-bfdc-000014cde798","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.redpacketsecurity.com/guacamaya-hacktivists-stole-sensitive-data-from-mexico-and-latin-american-countries/","pattern":"[url:value = 'https://www.redpacketsecurity.com/guacamaya-hacktivists-stole-sensitive-data-from-mexico-and-latin-american-countries/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eba58658-fab1-8f16-a933-00005dbc52e7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://finance.yahoo.com/news/analysis-mexico-data-hack-exposes-003101651.html","pattern":"[url:value = 'https://finance.yahoo.com/news/analysis-mexico-data-hack-exposes-003101651.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c6d4e49-dc52-0eb0-3538-0000d6c48c13","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://srslyriskybiz.substack.com/p/recent-cyber-chaos-is-a-structural","pattern":"[url:value = 'https://srslyriskybiz.substack.com/p/recent-cyber-chaos-is-a-structural']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2726d0cb-a20c-5c81-836b-00003ab97cca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyberscoop.com/environmentalist-hacktivist-collective-mining-company/","pattern":"[url:value = 'https://cyberscoop.com/environmentalist-hacktivist-collective-mining-company/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90150d90-adcf-ff9e-296f-0000d1166768","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2024/sharp-dragon-expands-towards-africa-and-the-caribbean/","pattern":"[url:value = 'https://research.checkpoint.com/2024/sharp-dragon-expands-towards-africa-and-the-caribbean/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb561485-940b-2d86-3160-0000bf2ebfea","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/","pattern":"[url:value = 'https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e01a526-9dfd-a1de-8e4a-00006cc107a8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-sharppanda-chinese-apt-group-targets-southeast-asian-government-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-sharppanda-chinese-apt-group-targets-southeast-asian-government-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6be09854-f9b5-1be0-81b7-0000865121c3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.cyble.com/2023/06/01/sharppanda-apt-campaign-expands-its-arsenal-targeting-g20-nations/","pattern":"[url:value = 'https://blog.cyble.com/2023/06/01/sharppanda-apt-campaign-expands-its-arsenal-targeting-g20-nations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c370496f-5490-724b-4b2d-0000c6434c00","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/dont-answer-russia-aligned-ta499-beleaguers-targets-video-call-requests","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/dont-answer-russia-aligned-ta499-beleaguers-targets-video-call-requests']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a542eb4c-f3e8-b6a8-47b8-0000a8ae3b34","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/hacktivists-take-sides-israel-palestinian","pattern":"[url:value = 'https://therecord.media/hacktivists-take-sides-israel-palestinian']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e9de984-66d0-480e-0c47-0000134851a0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc07b986-0b46-7ed4-185c-0000baada212","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat","pattern":"[url:value = 'https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f38f9965-ed31-c2c5-219f-0000213eae67","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: Asia.According","pattern":"[domain-name:value = 'Asia.According']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f37ae7e4-5ed5-7a06-f7cb-0000fb72c028","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor","pattern":"[url:value = 'https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5966e42-050e-5275-16b3-0000657a6ced","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set","pattern":"[url:value = 'https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fdfc141-c09f-c0e7-3190-000041a38b3c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.enea.com/insights/the-hunt-for-hiddenart/","pattern":"[url:value = 'https://www.enea.com/insights/the-hunt-for-hiddenart/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--331303d9-4712-aa79-ce5a-0000d9bd593f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/oilalpha-likely-pro-houthi-group-targeting-arabian-peninsula","pattern":"[url:value = 'https://www.recordedfuture.com/oilalpha-likely-pro-houthi-group-targeting-arabian-peninsula']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99af9dcf-5d43-1b0b-4999-0000ec03de64","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.zimperium.com/blog/zimperium-mtd-against-oilalpha-a-comprehensive-defense-strategy/","pattern":"[url:value = 'https://www.zimperium.com/blog/zimperium-mtd-against-oilalpha-a-comprehensive-defense-strategy/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ea7a155-721f-acc9-f4ec-000061af1278","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://forescoutstage.wpengine.com/blog/the-increasing-threat-posed-by-hacktivist-attacks-an-analysis-of-targeted-organizations-devices-and-ttps/","pattern":"[url:value = 'https://forescoutstage.wpengine.com/blog/the-increasing-threat-posed-by-hacktivist-attacks-an-analysis-of-targeted-organizations-devices-and-ttps/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fce0eedf-0923-99e7-2470-000012540b45","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.uptycs.com/blog/ghostlocker-ransomware-ghostsec","pattern":"[url:value = 'https://www.uptycs.com/blog/ghostlocker-ransomware-ghostsec']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40e301dc-429e-b405-4119-000050fd0b39","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-intel-indigozebra-apt-group-targeting-central-asia-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-intel-indigozebra-apt-group-targeting-central-asia-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ae8ddcb-41fb-93e4-fd76-0000f3cbed6d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.hackread.com/anonymous-affiliate-nb65-russia-broadcaster-data-breach/","pattern":"[url:value = 'https://www.hackread.com/anonymous-affiliate-nb65-russia-broadcaster-data-breach/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7575a3fa-3a6b-fb38-df75-0000e960d944","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/articles/russian-ukrainian-cyber-warfare-rewterz-threat-intelligence-rollup","pattern":"[url:value = 'https://www.rewterz.com/articles/russian-ukrainian-cyber-warfare-rewterz-threat-intelligence-rollup']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8604b27-eb8b-464a-451e-0000974be2f5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/reassessing-cyberwarfare-lessons-learned-in-2022/108328/","pattern":"[url:value = 'https://securelist.com/reassessing-cyberwarfare-lessons-learned-in-2022/108328/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74538a44-5c91-2723-7885-0000b0eb1049","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/growling-bears-make-thunderous-noise.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/growling-bears-make-thunderous-noise.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e5b11fb-9b3d-55fe-1392-0000e287726d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-leaked-conti-ransomware-used-to-target-russia-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-leaked-conti-ransomware-used-to-target-russia-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24ea6f6e-94db-8c18-3efd-00001485dfae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/","pattern":"[url:value = 'https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--add0fb2d-424b-06ec-26cb-0000b5787a12","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/witchetty-steganography-espionage","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/witchetty-steganography-espionage']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--546f8236-47c2-122f-476e-000000285ad8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-witchetty-apt-group-active-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-witchetty-apt-group-active-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1fc7b0a-9a6e-353b-7766-00008121dea3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/bad-magic-apt/109087/","pattern":"[url:value = 'https://securelist.com/bad-magic-apt/109087/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edf75aff-181f-4c35-5e14-00002963a3cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger","pattern":"[url:value = 'https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7101092-a31e-8343-961d-00005d942bf2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping","pattern":"[url:value = 'https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb8907aa-9826-9041-b26a-0000fbbc3090","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/carderbee-software-supply-chain-certificate-abuse","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/carderbee-software-supply-chain-certificate-abuse']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14b681e6-95d4-3cf9-e5a7-00005983561b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.polyswarm.io/carderbee-targets-hong-kong-in-supply-chain-attack","pattern":"[url:value = 'https://blog.polyswarm.io/carderbee-targets-hong-kong-in-supply-chain-attack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7a7a15a-6a43-4fea-97ee-00006af355cc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.eclecticiq.com/chinese-state-sponsored-cyber-espionage-activity-targeting-semiconductor-industry-in-east-asia","pattern":"[url:value = 'https://blog.eclecticiq.com/chinese-state-sponsored-cyber-espionage-activity-targeting-semiconductor-industry-in-east-asia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d0f2d96-7656-9dfd-4f0f-0000bd7dc6cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.resecurity.com/blog/article/ransomedvc-in-the-spotlight-what-we-know-about-the-ransomware-group-targeting-major-japanese-businesses","pattern":"[url:value = 'https://www.resecurity.com/blog/article/ransomedvc-in-the-spotlight-what-we-know-about-the-ransomware-group-targeting-major-japanese-businesses']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e513883-6d4c-d7c1-410c-00001cf63d80","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/threat-source-newsletter-sept-28-2023/","pattern":"[url:value = 'https://blog.talosintelligence.com/threat-source-newsletter-sept-28-2023/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--473f4785-cf83-b70e-22ea-00001ad6687d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securityaffairs.com/151550/data-breach/ransomed-vc-sony-ntt-alleged-attacks.html","pattern":"[url:value = 'https://securityaffairs.com/151550/data-breach/ransomed-vc-sony-ntt-alleged-attacks.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40ffc200-025b-877c-7802-000020b81faf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.videogameschronicle.com/news/a-ransomware-group-claims-to-have-beached-all-sony-systems/","pattern":"[url:value = 'https://www.videogameschronicle.com/news/a-ransomware-group-claims-to-have-beached-all-sony-systems/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d4e4b41-815b-9248-afe8-000007c7587d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/unmasking-usdod-the-enigma-of-the-cyber-realm/","pattern":"[url:value = 'https://socradar.io/unmasking-usdod-the-enigma-of-the-cyber-realm/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--963e85eb-a861-5cd6-9555-0000d6540bdc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/blog/sep-2023-cybercrime-update-new-ransomware-threats-and-the-rising-menace-of-telegram/","pattern":"[url:value = 'https://www.sentinelone.com/blog/sep-2023-cybercrime-update-new-ransomware-threats-and-the-rising-menace-of-telegram/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--945980a8-6023-27b0-828e-00000a2938f9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/on-the-horizon-ransomed-vc-ransomware-group-spotted-in-the-wild/","pattern":"[url:value = 'https://socradar.io/on-the-horizon-ransomed-vc-ransomware-group-spotted-in-the-wild/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4767600-99b1-88d5-e098-000034754f33","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/colonial-pipeline-attributes-ransomware-claims-to-unrelated-third-party-breach","pattern":"[url:value = 'https://therecord.media/colonial-pipeline-attributes-ransomware-claims-to-unrelated-third-party-breach']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0615380c-8f9e-b36f-3cda-0000872ee4dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkowl.com/blog-content/darkowl-threat-actor-spotlight-siegedsec-and-leaked-data/","pattern":"[url:value = 'https://www.darkowl.com/blog-content/darkowl-threat-actor-spotlight-siegedsec-and-leaked-data/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--193b7944-77bf-b337-e7e7-0000cc134b30","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://webz.io/dwp/exclusive-hacktivists-attack-anti-abortion-u-s-states/","pattern":"[url:value = 'https://webz.io/dwp/exclusive-hacktivists-attack-anti-abortion-u-s-states/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe5615f1-55f2-70d9-f0e0-0000f5cd4e62","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/fort-worth-officials-say-leaked-data-was-public","pattern":"[url:value = 'https://therecord.media/fort-worth-officials-say-leaked-data-was-public']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2365e645-f67b-99ba-73dc-0000b7dbcb1b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/the-five-families-hacker-collaboration-redefining-the-game/","pattern":"[url:value = 'https://socradar.io/the-five-families-hacker-collaboration-redefining-the-game/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5aa5597-23a3-6f65-4ff9-0000fde508c9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socradar.io/threat-actor-profile-siegedsec/","pattern":"[url:value = 'https://socradar.io/threat-actor-profile-siegedsec/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b943e21-17a0-2088-8315-00007b5e2502","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/nato-siegedsec-unclassified-websites-alleged-cyberattack","pattern":"[url:value = 'https://therecord.media/nato-siegedsec-unclassified-websites-alleged-cyberattack']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e857088-5f19-23ab-7bb0-0000a9bd0151","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/the-mystery-of-metador-an-unattributed-threat-hiding-in-telcos-isps-and-universities/","pattern":"[url:value = 'https://www.sentinelone.com/labs/the-mystery-of-metador-an-unattributed-threat-hiding-in-telcos-isps-and-universities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39f58796-a05f-366f-fcc9-0000b4fd89ca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/the-mystery-of-metador-unpicking-mafaldas-anti-analysis-techniques/","pattern":"[url:value = 'https://www.sentinelone.com/labs/the-mystery-of-metador-unpicking-mafaldas-anti-analysis-techniques/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81fc97f0-2637-5217-cfad-0000cbb99415","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.seqrite.com/blog/operation-peek-a-baku-silent-lynx-apt-dushanbe-espionage/","pattern":"[url:value = 'https://www.seqrite.com/blog/operation-peek-a-baku-silent-lynx-apt-dushanbe-espionage/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14dba8f2-cb07-9d0d-a3a6-000035e9dfb9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://bi-zone.medium.com/cavalry-werewolf-raids-russias-public-sector-with-trusted-relationship-attacks-e19f7a5c83ef","pattern":"[url:value = 'https://bi-zone.medium.com/cavalry-werewolf-raids-russias-public-sector-with-trusted-relationship-attacks-e19f7a5c83ef']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32aba1c8-0760-aeb8-8c40-00009dd275ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/","pattern":"[url:value = 'https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d480473d-201b-e181-5ae2-00008a45695b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.group-ib.com/blog/shadowsilk/","pattern":"[url:value = 'https://www.group-ib.com/blog/shadowsilk/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ce4247c-56ea-fba5-000c-0000ff121311","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/attributing-yorotrooper/","pattern":"[url:value = 'https://blog.talosintelligence.com/attributing-yorotrooper/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cda503b4-fd8b-98c5-5721-0000bbb0170b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/get-a-loda-this/","pattern":"[url:value = 'https://blog.talosintelligence.com/get-a-loda-this/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a615c669-d345-4914-52e7-0000430d2184","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/yorotrooper-espionage-campaign-cis-turkey-europe/","pattern":"[url:value = 'https://blog.talosintelligence.com/yorotrooper-espionage-campaign-cis-turkey-europe/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ae61086-f53b-d46b-2ce2-00001265779a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/","pattern":"[url:value = 'https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--104fcdf7-b424-2524-384c-0000dccad5e9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MsftSecIntel/status/1711871732644970856","pattern":"[url:value = 'https://twitter.com/MsftSecIntel/status/1711871732644970856']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d99cb75e-70a5-b1a3-dec6-0000c069a1dd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-41-5/","pattern":"[url:value = 'https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-41-5/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47a9e342-b29f-e69d-c1eb-00005d31a724","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/monthly-news-november-2023/ba-p/3970796","pattern":"[url:value = 'https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/monthly-news-november-2023/ba-p/3970796']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b862f11-9b4e-035d-4c62-0000ff5592fa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organized-persistent-and-operating-for-over-a-year/","pattern":"[url:value = 'https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organized-persistent-and-operating-for-over-a-year/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--455491cb-2498-66a9-381e-00006dd012fc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c171f3d6-2bbc-0ee6-75f5-000065e1ff39","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/goldenjackal-apt-group/109677/","pattern":"[url:value = 'https://securelist.com/goldenjackal-apt-group/109677/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da33aa9d-c6ba-1940-8158-0000ea855ba2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/it-threat-evolution-q2-2023/110355/","pattern":"[url:value = 'https://securelist.com/it-threat-evolution-q2-2023/110355/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2cc3a3f-c685-496d-fe92-00006c3ab723","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/cyber-soft-power-chinas-continental-takeover/","pattern":"[url:value = 'https://www.sentinelone.com/labs/cyber-soft-power-chinas-continental-takeover/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc5697f5-e870-0b96-80fd-0000fb711c75","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a811791-f308-c19a-fae6-0000979ba053","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-trends-report-q3-2023/110752/","pattern":"[url:value = 'https://securelist.com/apt-trends-report-q3-2023/110752/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1765719a-b47e-10c1-d3c2-00000f0ea5ff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://usa.kaspersky.com/blog/sas-2023-research/29254/","pattern":"[url:value = 'https://usa.kaspersky.com/blog/sas-2023-research/29254/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2107e780-346e-6e1f-eb9a-00009a18ae87","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-power-suppliers-network-infiltrated-for-6-months-by-redfly-hackers-active-iocs/","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-power-suppliers-network-infiltrated-for-6-months-by-redfly-hackers-active-iocs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1e08228-112b-ce3f-3915-00006b974a86","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/critical-infrastructure-attacks","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/critical-infrastructure-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a007463-7283-29f7-52dc-0000f5b48c6f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e102889c-7063-6dec-7407-00001d2b77b4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ics-cert.kaspersky.com/publications/reports/2023/03/24/apt-attacks-on-industrial-organizations-in-h2-2022/","pattern":"[url:value = 'https://ics-cert.kaspersky.com/publications/reports/2023/03/24/apt-attacks-on-industrial-organizations-in-h2-2022/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--169131e3-9ea9-dcad-97af-00001e878f21","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54e6aeda-fa0b-f6d6-9a61-00000d852336","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.picussecurity.com/resource/blog/cyber-threat-intelligence-report-may-2023","pattern":"[url:value = 'https://www.picussecurity.com/resource/blog/cyber-threat-intelligence-report-may-2023']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ef0864c-40ff-49b0-bf18-00005d92fce5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/vmware-detection-containment-hardening","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/vmware-detection-containment-hardening']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab2144da-db65-9881-ff7f-0000ac146fbc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a093f61d-465b-7fb5-6ed6-0000cb68f1e8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--482d02c9-c999-13e4-55bd-00001de1d6de","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/russia-aligned-tag-70-targets-european-government-and-military-mail","pattern":"[url:value = 'https://www.recordedfuture.com/russia-aligned-tag-70-targets-european-government-and-military-mail']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c409e65b-3b5b-4415-cf88-0000e56768f5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybersecuritynews.com/russian-hackers-xss-flaw/","pattern":"[url:value = 'https://cybersecuritynews.com/russian-hackers-xss-flaw/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--146d3953-2ec5-0bc9-7d2c-0000a70b450c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/uac-0114-group-aka-winter-vivern-attack-detection-hackers-launch-malicious-phishing-campaigns-targeting-government-entities-of-ukraine-and-poland/","pattern":"[url:value = 'https://socprime.com/blog/uac-0114-group-aka-winter-vivern-attack-detection-hackers-launch-malicious-phishing-campaigns-targeting-government-entities-of-ukraine-and-poland/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60ea42d3-2e75-d1cc-56ef-0000f929e846","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs","pattern":"[url:value = 'https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61bcff24-5bda-5a88-42a1-00009ac1a926","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/samsung-investigating-claims-of-hack-on-south-korea-systems-internal-employee-platform/","pattern":"[url:value = 'https://therecord.media/samsung-investigating-claims-of-hack-on-south-korea-systems-internal-employee-platform/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d16dee9-ab2f-5111-58f2-0000b92af3cc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/s2wblog/%E5%8F%98%E8%84%B8-teng-snake-a-k-a-code-core-8c35268b4d1a","pattern":"[url:value = 'https://medium.com/s2wblog/%E5%8F%98%E8%84%B8-teng-snake-a-k-a-code-core-8c35268b4d1a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--652dd4ef-c9d0-39bd-88f6-0000f6438e38","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/xiaoqiying-genesis-day-threat-actor-group-targets-south-korea-taiwan","pattern":"[url:value = 'https://www.recordedfuture.com/xiaoqiying-genesis-day-threat-actor-group-targets-south-korea-taiwan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d389de8-75ae-4c60-0272-0000bf6a8822","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/","pattern":"[url:value = 'https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--467122ec-fd78-b115-7dac-0000d43e6ba6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.netlab.360.com/necro-upgrades-again-using-tor-dynamic-domain-dga-and-aiming-at-both-windows-linux/","pattern":"[url:value = 'https://blog.netlab.360.com/necro-upgrades-again-using-tor-dynamic-domain-dga-and-aiming-at-both-windows-linux/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96bf71fc-28c1-6c26-e2cc-000025522926","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cybersecurity-insiders.com/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers-and-android-devices/?utm_source=rss&utm_medium=rss&utm_campaign=rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers-and-android-devices","pattern":"[url:value = 'https://www.cybersecurity-insiders.com/rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers-and-android-devices/?utm_source=rss&utm_medium=rss&utm_campaign=rapidly-evolving-iot-malware-enemybot-now-targeting-content-management-system-servers-and-android-devices']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1433ff4-0860-2db9-5289-0000f1b0a455","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fortinet.com/blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/enemybot-a-look-into-keksecs-latest-ddos-botnet']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5de6273-7e4d-5bcb-51af-0000946165b4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/","pattern":"[url:value = 'https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e810310-b3ff-56ce-709a-000059c206e5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf","pattern":"[url:value = 'https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f8cee8f-7c45-001e-dcd2-00003aec0855","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=khywfhJv4H8","pattern":"[url:value = 'https://www.youtube.com/watch?v=khywfhJv4H8']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee466de3-b9eb-4c82-b2d8-0000103edaf6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/","pattern":"[url:value = 'https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6517d5e8-0345-e4b2-46df-00002c1b704e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.microsoft.com/on-the-issues/2023/07/11/mitigation-china-based-threat-actor/","pattern":"[url:value = 'https://blogs.microsoft.com/on-the-issues/2023/07/11/mitigation-china-based-threat-actor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a76b7bc5-aa22-4a52-aeaf-000075b9094f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/","pattern":"[url:value = 'https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--504a715f-77ec-946f-e9d4-000033bbcc4a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr","pattern":"[url:value = 'https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a58136d-29c1-b69d-7d94-0000b02685d3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/","pattern":"[url:value = 'https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe94f4fd-98d6-e493-dcb3-0000ced8d637","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_za/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html","pattern":"[url:value = 'https://www.trendmicro.com/en_za/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa2ed24f-bf42-7c1a-a32f-0000e06825ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://nsfocusglobal.com/warning-newly-discovered-apt-attacker-atlascross-exploits-red-cross-blood-drive-phishing-for-cyberattack/","pattern":"[url:value = 'https://nsfocusglobal.com/warning-newly-discovered-apt-attacker-atlascross-exploits-red-cross-blood-drive-phishing-for-cyberattack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af3d20ab-d122-996e-8a69-0000ecb79f33","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.attackiq.com/2023/11/21/attack-graph-response-to-cisa-advisory-aa23-320a/","pattern":"[url:value = 'https://www.attackiq.com/2023/11/21/attack-graph-response-to-cisa-advisory-aa23-320a/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a5bfc7d-d194-a932-9582-0000ecef987a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/","pattern":"[url:value = 'https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d13a4da-5b71-1a23-e190-00003abdcd06","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-brings-8m-loss-daily/","pattern":"[url:value = 'https://www.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-brings-8m-loss-daily/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c3f93bc-71bb-ab8c-2d82-0000d438b612","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.agari.com/blog/covid-19-unemployment-fraud-cares-act?_gl=1%2Ayzg6ns%2A_ga%2AMTkyMzIyOTI4MC4xNjk2MjUyMDA2%2A_ga_NHMHGJWX49%2AMTY5NjI1MjAwNS4xLjAuMTY5NjI1MjAwNS42MC4wLjA.&utm_source=press-release&utm_medium=prnewswire&utm_campaign=scattered20","pattern":"[url:value = 'https://www.agari.com/blog/covid-19-unemployment-fraud-cares-act?_gl=1%2Ayzg6ns%2A_ga%2AMTkyMzIyOTI4MC4xNjk2MjUyMDA2%2A_ga_NHMHGJWX49%2AMTY5NjI1MjAwNS4xLjAuMTY5NjI1MjAwNS42MC4wLjA.&utm_source=press-release&utm_medium=prnewswire&utm_campaign=scattered20']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13306ae8-83ea-85d4-56ff-0000ea4c7724","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://static.fortra.com/agari/pdfs/guide/ag-scattered-canary-gd.pdf","pattern":"[url:value = 'https://static.fortra.com/agari/pdfs/guide/ag-scattered-canary-gd.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b1dcaa4-b0bd-9969-dbbb-00007814e374","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cofense.com/blog/gift-card-fraud-ecosystem-shifts-what-paxfuls-closing-means-for-business-email-compromise/","pattern":"[url:value = 'https://cofense.com/blog/gift-card-fraud-ecosystem-shifts-what-paxfuls-closing-means-for-business-email-compromise/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d9a086e-c97d-338b-c6d5-00006e3c53ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceb66032-a9c5-9727-d7f1-000094660980","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89ec9f0c-efaa-005d-f379-0000a20984c5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2022/09/06/worok-big-picture/","pattern":"[url:value = 'https://www.welivesecurity.com/2022/09/06/worok-big-picture/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9f661a3-481d-22f3-1252-00000770abb1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf","pattern":"[url:value = 'https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c4b61d4-724b-2485-43b5-0000e31e1ac0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/","pattern":"[url:value = 'https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe8f7963-ed55-d03b-ab59-00003d1d6c27","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/threat/voltzite/","pattern":"[url:value = 'https://www.dragos.com/threat/voltzite/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3caf24f2-5f27-6ec7-1ab0-0000f5b7bdf3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/volt-typhoon-threat-brief/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/volt-typhoon-threat-brief/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c51194a-be68-7b9f-fef4-00000e1785ce","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations","pattern":"[url:value = 'https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fa49f39-bf55-3f8b-b128-0000f8ae6aba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor/","pattern":"[url:value = 'https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e5c3eaa-b1a8-a2bf-f999-000003819b24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1","pattern":"[url:value = 'https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf57df7c-1bbf-30b4-073c-00005a32c9a2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.team-cymru.com/post/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor","pattern":"[url:value = 'https://www.team-cymru.com/post/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42909913-fbc3-d361-f41e-0000ba9afad2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/apt43-north-korea-cybercrime-espionage","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/apt43-north-korea-cybercrime-espionage']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e015a8c2-7e1a-740f-e418-00006d5ed56a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://go.recordedfuture.com/hubfs/reports/cta-2023-0330.pdf","pattern":"[url:value = 'https://go.recordedfuture.com/hubfs/reports/cta-2023-0330.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38c3b665-4b26-5d6c-5d1e-00000a98d669","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.truesec.com/hub/blog/what-is-anonymous-sudan","pattern":"[url:value = 'https://www.truesec.com/hub/blog/what-is-anonymous-sudan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4e4ce8d-ec07-254b-5132-0000ef851128","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://files.truesec.com/hubfs/Reports/Anonymous%20Sudan%20-%20Publish%201.2%20-%20a%20Truesec%20Report.pdf","pattern":"[url:value = 'https://files.truesec.com/hubfs/Reports/Anonymous%20Sudan%20-%20Publish%201.2%20-%20a%20Truesec%20Report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c384c4a0-12df-0181-011e-0000684d4d7e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe28a118-613b-019a-363d-000064ea92ca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--984039f6-2292-b1ee-d702-00003d67867e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker","pattern":"[url:value = 'https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e3123c6-f092-2c3d-9b70-00008e23d889","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c63f8a2b-6b9a-d0d7-5d36-0000b764b195","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.accenture.com/us-en/blogs/cyber-defense/karakurt-threat-mitigation","pattern":"[url:value = 'https://www.accenture.com/us-en/blogs/cyber-defense/karakurt-threat-mitigation']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed2d6bd7-2b58-ce56-91ea-0000bf6688ef","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group","pattern":"[url:value = 'https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba02fa95-0d2b-44b0-14cd-00000ff35714","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-152a","pattern":"[url:value = 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-152a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e04a4ca-7ebb-82d0-6f75-0000a548eb92","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/chamelgang-attacking-critical-infrastructure-with-ransomware/","pattern":"[url:value = 'https://www.sentinelone.com/labs/chamelgang-attacking-critical-infrastructure-with-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--330b2581-67eb-9c54-f7de-00006ba03d45","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/","pattern":"[url:value = 'https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2996a520-43d5-4823-35f4-000006277dba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/ta453-refuses-be-bound-expectations","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/ta453-refuses-be-bound-expectations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc938fbe-5aca-ae8d-33ac-0000eeabd032","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/blog/apt42-charms-cons-compromises","pattern":"[url:value = 'https://www.mandiant.com/resources/blog/apt42-charms-cons-compromises']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bca633bc-aff1-a124-433d-0000f3ec218b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/ta406-pivots-front","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/ta406-pivots-front']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2557d322-a940-8ef3-3c51-000090a5858e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/triple-threat-north-korea-aligned-ta406-scams-spies-and-steals","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/triple-threat-north-korea-aligned-ta406-scams-spies-and-steals']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--314dc21b-f639-8452-b913-000015a481ef","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MsftSecIntel/status/1625181255754039318","pattern":"[url:value = 'https://twitter.com/MsftSecIntel/status/1625181255754039318']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11c304bf-7d1b-e34b-4f06-00005c75aa9c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/dtpacker-net-packer-curious-password-1","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/dtpacker-net-packer-curious-password-1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--166a8039-50f7-138f-c426-000049288baa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://exchange.xforce.ibmcloud.com/threat-group/guid:1dda890fa2662ed26b451c703e922315","pattern":"[url:value = 'https://exchange.xforce.ibmcloud.com/threat-group/guid:1dda890fa2662ed26b451c703e922315']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22ae668b-4a63-9ef5-46d1-00001bdff323","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network","pattern":"[url:value = 'https://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63b9b9bf-0545-84ce-c9fe-0000bdcee239","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://thehackernews.com/2021/06/ransomware-attackers-partnering-with.html","pattern":"[url:value = 'https://thehackernews.com/2021/06/ransomware-attackers-partnering-with.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--830cdbbd-5cc2-813a-a96a-0000528a7891","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.zdnet.com/article/ta575-criminal-group-using-squid-game-lures-for-dridex-malware/","pattern":"[url:value = 'https://www.zdnet.com/article/ta575-criminal-group-using-squid-game-lures-for-dridex-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0fb3a8f-c6a0-39a4-514d-000011d9ec2e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/ta575-uses-squid-game-lures-distribute-dridex-malware","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/ta575-uses-squid-game-lures-distribute-dridex-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21d15d2b-f7e6-cde4-11bb-00003eaf2dd5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.blackberry.com/en/2021/08/blackberry-prevents-threat-actor-group-ta575-and-dridex-malware","pattern":"[url:value = 'https://blogs.blackberry.com/en/2021/08/blackberry-prevents-threat-actor-group-ta575-and-dridex-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--626af5bf-a563-0e4e-5095-0000fed8615f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://isc.sans.edu/diary/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exploit+msmsdt/28728","pattern":"[url:value = 'https://isc.sans.edu/diary/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exploit+msmsdt/28728']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31e87dd1-560c-c57b-513d-00004c7d7769","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/","pattern":"[url:value = 'https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a9c9761-4e81-a8d8-2020-00007ada2721","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--216f6058-95eb-9709-eef2-00002e292de9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/threat-brief-hancitor-actors/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/threat-brief-hancitor-actors/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24ec49c0-7999-49c2-96d4-0000edde89d5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e10b9f6a-8ad7-4382-fde5-0000d03d44e4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://vixra.org/abs/1902.0257","pattern":"[url:value = 'https://vixra.org/abs/1902.0257']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50a92b28-0f4a-7b6d-a2c6-00001b52b483","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618","pattern":"[url:value = 'https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fa9fd00-f254-c2c3-ba67-0000fa6ec16d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.scilabs.mx/cyber-threat-profile-malteiro/","pattern":"[url:value = 'https://blog.scilabs.mx/cyber-threat-profile-malteiro/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--565b30d8-87bb-1168-5d4d-000054139fff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dd1ddd6-d7ea-6ea3-73f7-0000b8305511","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffbef815-9e37-0730-01c4-00001e27d1f4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trellix.com/en-us/about/newsroom/stories/research/evolution-of-bazarcall-social-engineering-tactics.html","pattern":"[url:value = 'https://www.trellix.com/en-us/about/newsroom/stories/research/evolution-of-bazarcall-social-engineering-tactics.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bff4bf69-d89f-b73d-4e48-00006afd31cc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/uat-5647-romcom/","pattern":"[url:value = 'https://blog.talosintelligence.com/uat-5647-romcom/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ce390ad-af90-27b1-c8a8-00006d94b269","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a03d7da7-9740-7dc5-79f3-0000eab84541","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection","pattern":"[url:value = 'https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cfe2185-6612-eb2e-a465-0000c5125621","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://labs.k7computing.com/index.php/romcom-rat-not-your-typical-love-story/","pattern":"[url:value = 'https://labs.k7computing.com/index.php/romcom-rat-not-your-typical-love-story/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7dc1b8f-f31f-882a-777a-0000384c4cc1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b49f7c52-ef79-57df-8002-0000787407eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/10/unattributed-romcom-threat-actor-spoofing-popular-apps-now-hits-ukrainian-militaries']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77c516ee-7669-6819-4858-0000a09c3b9b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0968fbcf-b798-f14e-8a75-0000daa445c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.360.cn/report/detail?id=6c9a1b56e4ceb84a8ab9e96044429adc","pattern":"[url:value = 'https://cert.360.cn/report/detail?id=6c9a1b56e4ceb84a8ab9e96044429adc']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a6d8ab9-78f2-0aaa-84fe-0000cc96ed9f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://mp.weixin.qq.com/s/Hzq4_tWmunDpKfHTlZNM-A","pattern":"[url:value = 'https://mp.weixin.qq.com/s/Hzq4_tWmunDpKfHTlZNM-A']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--107b39cf-91a1-631f-fdd0-0000a7d6b1cd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://equalit.ie/deflect-labs-report-6/","pattern":"[url:value = 'https://equalit.ie/deflect-labs-report-6/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71850968-0b66-380f-158c-0000fea213a1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.amnesty.org/en/latest/research/2020/03/targeted-surveillance-attacks-in-uzbekistan-an-old-threat-with-new-techniques/","pattern":"[url:value = 'https://www.amnesty.org/en/latest/research/2020/03/targeted-surveillance-attacks-in-uzbekistan-an-old-threat-with-new-techniques/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1bb77e4-b3b8-408d-99b9-00006650b816","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf","pattern":"[url:value = 'https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--393b3694-96e9-599d-839a-0000367b2dea","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.google/threat-analysis-group/countering-hack-for-hire-groups/","pattern":"[url:value = 'https://blog.google/threat-analysis-group/countering-hack-for-hire-groups/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c583338c-2196-8f52-c919-00009c831025","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/the-sprawling-infrastructure-of-a-careless-mercenary/","pattern":"[url:value = 'https://www.sentinelone.com/labs/the-sprawling-infrastructure-of-a-careless-mercenary/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d8c21ca-8ad9-4b63-9192-000000df8ced","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-lockbit","pattern":"[url:value = 'https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-lockbit']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9f30e47-90dd-2224-b611-00003b94507a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://security.packt.com/understanding-lockbit/","pattern":"[url:value = 'https://security.packt.com/understanding-lockbit/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c4223df-5bc8-fe20-efe5-000054d86042","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://socradar.io/lockbit-3-another-upgrade-to-worlds-most-active-ransomware/","pattern":"[url:value = 'https://socradar.io/lockbit-3-another-upgrade-to-worlds-most-active-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8604e03-0959-5c83-45ec-0000d578f8dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/better-together-global-attitude-survey-takeaways-2021/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/better-together-global-attitude-survey-takeaways-2021/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2184d1a9-bca2-9935-a056-000050299007","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.gov.pl/web/special-services/russian-cyberattacks","pattern":"[url:value = 'https://www.gov.pl/web/special-services/russian-cyberattacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1d9b0da-b354-f3e0-8cc3-00006fa23121","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/noname05716-the-pro-russian-hacktivist-group-targeting-nato/","pattern":"[url:value = 'https://www.sentinelone.com/labs/noname05716-the-pro-russian-hacktivist-group-targeting-nato/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28e6ae91-37f2-985b-4b34-0000714a416b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decoded.avast.io/martinchlumecky/bobik/","pattern":"[url:value = 'https://decoded.avast.io/martinchlumecky/bobik/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12558a3c-f4fe-490a-19b8-0000036a8cf2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/60440/","pattern":"[url:value = 'https://asec.ahnlab.com/en/60440/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37fee4c9-1098-c487-dcc2-00000a1f01a5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.pwndefend.com/2022/06/04/cve-2022-26134-honeypot-payload-analysis-example/","pattern":"[url:value = 'https://www.pwndefend.com/2022/06/04/cve-2022-26134-honeypot-payload-analysis-example/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cafdeec8-ae89-d3d7-d7d2-0000683bd25f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/","pattern":"[url:value = 'https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7280f2d4-f035-a9fa-3bc3-0000b5c4d82f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://khonggianmang.vn/uploads/CB_941_Canhbao_APT_36c5a857fa.pdf","pattern":"[url:value = 'https://khonggianmang.vn/uploads/CB_941_Canhbao_APT_36c5a857fa.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48e31af4-e248-1e9c-ef8a-0000cf95d7f3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/","pattern":"[url:value = 'https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38680ccd-66de-d920-68bb-000082dde6e3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22f155c9-7a62-4998-f239-0000677e83d8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb729287-3d43-f32c-26d7-0000ed70b098","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fortinet.com/blog/threat-research/cta-security-playbook--goblin-panda.html","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/cta-security-playbook--goblin-panda.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12fca0ff-88a4-a83b-b391-000050e2738f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/cycldek-bridging-the-air-gap/97157/","pattern":"[url:value = 'https://securelist.com/cycldek-bridging-the-air-gap/97157/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffab955d-9e78-748c-8281-0000dd20fc8d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-august-goblin-panda/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-august-goblin-panda/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d8ed97d-b004-f0c7-4a44-0000f2a56ea1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/avast/ioc/tree/master/OperationDragonCastling","pattern":"[url:value = 'https://github.com/avast/ioc/tree/master/OperationDragonCastling']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfd93319-fc80-ef0f-c9b5-0000ece5d2de","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies","pattern":"[url:value = 'https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--739ab8c4-b2fa-b223-9e73-00005e1625ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf","pattern":"[url:value = 'https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9812af2-bc74-eac1-3ffb-0000b7e29d47","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/returnedlibra/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/returnedlibra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c5aea65-2c8d-4769-f202-00009545ef75","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/thieflibra/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/thieflibra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c2e0ff5-a844-caad-7abd-00001c37e589","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/pryinglibra/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/pryinglibra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a15e030e-8903-ff19-6dd7-000059164735","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware","pattern":"[url:value = 'https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--879b12b1-4cdf-5c6a-233b-00002fc3eb11","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/windealer-dealing-on-the-side/105946","pattern":"[url:value = 'https://securelist.com/windealer-dealing-on-the-side/105946']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97771b69-f06c-1bf5-3100-0000d4279a93","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blogs.jpcert.or.jp/en/2021/10/windealer.html","pattern":"[url:value = 'https://blogs.jpcert.or.jp/en/2021/10/windealer.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--642b9d55-0b1b-c950-f5f9-0000f652a486","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf","pattern":"[url:value = 'https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--392c38dc-ae22-7575-8583-000055a259db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-trends-report-q3-2021/104708","pattern":"[url:value = 'https://securelist.com/apt-trends-report-q3-2021/104708']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb43289f-79d2-4e31-4f9e-0000b0b10428","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/it-threat-evolution-q2-2020/98230","pattern":"[url:value = 'https://securelist.com/it-threat-evolution-q2-2020/98230']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--424499aa-60da-d28e-615c-0000f1ab2980","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-trends-report-q2-2020/97937","pattern":"[url:value = 'https://securelist.com/apt-trends-report-q2-2020/97937']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--871506fb-868c-5e2b-74fe-000076609a75","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-trends-report-q2-2019/91897","pattern":"[url:value = 'https://securelist.com/apt-trends-report-q2-2019/91897']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03dca0ad-b0a9-9bbe-64d0-000004b4a988","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07170759/Microcin_Technical_4PDF_eng_final_s.pdf","pattern":"[url:value = 'https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07170759/Microcin_Technical_4PDF_eng_final_s.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b769abc1-494f-8775-0a73-00001d8605b0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/unit42-threat-actors-target-government-belarus-using-cmstar-trojan","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/unit42-threat-actors-target-government-belarus-using-cmstar-trojan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--478f4bc8-f2b4-bbfd-5dcf-000005408a6e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign","pattern":"[url:value = 'https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21394d9c-48ce-8be5-ad5c-00001aadbd5b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia","pattern":"[url:value = 'https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1185089-0ce0-bc7e-ab22-0000b345a012","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia","pattern":"[url:value = 'https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--850eb32b-db76-b255-33e6-0000e83e3c56","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/a-simple-example-of-a-complex-cyberattack/82636","pattern":"[url:value = 'https://securelist.com/a-simple-example-of-a-complex-cyberattack/82636']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d152ff09-9c92-05b8-0fff-0000ede6b35a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://securelist.com/microcin-is-here/97353","pattern":"[url:value = 'https://securelist.com/microcin-is-here/97353']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58e6fffd-98c2-0ea7-7e91-000093271f4a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/bronze-vapor","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/bronze-vapor']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85e6c6cd-8242-2d65-4e76-0000b9c877bd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/news-events/analysis-reports/ar21-112a","pattern":"[url:value = 'https://www.cisa.gov/news-events/analysis-reports/ar21-112a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--029ff5c5-4a64-9b66-6f09-00006a698a2a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/solarwinds-understanding-detecting-the-supernova-webshell-trojan","pattern":"[url:value = 'https://www.sentinelone.com/labs/solarwinds-understanding-detecting-the-supernova-webshell-trojan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff351310-dc74-1a6c-d91a-0000df0c6390","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group","pattern":"[url:value = 'https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1613e16d-0fb0-9f4e-56f7-000077a29eb8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.guidepointsecurity.com/blog/supernova-solarwinds-net-webshell-analysis","pattern":"[url:value = 'https://www.guidepointsecurity.com/blog/supernova-solarwinds-net-webshell-analysis']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7979f223-f4bd-11cc-527c-0000c12ef7c9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/solarstorm-supernova","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/solarstorm-supernova']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa8f01e0-011f-7ea0-64a7-000039883a04","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=LeKi0KfzOow&list=PLffioUnqXWkdzWcZXH-bzPVgcs2R4r7iS&index=1&t=2154s","pattern":"[url:value = 'https://www.youtube.com/watch?v=LeKi0KfzOow&list=PLffioUnqXWkdzWcZXH-bzPVgcs2R4r7iS&index=1&t=2154s']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89da95b7-feb7-3468-61eb-00005e57e827","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://vb2020.vblocalhost.com/uploads/VB2020-43.pdf","pattern":"[url:value = 'https://vb2020.vblocalhost.com/uploads/VB2020-43.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e79e8b3c-e540-ca36-2590-000016c7a67e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-india-and-hong-kong-using-new-variant-of-mgbot-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--974c03ee-8a8d-78b3-25c6-0000034de6eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://attack.mitre.org/groups/G1021/","pattern":"[url:value = 'https://attack.mitre.org/groups/G1021/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1bd280e8-280f-56eb-da66-000000d9ef1e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/","pattern":"[url:value = 'https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3eaa652-4576-7a0d-14fa-000023ccafda","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://twitter.com/cglyer/status/1480734487000453121","pattern":"[url:value = 'https://twitter.com/cglyer/status/1480734487000453121']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4121e1b1-60a1-9eed-dec0-00003be6033b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility","pattern":"[url:value = 'https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--892c2772-6298-f32d-6b68-00004b1e279f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a781d4e2-9900-a796-6e64-000021fbf26a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8a83522-893b-afb0-db54-0000b5833e94","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/MrDanPerez/status/1390285821786394624","pattern":"[url:value = 'https://twitter.com/MrDanPerez/status/1390285821786394624']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d3f5087-3577-6e63-177b-00001cd1384f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://intrusiontruth.wordpress.com/2021/05/06/an-apt-with-no-name","pattern":"[url:value = 'https://intrusiontruth.wordpress.com/2021/05/06/an-apt-with-no-name']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a917bcf3-78c4-a8e9-51c9-00008857ecfd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.justice.gov/opa/press-release/file/1295986/download","pattern":"[url:value = 'https://www.justice.gov/opa/press-release/file/1295986/download']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bcba78a-1842-b76f-4f91-0000f524eaa5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.justice.gov/opa/press-release/file/1295981/download","pattern":"[url:value = 'https://www.justice.gov/opa/press-release/file/1295981/download']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97bb6749-d2be-82de-37fa-0000fd326412","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion","pattern":"[url:value = 'https://www.justice.gov/opa/pr/two-chinese-hackers-working-ministry-state-security-charged-global-computer-intrusion']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4487e050-8756-9104-42c0-0000b5688e35","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca89a87b-f7d7-8318-0a88-00005e68cfb0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.softpedia.com/news/trochilus-rat-evades-antivirus-detection-used-for-cyber-espionage-in-south-east-asia-498776.shtml","pattern":"[url:value = 'https://news.softpedia.com/news/trochilus-rat-evades-antivirus-detection-used-for-cyber-espionage-in-south-east-asia-498776.shtml']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bd23147-60eb-ac8b-4ea3-00002f236a3a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://app.box.com/s/z1uanuv1vn3vw5iket1r6bqrmlra0gpn","pattern":"[url:value = 'https://app.box.com/s/z1uanuv1vn3vw5iket1r6bqrmlra0gpn']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--139d71fc-8b30-3889-ee3c-0000f0326847","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://otx.alienvault.com/pulse/55bbc68e67db8c2d547ae393","pattern":"[url:value = 'https://otx.alienvault.com/pulse/55bbc68e67db8c2d547ae393']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9487c39e-f197-0d8c-b195-0000a4e4659d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: Invoke-PowerShellTcp.ps","pattern":"[domain-name:value = 'Invoke-PowerShellTcp.ps']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc6ef393-27a3-2efe-71bc-00009eb8bdea","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/21/a/earth-wendigo-injects-javascript-backdoor-to-service-worker-for-.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/21/a/earth-wendigo-injects-javascript-backdoor-to-service-worker-for-.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5245a6a1-682e-96ba-31e9-0000d227dcdb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/en/eset-research/operation-fishmedley/","pattern":"[url:value = 'https://www.welivesecurity.com/en/eset-research/operation-fishmedley/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18888ee1-f2a6-77e5-cbe9-00001a3541f6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=-7Swd1ZetiQ","pattern":"[url:value = 'https://www.youtube.com/watch?v=-7Swd1ZetiQ']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--376d6cf1-a7c5-7fc3-b045-0000ba3b6530","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/pdf/2022-year-in-retrospect-report.pdf","pattern":"[url:value = 'https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/pdf/2022-year-in-retrospect-report.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28c2e2f9-ec35-dab1-252c-000057413f2b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/jolly-jellyfish/NCSC-MAR-Jolly-Jellyfish.pdf","pattern":"[url:value = 'https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/jolly-jellyfish/NCSC-MAR-Jolly-Jellyfish.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f34d215e-abb1-79ce-ff62-000016a66e29","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-trends-report-q2-2021/103517","pattern":"[url:value = 'https://securelist.com/apt-trends-report-q2-2021/103517']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94a52399-23c6-cff4-c475-00001ea1e643","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/apt-annual-review-2021/105127","pattern":"[url:value = 'https://securelist.com/apt-annual-review-2021/105127']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf45069b-55e7-8e71-99ff-000055dc0099","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass","pattern":"[url:value = 'https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93e8b3e4-5db6-40ed-3adb-00003ba4aa70","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools","pattern":"[url:value = 'https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a0b6c61-7dda-32cc-1e53-0000e3f919b0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html","pattern":"[url:value = 'https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42fc69ea-32af-c132-5dff-000050377e43","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/wp-content/uploads/2021/08/SentinelOne_-SentinelLabs_ShadowPad_WP_V2.pdf","pattern":"[url:value = 'https://www.sentinelone.com/wp-content/uploads/2021/08/SentinelOne_-SentinelLabs_ShadowPad_WP_V2.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6ea9173-74cb-1c28-a34f-00008a44236c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://media-exp1.licdn.com/dms/document/C561FAQHhWFRcWmdCPw/feedshare-document-pdf-analyzed/0/1639591145314?e=1658966400&v=beta&t=_uCcyEVg6b_VDiBTvWQIXtBOdQ1GQAAydqGyq62KA3E","pattern":"[url:value = 'https://media-exp1.licdn.com/dms/document/C561FAQHhWFRcWmdCPw/feedshare-document-pdf-analyzed/0/1639591145314?e=1658966400&v=beta&t=_uCcyEVg6b_VDiBTvWQIXtBOdQ1GQAAydqGyq62KA3E']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0635058a-deca-0962-3098-00003310eb98","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan","pattern":"[url:value = 'https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--946f4539-dc9e-e738-10e1-00008fcf5cac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operations-of-winnti-group.pdf","pattern":"[url:value = 'https://hello.global.ntt/-/media/ntt/global/insights/white-papers/the-operations-of-winnti-group.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61786a1a-aeb1-3858-60ee-0000240b194a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/h/irontiger-compromises-chat-app-Mimi-targets-windows-mac-linux-users.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/h/irontiger-compromises-chat-app-Mimi-targets-windows-mac-linux-users.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcb29ac5-9441-703d-6977-0000cdd3a1c9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/diceyf-deploys-gameplayerframework-in-online-casino-development-studio/107723/","pattern":"[url:value = 'https://securelist.com/diceyf-deploys-gameplayerframework-in-online-casino-development-studio/107723/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d38d878-76a3-9d0a-443e-0000cf778bb2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf","pattern":"[url:value = 'https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-40-LunghiHorejsi.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e647f66-11ea-7c15-1dbf-00005a54325a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=QXGO4RJaUPQ","pattern":"[url:value = 'https://www.youtube.com/watch?v=QXGO4RJaUPQ']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--887f6d4a-0bf0-3649-64b2-000099923477","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://documents.trendmicro.com/assets/txt/earth-berberoka-domains-2.txt","pattern":"[url:value = 'https://documents.trendmicro.com/assets/txt/earth-berberoka-domains-2.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f37acea-29fc-4250-0706-0000ea0c466d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://documents.trendmicro.com/assets/txt/earth-berberoka-macos-iocs-2.txt","pattern":"[url:value = 'https://documents.trendmicro.com/assets/txt/earth-berberoka-macos-iocs-2.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76e6e555-ade6-0614-9258-0000f461e967","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt","pattern":"[url:value = 'https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac4b943a-3662-3109-a25e-000029a9f242","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt","pattern":"[url:value = 'https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7782df8-4522-01e3-e56d-00003155c490","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/22/d/new-apt-group-earth-berberoka-targets-gambling-websites-with-old.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb35fe3e-ee08-4bae-52cc-0000060f859f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf","pattern":"[url:value = 'https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-berberoka.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5eca8abc-388f-c93b-de4f-000082ef19eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/moneylibra/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/moneylibra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dc070d7-9cbe-851d-a3ae-0000c8ebdd70","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/k/analysis-of-kinsing-malwares-use-of-rootkit.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/k/analysis-of-kinsing-malwares-use-of-rootkit.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba85c186-3814-f7f6-003d-00005efdb386","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a04112d4-23c8-e699-742b-000007d9d937","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/ruinousursa/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/ruinousursa/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a09f114c-c2b9-1f66-07ad-0000be9f9c6f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/","pattern":"[url:value = 'https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b014b33-7db9-16be-71d2-0000b6d1b874","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/_cpresearch_/status/1541753913732366338","pattern":"[url:value = 'https://twitter.com/_cpresearch_/status/1541753913732366338']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42ea07c3-2ab8-9230-8118-00006801f054","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bbc.com/news/technology-62072480","pattern":"[url:value = 'https://www.bbc.com/news/technology-62072480']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc253b64-cdd7-3fd7-4ef8-0000cc1e1df1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.deepinstinct.com/blog/polonium-apt-group-uncovering-new-elements","pattern":"[url:value = 'https://www.deepinstinct.com/blog/polonium-apt-group-uncovering-new-elements']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30849040-4585-523d-9bc9-00001f78057d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://teamt5.org/en/posts/assassinations-of-minininja-in-various-apac-countries/","pattern":"[url:value = 'https://teamt5.org/en/posts/assassinations-of-minininja-in-various-apac-countries/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4734999c-ea92-de60-a038-00008148c19b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://community.riskiq.com/article/d8b749f2","pattern":"[url:value = 'https://community.riskiq.com/article/d8b749f2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b2f64e0-6d5e-9ef6-aa59-0000f7d4069f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html","pattern":"[url:value = 'https://gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2ab005c-21ce-fbef-9054-0000d0d4e8c8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/new-toddycat-apt-group-targets-exchange-servers-in-asia-europe/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/new-toddycat-apt-group-targets-exchange-servers-in-asia-europe/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d4ea151-4784-c3f5-38a9-0000bf70e08b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://webz.io/dwp/new-ransomware-group-ransomhouse-is-it-real-or-fake/","pattern":"[url:value = 'https://webz.io/dwp/new-ransomware-group-ransomhouse-is-it-real-or-fake/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a56e59e-8212-c353-bcba-0000a2fa2346","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti","pattern":"[url:value = 'https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c20342a-ef96-af34-15ce-000041e855db","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b7d6349-8bee-c871-d2e0-0000eb59c60f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/","pattern":"[url:value = 'https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--970fc0c9-4920-7d99-6113-0000314d2229","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.agari.com/cyber-intelligence-research/whitepapers/acid-agari-cosmic-lynx.pdf","pattern":"[url:value = 'https://www.agari.com/cyber-intelligence-research/whitepapers/acid-agari-cosmic-lynx.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--962c528a-8c66-8ad2-70e3-0000a281885b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/25/d/bpfdoor-hidden-controller.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/25/d/bpfdoor-hidden-controller.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d47ca05d-1422-8065-d177-000067a67967","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://troopers.de/troopers22/talks/7cv8pz","pattern":"[url:value = 'https://troopers.de/troopers22/talks/7cv8pz']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8df8ce5b-87e1-42d0-fb7e-00007280049c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/","pattern":"[url:value = 'https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6f9ad22-c242-2033-d4a8-000010775fea","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/unc3524-eye-spy-email","pattern":"[url:value = 'https://www.mandiant.com/resources/unc3524-eye-spy-email']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6feb502-8d9b-cbef-a244-000034451480","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://attack.mitre.org/groups/G1003/","pattern":"[url:value = 'https://attack.mitre.org/groups/G1003/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31bf4c76-1202-926f-a26a-0000a318ff69","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/en-us/blog/who-is-ember-bear/","pattern":"[url:value = 'https://www.crowdstrike.com/en-us/blog/who-is-ember-bear/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aec3ba6-9a0e-ff03-5e51-0000bc8d255d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://nsfocusglobal.com/wp-content/uploads/2021/11/Analysis-Report-on-Lorec53-Group.pdf","pattern":"[url:value = 'https://nsfocusglobal.com/wp-content/uploads/2021/11/Analysis-Report-on-Lorec53-Group.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f1edc50-d0b9-f166-1ac3-00004f48dc41","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope","pattern":"[url:value = 'https://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc06049d-c01b-9588-b792-00008cb20e80","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fa317d2-952a-f932-549a-00003027d2ab","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/nascentursa/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/nascentursa/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc89f1fd-a8f9-5178-1511-0000d0a94ea9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/","pattern":"[url:value = 'https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb646619-bdaa-3c73-b56b-00009ef9b4fa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/","pattern":"[url:value = 'https://www.intezer.com/blog/research/elephant-malware-targeting-ukrainian-orgs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e448c353-e9f0-356c-4e8d-0000025c988c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba055ce5-2f1c-2281-5264-00003d3bb188","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/38374","pattern":"[url:value = 'https://cert.gov.ua/article/38374']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--581d797a-38e2-3af2-54ba-000030eb0616","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd2c41f1-b07c-fcd9-5247-00009bca4e23","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.expats.cz/czech-news/article/pro-russian-hackers-target-czech-websites-in-a-series-of-attacks","pattern":"[url:value = 'https://www.expats.cz/czech-news/article/pro-russian-hackers-target-czech-websites-in-a-series-of-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b76ede7e-5e38-47d1-327a-00001fa8a48d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/russia-or-ukraine-hacking-groups-take-sides/?msclkid=235244a7ba6611ec92f21c9bd3b8ee49","pattern":"[url:value = 'https://therecord.media/russia-or-ukraine-hacking-groups-take-sides/?msclkid=235244a7ba6611ec92f21c9bd3b8ee49']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b467cc1-7426-9c9a-f329-0000782e6b8d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cisa.gov/uscert/ncas/alerts/aa22-110a","pattern":"[url:value = 'https://www.cisa.gov/uscert/ncas/alerts/aa22-110a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1ffd35c-5322-830a-8e48-000016c7ebca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2020-008-copy-paste-compromises-tactics-techniques-and-procedures-used-target-multiple-australian-networks","pattern":"[url:value = 'https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2020-008-copy-paste-compromises-tactics-techniques-and-procedures-used-target-multiple-australian-networks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba1ca81c-0631-dc96-4ade-0000939575ae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyber.gov.au/acsc/view-all-content/alerts/copy-paste-compromises","pattern":"[url:value = 'https://www.cyber.gov.au/acsc/view-all-content/alerts/copy-paste-compromises']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5ceb234-ac68-f449-b4c9-00007d3b2bca","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ti.qianxin.com/blog/articles/Blade-hawk-The-activities-of-targeted-the-Middle-East-and-West-Asia-are-exposed/","pattern":"[url:value = 'https://ti.qianxin.com/blog/articles/Blade-hawk-The-activities-of-targeted-the-Middle-East-and-West-Asia-are-exposed/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7812fe39-ed13-4729-a590-0000a64a26b2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://telegra.ph/Discover-Malware-Android-03-26","pattern":"[url:value = 'https://telegra.ph/Discover-Malware-Android-03-26']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2d73d35-cf83-0e91-ce4b-0000a4896dce","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2021/09/07/bladehawk-android-espionage-kurdish/","pattern":"[url:value = 'https://www.welivesecurity.com/2021/09/07/bladehawk-android-espionage-kurdish/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17838062-1a52-6a6b-a604-0000f0171026","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.sentinelone.com/labs/chinese-threat-actor-scarab-targeting-ukraine","pattern":"[url:value = 'https://www.sentinelone.com/labs/chinese-threat-actor-scarab-targeting-ukraine']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc4896d7-0d30-b34e-9535-000023ac8299","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://web.archive.org/web/20150124025612/http://www.symantec.com:80/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012","pattern":"[url:value = 'https://web.archive.org/web/20150124025612/http://www.symantec.com:80/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5efdff24-a1cf-6560-cd27-00009b1ad81f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/adversaries/slippy-spider/","pattern":"[url:value = 'https://www.crowdstrike.com/adversaries/slippy-spider/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--756f31a0-3ca0-7a5b-0e7b-0000365e63c0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.checkpoint.com/2022/03/07/lapsus-ransomware-gang-uses-stolen-source-code-to-disguise-malware-files-as-trustworthy-check-point-customers-remain-protected/","pattern":"[url:value = 'https://blog.checkpoint.com/2022/03/07/lapsus-ransomware-gang-uses-stolen-source-code-to-disguise-malware-files-as-trustworthy-check-point-customers-remain-protected/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a69ebcd2-04cd-0686-ca67-000025bcfba1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ab6006a-d091-e759-a888-000093341ddb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf","pattern":"[url:value = 'https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c40d3275-d9bf-1049-712c-0000358dc71d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://web.archive.org/web/20191208223958/https://www.contextis.com/en/blog/avivore","pattern":"[url:value = 'https://web.archive.org/web/20191208223958/https://www.contextis.com/en/blog/avivore']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7108c37c-3c09-fe83-f9cd-00004791d854","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.contextis.com/en/news/context-identifies-new-avivore-threat-group","pattern":"[url:value = 'https://www.contextis.com/en/news/context-identifies-new-avivore-threat-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b81270c-3b4d-b41c-d92e-0000bd16bd72","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.computerweekly.com/news/252471769/New-threat-group-behind-Airbus-cyber-attacks-claim-researchers","pattern":"[url:value = 'https://www.computerweekly.com/news/252471769/New-threat-group-behind-Airbus-cyber-attacks-claim-researchers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fe7fdc3-2029-17e5-0dab-0000f8e38513","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard","pattern":"[url:value = 'https://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--325714cb-4906-178c-b050-0000b22d2f3f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations","pattern":"[url:value = 'https://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bf3d6f4-a2db-320c-6d5b-0000b56d5f96","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/campuscodi/status/1450455259202166799","pattern":"[url:value = 'https://twitter.com/campuscodi/status/1450455259202166799']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9ac4830-7a19-3443-34e8-000037dd8a29","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.thaicert.or.th/downloads/files/Threat_Group_Cards_v2.0.pdf","pattern":"[url:value = 'https://www.thaicert.or.th/downloads/files/Threat_Group_Cards_v2.0.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f470d40-859b-f808-80f2-0000d9fa627f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/china-apt-antlion-taiwan-financial-attacks","pattern":"[url:value = 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/china-apt-antlion-taiwan-financial-attacks']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b0805ed-2f86-1b85-81a3-000026e07a41","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://sebdraven.medium.com/copy-cat-of-apt-sidewinder-1893059ca68d","pattern":"[url:value = 'https://sebdraven.medium.com/copy-cat-of-apt-sidewinder-1893059ca68d']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59599374-865f-86b7-97b9-0000ef55b5f2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://about.fb.com/news/2021/11/taking-action-against-hackers-in-pakistan-and-syria/","pattern":"[url:value = 'https://about.fb.com/news/2021/11/taking-action-against-hackers-in-pakistan-and-syria/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e289e7b-e91a-24a0-5e38-000076a5cd6f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.talosintelligence.com/2021/07/sidecopy.html","pattern":"[url:value = 'https://blog.talosintelligence.com/2021/07/sidecopy.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6af2cea0-957b-2535-5614-00002bc47154","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.telsy.com/sidecopy-apt-from-windows-to-nix/","pattern":"[url:value = 'https://www.telsy.com/sidecopy-apt-from-windows-to-nix/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12b79144-6f6a-124e-1082-0000bebafdd4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.malwarebytes.com/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure/","pattern":"[url:value = 'https://blog.malwarebytes.com/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38372057-c3f7-6041-c248-0000b0bcfc0e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.seqrite.com/blog/operation-sidecopy/","pattern":"[url:value = 'https://www.seqrite.com/blog/operation-sidecopy/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fcf1eed-7dd0-c3c0-6b5a-00008ad6e69c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.netwitness.com/wp-content/uploads/FIN13-Elephant-Beetle-NetWitness.pdf","pattern":"[url:value = 'https://www.netwitness.com/wp-content/uploads/FIN13-Elephant-Beetle-NetWitness.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e340eb8c-925b-53b9-d0ef-0000d70fcc1e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf","pattern":"[url:value = 'https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f2a02f2-487e-f8dd-6499-0000abbb496b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation","pattern":"[url:value = 'https://blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55887af2-1750-6de4-179b-00007485782b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/fin13-cybercriminal-mexico","pattern":"[url:value = 'https://www.mandiant.com/resources/fin13-cybercriminal-mexico']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f1cb450-c576-8ad0-97ab-00000c625cb2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.group-ib.com/opera1er-apt","pattern":"[url:value = 'https://blog.group-ib.com/opera1er-apt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b837e457-47da-218b-b7f6-00001f2aeec4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www2.swift.com/isac/report/10118","pattern":"[url:value = 'https://www2.swift.com/isac/report/10118']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abfc723d-00dc-c9ea-f32f-000071c79685","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-common-raven-iocs","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-common-raven-iocs']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--587e074c-bd21-7a52-3873-0000750afbae","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:03-04:00","name":"url: https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04b829ee-5a1e-af73-5ee4-0000d6f61c55","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://public.gdatasoftware.com/Presse/Publikationen/Whitepaper/EN/GDATA_TooHash_CaseStudy_102014_EN_v1.pdf","pattern":"[url:value = 'https://public.gdatasoftware.com/Presse/Publikationen/Whitepaper/EN/GDATA_TooHash_CaseStudy_102014_EN_v1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69e7d99e-8031-a78e-859c-00006d6fd9b0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://hitcon.org/2016/pacific/0composition/pdf/1202/1202%20R0%200930%20an%20intelligance-driven%20approach%20to%20cyber%20defense.pdf","pattern":"[url:value = 'https://hitcon.org/2016/pacific/0composition/pdf/1202/1202%20R0%200930%20an%20intelligance-driven%20approach%20to%20cyber%20defense.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f127aa6b-71a2-e702-b175-000041168096","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.venustech.com.cn/uploads/2018/08/231401512426.pdf","pattern":"[url:value = 'https://www.venustech.com.cn/uploads/2018/08/231401512426.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f67862f-d01e-04e7-3be6-000079688f0a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2021/06/09/gelsemium-when-threat-actors-go-gardening/","pattern":"[url:value = 'https://www.welivesecurity.com/2021/06/09/gelsemium-when-threat-actors-go-gardening/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ac11830-4c27-67ef-9b00-0000be65ca0b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-winter","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-winter']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2434b542-1905-9cf5-61d6-00003f6eb26c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/blog/ransomware-groups-use-tor-based-backdoor-for-persistent-access","pattern":"[url:value = 'https://www.secureworks.com/blog/ransomware-groups-use-tor-based-backdoor-for-persistent-access']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10566399-eef4-97a0-659c-0000ca6c0a64","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/gold-waterfall","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/gold-waterfall']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2940d78e-7f5e-fd6d-7de7-0000a7786145","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-symphony","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-symphony']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ec97d4d-f1ef-73ea-d8b8-0000f41d26ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-southfield","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-southfield']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8ce9e2d-aa06-739e-dec2-000057fdd8e6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-skyline","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-skyline']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af314778-81e5-a8b8-7913-00004072a511","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-riverview","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-riverview']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16f4d4a2-f43c-4edf-f863-0000710efaa8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-13th-2020-extortion-gone-wild/","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-13th-2020-extortion-gone-wild/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a65c7e0c-e514-9839-3cd4-00002e0df5cb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-northfield","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-northfield']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b6d6af0-6e5d-6cbb-6091-0000eda3a8bd","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-mansard","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-mansard']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b8f4672-1700-d792-fb35-000078278fc9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-garden","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-garden']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5170cc9-f921-d1b2-1018-0000456e226f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-galleon","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-galleon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3a57cd1-799e-754c-3bf1-00005d0b7be7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/gold-galleon-how-a-nigerian-cyber-crew-plunders-the-shipping-industry","pattern":"[url:value = 'https://www.secureworks.com/research/gold-galleon-how-a-nigerian-cyber-crew-plunders-the-shipping-industry']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c10c3c1d-cae7-72ea-7868-00009acd4098","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-flanders","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-flanders']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73578e27-b54e-566a-1e55-0000997b642a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-fairfax","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-fairfax']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2971b009-7ee4-c108-2cf1-00003860911a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/monsterlibra/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/monsterlibra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44caeabd-cc61-7ad8-c5b2-0000e6d01861","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://attack.mitre.org/groups/G0127/","pattern":"[url:value = 'https://attack.mitre.org/groups/G0127/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--150b5be1-b750-aef2-85cb-000092cba23b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.hhs.gov/sites/default/files/mespinoza-goldburlap-cyborgspider-analystnote-tlpwhite.pdf","pattern":"[url:value = 'https://www.hhs.gov/sites/default/files/mespinoza-goldburlap-cyborgspider-analystnote-tlpwhite.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e524f5c-4559-e7bf-34a3-00006354f156","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-burlap","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-burlap']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3013fd0-e366-e92d-c2d0-000056266a97","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://conferences.law.stanford.edu/cyberday/wp-content/uploads/sites/10/2016/10/2a_15GlobalThreatReport_Extracted.pdf","pattern":"[url:value = 'https://conferences.law.stanford.edu/cyberday/wp-content/uploads/sites/10/2016/10/2a_15GlobalThreatReport_Extracted.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c683bf04-e5d8-24c6-4a02-0000e4938d59","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://statescoop.com/baltimore-ransomware-crowdstrike-extortion/","pattern":"[url:value = 'https://statescoop.com/baltimore-ransomware-crowdstrike-extortion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d3dbec5-6437-3841-4f07-0000413cdeaf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1","pattern":"[url:value = 'https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0872137b-ef82-a45b-a54a-000073369395","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/ecrime-ecosystem/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/ecrime-ecosystem/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c85f740-0bfa-08b0-12a4-000042c3c827","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://go.crowdstrike.com/rs/281-OBQ-266/images/Report_BosonSpider.pdf","pattern":"[url:value = 'https://go.crowdstrike.com/rs/281-OBQ-266/images/Report_BosonSpider.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cf5462a-79cc-415b-1554-0000aa586804","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/cutwail-spam-campaign-uses-steganography-to-distribute-urlzone/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/cutwail-spam-campaign-uses-steganography-to-distribute-urlzone/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43b9ca75-d4ea-8ff0-a52f-000025e4dbba","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group","pattern":"[url:value = 'https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0fd2136-da47-e370-fd35-00009b03470e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-evergreen","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-evergreen']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99441390-7f77-c9fd-9217-0000193b39dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf","pattern":"[url:value = 'https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8180d39d-8196-b3b3-3847-000046107b70","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/analysis-of-ecrime-menu-style-toolkits/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/analysis-of-ecrime-menu-style-toolkits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9670e2cd-f043-ff06-1b1b-0000514ca079","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel","pattern":"[url:value = 'https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b97d8a96-b08d-9c1e-488b-0000e230fc15","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-2/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-2/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--137ef45c-d65a-dc9b-1051-000056bdeaeb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.youtube.com/watch?v=qxPXxWMI2i4","pattern":"[url:value = 'https://www.youtube.com/watch?v=qxPXxWMI2i4']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87b20944-05c5-1431-dcb5-0000774809dc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de0f1e0d-ebeb-f30d-98ee-0000b850f46d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/gold-dupont","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/gold-dupont']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90351677-ef01-ad56-2747-0000efe34a1f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-lagoon","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-lagoon']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea4c8178-da12-90cb-266d-0000f366d81d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-analyzing-a-fowl-banking-trojan-part-1/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-analyzing-a-fowl-banking-trojan-part-1/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--749095a8-9b03-0a13-1621-0000df24a419","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeServicesCyberFrontLines.pdf","pattern":"[url:value = 'https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeServicesCyberFrontLines.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cfdb38e-23b4-6718-4b54-000013390062","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.crowdstrike.com/blog/ransomware-preparedness-a-call-to-action/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/ransomware-preparedness-a-call-to-action/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9198180c-d394-a2b4-2831-000081a33f74","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cyberscoop.com/coronavirus-hacking-disinformation-ransomware-spearphishing/","pattern":"[url:value = 'https://www.cyberscoop.com/coronavirus-hacking-disinformation-ransomware-spearphishing/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9718af29-39d7-f01a-d13d-0000f9190026","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-malware-gang-steals-millions-from-south-korean-users/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-malware-gang-steals-millions-from-south-korean-users/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82d35b36-8b01-467c-4e86-00009205dbff","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/18/f/fakespy-android-information-stealing-malware-targets-japanese-and-korean-speaking-users.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/18/f/fakespy-android-information-stealing-malware-targets-japanese-and-korean-speaking-users.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9e12e6c-1f37-631d-8ed4-000069b1ac81","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/18/d/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/18/d/xloader-android-spyware-and-banking-trojan-distributed-via-dns-spoofing.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23d0ec6e-2033-7a7a-402b-0000c227cd93","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/18/k/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/18/k/a-look-into-the-connection-between-xloader-and-fakespy-and-their-possible-ties-with-the-yanbian-gang.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e45ba416-d504-c297-7d49-0000da0f6b19","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.riskiq.com/blog/external-threat-management/yanbian-gang-malware-distribution/","pattern":"[url:value = 'https://www.riskiq.com/blog/external-threat-management/yanbian-gang-malware-distribution/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72c0d837-4efe-5593-fe3c-000007d73b6e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cert.gov.ua/article/5098518","pattern":"[url:value = 'https://cert.gov.ua/article/5098518']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f8bf740-8958-2ed2-454c-0000a57be5c3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/picassoloader-and-cobalt-strike-beacon-detection-uac-0057-aka-ghostwriter-hacking-group-attacks-the-ukrainian-leading-military-educational-institution/","pattern":"[url:value = 'https://socprime.com/blog/picassoloader-and-cobalt-strike-beacon-detection-uac-0057-aka-ghostwriter-hacking-group-attacks-the-ukrainian-leading-military-educational-institution/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c0da8e9-1a35-e88b-562a-00004a2ae4a1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://socprime.com/blog/uac-0057-attack-detection-a-surge-in-adversary-activity-distributing-picassoloader-and-cobalt-strike-beacon/","pattern":"[url:value = 'https://socprime.com/blog/uac-0057-attack-detection-a-surge-in-adversary-activity-distributing-picassoloader-and-cobalt-strike-beacon/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ee8b857-bdea-f62a-a78a-00001f48332f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bleepingcomputer.com/news/security/meta-ukrainian-officials-military-targeted-by-ghostwriter-hackers","pattern":"[url:value = 'https://www.bleepingcomputer.com/news/security/meta-ukrainian-officials-military-targeted-by-ghostwriter-hackers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cd99e04-5a47-320e-d504-0000e3b220fa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/unc1151-linked-to-belarus-government","pattern":"[url:value = 'https://www.mandiant.com/resources/unc1151-linked-to-belarus-government']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--888dfe2a-1438-983e-abdc-0000d89ab5be","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/hatr/status/1377220336597483520","pattern":"[url:value = 'https://twitter.com/hatr/status/1377220336597483520']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d57a3329-dcc0-d84b-d518-00008751c506","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a9bd99c-707e-b257-036c-0000375830ea","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://therecord.media/redecho-group-parks-domains-after-public-exposure/","pattern":"[url:value = 'https://therecord.media/redecho-group-parks-domains-after-public-exposure/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f639ab23-b32a-5a20-f9f3-0000dc8b50cb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.recordedfuture.com/redecho-targeting-indian-power-sector/","pattern":"[url:value = 'https://www.recordedfuture.com/redecho-targeting-indian-power-sector/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1eafcfe1-2d6b-d8cf-d5fa-0000565d8adf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.thedailybeast.com/how-chinas-devastating-microsoft-hack-puts-us-all-at-risk","pattern":"[url:value = 'https://www.thedailybeast.com/how-chinas-devastating-microsoft-hack-puts-us-all-at-risk']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fbeea79-bfe9-eeea-7227-0000271e93d3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.nextron-systems.com/2021/03/06/scan-for-hafnium-exploitation-evidence-with-thor-lite","pattern":"[url:value = 'https://www.nextron-systems.com/2021/03/06/scan-for-hafnium-exploitation-evidence-with-thor-lite']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--395290cd-a68d-1a02-c05a-00009925fa46","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server","pattern":"[url:value = 'https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3776c027-2748-52e3-6874-0000bbe816bb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshell.md","pattern":"[url:value = 'https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshell.md']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--839ea99a-fb34-d7f5-d916-00006c80c1e8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.huntress.com/blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers","pattern":"[url:value = 'https://www.huntress.com/blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34021ccd-46c1-ab6d-af74-000065787cf8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pastebin.com/J4L3r2RS","pattern":"[url:value = 'https://pastebin.com/J4L3r2RS']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4b5c643-25ce-aee7-6dd5-0000a0014148","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021","pattern":"[url:value = 'https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2666aa8c-7fee-f824-6523-0000ec603762","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/falcon-complete-stops-microsoft-exchange-server-zero-day-exploits","pattern":"[url:value = 'https://www.crowdstrike.com/blog/falcon-complete-stops-microsoft-exchange-server-zero-day-exploits']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3159111f-6e51-dd4d-c58e-0000a2626b92","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/cert-lv/exchange_webshell_detection","pattern":"[url:value = 'https://github.com/cert-lv/exchange_webshell_detection']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d03e838e-a8d7-18eb-dad0-0000ce12a5d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/microsoft/CSS-Exchange/tree/main/Security","pattern":"[url:value = 'https://github.com/microsoft/CSS-Exchange/tree/main/Security']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3beef223-25e7-6edc-0e36-0000af45f16c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289","pattern":"[url:value = 'https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e5db44f-516a-9c20-d183-00001ac3c988","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://us-cert.cisa.gov/ncas/alerts/aa21-062a","pattern":"[url:value = 'https://us-cert.cisa.gov/ncas/alerts/aa21-062a']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54192606-2bcb-843c-70da-0000574e12ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd6229d5-2f6d-4fff-bf80-000098ce2d17","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/ESETresearch/status/1366862946488451088","pattern":"[url:value = 'https://twitter.com/ESETresearch/status/1366862946488451088']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3a80e4f-a390-362a-024a-0000c93e89f4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day","pattern":"[url:value = 'https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bef22b3-d7b1-efbd-d460-0000a469bc45","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.reddit.com/r/msp/comments/lwmo5c/mass_exploitation_of_onprem_exchange_servers","pattern":"[url:value = 'https://www.reddit.com/r/msp/comments/lwmo5c/mass_exploitation_of_onprem_exchange_servers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a23146fd-a741-0085-52fc-0000be974d36","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html","pattern":"[url:value = 'https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--504ef781-ff93-78b2-aab5-0000de182fa4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76fc883f-a7ec-cbe5-b84f-00009c104b01","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://attack.mitre.org/groups/G0125/","pattern":"[url:value = 'https://attack.mitre.org/groups/G0125/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--973c38e0-bec9-9e9b-4ac5-0000621d1fa2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: MEGA.In","pattern":"[domain-name:value = 'MEGA.In']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd213276-7c55-0d5a-7965-00000513159e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/adept-libra/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/adept-libra/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f805f007-202e-a174-8dc4-000095ef46e1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.lacework.com/teamtnt-builds-botnet-from-chinese-cloud-servers/","pattern":"[url:value = 'https://www.lacework.com/teamtnt-builds-botnet-from-chinese-cloud-servers/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80ad40c2-f3a5-b301-f806-00003e439750","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cyware.com/news/hildegard-teamtnts-new-feature-rich-malware-targeting-kubernetes-6587eb45","pattern":"[url:value = 'https://cyware.com/news/hildegard-teamtnts-new-feature-rich-malware-targeting-kubernetes-6587eb45']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0620966e-7f9c-e370-5e06-0000aa4aaed6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92e48ebc-eb12-599a-6b0e-00003a55d1ec","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/","pattern":"[url:value = 'https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e702879-28cf-c8d6-0e60-0000a20ec9a9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials","pattern":"[url:value = 'https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91a7e8ca-6e76-8094-c41f-0000b65b1906","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool","pattern":"[url:value = 'https://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22268255-6281-6cc3-6a38-000045b9d6e3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.aquasec.com/teamtnt-campaign-against-docker-kubernetes-environment","pattern":"[url:value = 'https://blog.aquasec.com/teamtnt-campaign-against-docker-kubernetes-environment']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a396f4e-7c74-6b4c-bae1-000033121a3e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://malpedia.caad.fkie.fraunhofer.de/details/elf.teamtnt","pattern":"[url:value = 'https://malpedia.caad.fkie.fraunhofer.de/details/elf.teamtnt']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--272f3fa4-4fcd-f485-15f3-0000d908a750","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/","pattern":"[url:value = 'https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a89b2ac-04f3-3bbd-7951-00006683160e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/solarphoenix/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/solarphoenix/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04f5678f-0fe3-0a4c-f888-0000f974e2e4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware","pattern":"[url:value = 'https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b264a75-8938-c833-933a-00007ed7cd1c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/fireeye/sunburst_countermeasures","pattern":"[url:value = 'https://github.com/fireeye/sunburst_countermeasures']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60430dd7-c704-aad4-fbfc-000026cb081c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://pastebin.com/6EDgCKxd","pattern":"[url:value = 'https://pastebin.com/6EDgCKxd']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--474f305c-08ad-56d8-ce61-0000a8f5f8cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://news.sophos.com/en-us/2020/12/21/how-sunburst-malware-does-defense-evasion/","pattern":"[url:value = 'https://news.sophos.com/en-us/2020/12/21/how-sunburst-malware-does-defense-evasion/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48268708-674f-cd42-6861-00005caa9f2f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/mitre-attack/identifying-unc2452-related-techniques-9f7b6c7f3714","pattern":"[url:value = 'https://medium.com/mitre-attack/identifying-unc2452-related-techniques-9f7b6c7f3714']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--848f5169-a26f-f45b-5895-00006dd74721","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/cycraft/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730","pattern":"[url:value = 'https://medium.com/cycraft/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c21eda9c-3901-c2d6-263b-000081a7140e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cycraft.com/download/%5BTLP-White%5D20200415%20Chimera_V4.1.pdf","pattern":"[url:value = 'https://cycraft.com/download/%5BTLP-White%5D20200415%20Chimera_V4.1.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d483ec3b-8794-91c7-5e01-00005a322171","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/","pattern":"[url:value = 'https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--627da1de-355a-096f-9153-0000eac9dddf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://i.blackhat.com/USA-20/Thursday/us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf","pattern":"[url:value = 'https://i.blackhat.com/USA-20/Thursday/us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0c07d23-2948-04cf-aa48-0000cf8878bc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2020/03/the-cycle-of-adversary-pursuit.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2020/03/the-cycle-of-adversary-pursuit.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcb771f0-a33e-90d9-9b91-00002293583a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=CgDtm05qApE","pattern":"[url:value = 'https://www.youtube.com/watch?v=CgDtm05qApE']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2217da13-b65b-2348-65ba-00001212f0f7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456","pattern":"[url:value = 'https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9aca1967-5288-0490-adc8-0000595f1a27","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://twitter.com/anthomsec/status/1321865315513520128","pattern":"[url:value = 'https://twitter.com/anthomsec/status/1321865315513520128']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b9a047d-96b4-5a7f-048f-0000dce901e8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.brighttalk.com/webcast/7451/447347","pattern":"[url:value = 'https://www.brighttalk.com/webcast/7451/447347']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2774987e-833c-8a1a-fed1-000044e9b5e4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdade7a4-d9e0-7283-eac2-0000935f0ad1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--165e53c8-75c6-ea8a-6603-000016d8909a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: TEMP.Warlock","pattern":"[domain-name:value = 'TEMP.Warlock']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--332d75a0-de3b-d6bd-4ca1-0000fbf24c70","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"domain: TEMP.Warlok","pattern":"[domain-name:value = 'TEMP.Warlok']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--996b4cda-79a5-1c9c-e03b-0000f2c44d08","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020OverWatchNowheretoHide.pdf","pattern":"[url:value = 'https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020OverWatchNowheretoHide.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7789755f-b2e9-e01a-8974-000055ba9a63","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-drake","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-drake']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e876548-00cd-df05-93d7-0000e1a91029","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.bbc.com/news/world-us-canada-53195749","pattern":"[url:value = 'https://www.bbc.com/news/world-us-canada-53195749']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a582eca-9f2a-b7e4-4dfd-000006f986e8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://en.wikipedia.org/wiki/Maksim_Yakubets","pattern":"[url:value = 'https://en.wikipedia.org/wiki/Maksim_Yakubets']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef2efe62-c00d-eab0-49ee-0000e9cc9bf3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/","pattern":"[url:value = 'https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7741aaed-31cf-6335-5956-0000007f234f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/eset/malware-ioc/tree/master/xdspy/","pattern":"[url:value = 'https://github.com/eset/malware-ioc/tree/master/xdspy/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32cb1e1c-84c9-4bcb-2921-000039bd3b6f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf","pattern":"[url:value = 'https://vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe1ee473-fc01-c13b-5906-000062dc98d2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/","pattern":"[url:value = 'https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a167298-3e1f-3fe5-b792-0000eeab0299","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.zdnet.com/article/iranian-hackers-are-selling-access-to-compromised-companies-on-an-underground-forum","pattern":"[url:value = 'https://www.zdnet.com/article/iranian-hackers-are-selling-access-to-compromised-companies-on-an-underground-forum']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4483d00-b9bd-68a8-d096-0000e699c406","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/who-is-pioneer-kitten","pattern":"[url:value = 'https://www.crowdstrike.com/blog/who-is-pioneer-kitten']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--321e81d5-985d-3cba-4b90-0000a7a3262e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.zdnet.com/article/fbi-says-an-iranian-hacking-group-is-attacking-f5-networking-devices","pattern":"[url:value = 'https://www.zdnet.com/article/fbi-says-an-iranian-hacking-group-is-attacking-f5-networking-devices']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30b102e8-d086-a479-e39f-0000ddd7251e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign.pdf","pattern":"[url:value = 'https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77eb0986-081b-d528-75ed-0000f7d4a252","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/wp-content/uploads/NA-EL-Threat-Perspective-2019.pdf","pattern":"[url:value = 'https://www.dragos.com/wp-content/uploads/NA-EL-Threat-Perspective-2019.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93788790-f7fa-62c9-a8e3-000023790a4f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/wp-content/uploads/The-ICS-Threat-Landscape.pdf","pattern":"[url:value = 'https://www.dragos.com/wp-content/uploads/The-ICS-Threat-Landscape.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1efc6819-f5b6-2849-9fdc-0000feae82d7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.dragos.com/threat/parisite","pattern":"[url:value = 'https://www.dragos.com/threat/parisite']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa5f24cc-cd98-233e-2693-000066ff87e3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://youtu.be/pBDu8EGWRC4?t=2492","pattern":"[url:value = 'https://youtu.be/pBDu8EGWRC4?t=2492']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6321c710-bb3d-5d79-c464-00002082b76a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/bitso-engineering/profiling-disrupting-an-apt-spear-phishing-campaign-targeting-slack-users-in-the-financial-sector-9389533d5fc2","pattern":"[url:value = 'https://medium.com/bitso-engineering/profiling-disrupting-an-apt-spear-phishing-campaign-targeting-slack-users-in-the-financial-sector-9389533d5fc2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99094321-5f5a-05e9-b0ea-00006f71cd82","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.hivepro.com/wp-content/uploads/2022/08/Vulnerabilities-Threats-that-Matter-25th-to-31st-July.pdf","pattern":"[url:value = 'https://www.hivepro.com/wp-content/uploads/2022/08/Vulnerabilities-Threats-that-Matter-25th-to-31st-July.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b34f52f-6a58-906b-04aa-00008f18a5a5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-evilnum-apt-group-targeting-financial-sector","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-evilnum-apt-group-targeting-financial-sector']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a4a5820-a067-cfe7-37dc-000028507cf6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.rewterz.com/rewterz-news/rewterz-threat-alert-evilnum-apt-group-active-iocs-7","pattern":"[url:value = 'https://www.rewterz.com/rewterz-news/rewterz-threat-alert-evilnum-apt-group-active-iocs-7']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c5671a7-f83e-8999-1abe-00009c6db201","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e9546b0-ce12-195b-573b-0000176e34e8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/","pattern":"[url:value = 'https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd4527af-fb17-b881-3e0d-0000fa215874","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/deathstalker-mercenary-triumvirate/98177/","pattern":"[url:value = 'https://securelist.com/deathstalker-mercenary-triumvirate/98177/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ea4714b-d026-7f05-3caa-00006f2608b7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1ea9478-6b29-8a62-e393-0000fb6638ef","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/alloytaurus/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/alloytaurus/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cdd833d-91c4-8ef7-84bc-0000300956e0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://troopers.de/troopers22/talks/7cv8pz/","pattern":"[url:value = 'https://troopers.de/troopers22/talks/7cv8pz/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b86cefa-1d00-d022-04cb-00001d876f06","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.youtube.com/watch?v=fBFm2fiEPTg","pattern":"[url:value = 'https://www.youtube.com/watch?v=fBFm2fiEPTg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc55ad08-3d35-0501-1a81-0000facd7335","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://github.com/citizenlab/malware-indicators/tree/master/202006_DarkBasin","pattern":"[url:value = 'https://github.com/citizenlab/malware-indicators/tree/master/202006_DarkBasin']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f08a8ab4-9120-b06e-acc3-0000fa20096d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/","pattern":"[url:value = 'https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5d5f241-531d-4e0e-18a5-0000551d07d8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/atoms/hunter-serpens/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/atoms/hunter-serpens/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed55090b-bcf2-c8bc-fdab-000032e0b490","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/cobalt-katana","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/cobalt-katana']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a34d1894-0b22-de5f-0315-0000841af055","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/cobalt-juno","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/cobalt-juno']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31b37bdf-37cf-b548-dcd2-0000ec007599","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://s.tencent.com/research/report/836.html","pattern":"[url:value = 'https://s.tencent.com/research/report/836.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af3006e4-a134-8b66-d383-00002a1eaa57","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.epicturla.com/blog/the-lost-nazar","pattern":"[url:value = 'https://www.epicturla.com/blog/the-lost-nazar']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3905480c-4475-e6e6-6a9d-0000b5a68d71","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465","pattern":"[url:value = 'https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cede41d-80d7-1371-c45b-00000421dd9c","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2050cae6-8990-7e02-056a-0000036787ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/","pattern":"[url:value = 'https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d2dadf2-40c1-3940-c06c-00001c407cdc","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cba8826-b1e0-9b5a-905d-0000105837a1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.theregister.co.uk/2020/01/17/hackers_patch_citrix_vulnerability/","pattern":"[url:value = 'https://www.theregister.co.uk/2020/01/17/hackers_patch_citrix_vulnerability/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d85aee2-3f5f-e049-0ecc-0000f346a795","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://asec.ahnlab.com/en/52479/","pattern":"[url:value = 'https://asec.ahnlab.com/en/52479/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c95f86e4-f706-fdb6-f103-0000cc904eb3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ahnlab.com/en/contents/content-center/35891","pattern":"[url:value = 'https://www.ahnlab.com/en/contents/content-center/35891']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e07aa11b-94c0-7d0f-7b5b-0000e3c91c55","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://mobile.twitter.com/mstoned7/status/1247361687570673664","pattern":"[url:value = 'https://mobile.twitter.com/mstoned7/status/1247361687570673664']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--846a4186-bfd5-5fb1-ffc8-000055cbd41a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ahnlab.com/kr/site/securityinfo/secunews/secuNewsView.do?curPage=1&menu_dist=2&seq=29129","pattern":"[url:value = 'https://www.ahnlab.com/kr/site/securityinfo/secunews/secuNewsView.do?curPage=1&menu_dist=2&seq=29129']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--518b42ef-280a-9889-3986-0000eeeda54d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.esentire.com/web-native-pages/the-hunt-for-venom-spider-part-2","pattern":"[url:value = 'https://www.esentire.com/web-native-pages/the-hunt-for-venom-spider-part-2']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--208108b8-f812-ae6d-462d-00006d5dd398","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/blog/threat-insight/q4-2020-threat-report-quarterly-analysis-cybersecurity-trends-tactics-and-themes","pattern":"[url:value = 'https://www.proofpoint.com/us/blog/threat-insight/q4-2020-threat-report-quarterly-analysis-cybersecurity-trends-tactics-and-themes']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a44d34b7-4b57-6e06-8f60-000087206345","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta544-targets-geographies-italy-japan-range-malware","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta544-targets-geographies-italy-japan-range-malware']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bb3a674-ae7a-eb3d-272e-00000dbb7cf0","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/urlzone-top-malware-japan-while-emotet-and-line-phishing-round-out-landscape-0","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/urlzone-top-malware-japan-while-emotet-and-line-phishing-round-out-landscape-0']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9e68016-d776-b8b2-270a-00009e374593","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa0b34a8-2bcc-11dd-3790-00000fe563f3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/brushaloader-still-sweeping-victims-one-year-later","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/brushaloader-still-sweeping-victims-one-year-later']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10720dc3-b59a-fad4-5c8a-00006c3a03fa","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-essex","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-essex']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9269f6dd-2c9b-87a8-5e5b-000007af7c98","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-heron","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-heron']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d074714-dd0a-5894-7ec5-0000ce05025e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://na.eventscloud.com/file_uploads/6568237bca6dc156e5c5557c5989e97c_CrowdStrikeFal.Con2019_ThroughEyesOfAdversary_J.Ayers.pdf","pattern":"[url:value = 'https://na.eventscloud.com/file_uploads/6568237bca6dc156e5c5557c5989e97c_CrowdStrikeFal.Con2019_ThroughEyesOfAdversary_J.Ayers.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c33545b6-4222-c599-6129-0000ee18b8ac","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://fortiguard.com/encyclopedia/botnet/7630456","pattern":"[url:value = 'https://fortiguard.com/encyclopedia/botnet/7630456']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--470619a7-fc85-b2a9-04c8-00005a220221","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.kaspersky.com/about/press-releases/2019_fin7-hacking-group-targets-more-than-130-companies-after-leaders-arrest","pattern":"[url:value = 'https://www.kaspersky.com/about/press-releases/2019_fin7-hacking-group-targets-more-than-130-companies-after-leaders-arrest']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bacb4669-5652-1d97-4c46-000019e54600","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/","pattern":"[url:value = 'https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cd41914-b6f0-6632-7563-0000f5e7f1eb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://bitofhex.com/2020/02/10/sapphire-mushroom-lnk-files/","pattern":"[url:value = 'https://bitofhex.com/2020/02/10/sapphire-mushroom-lnk-files/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a758fc2-2739-a742-90b1-0000fa2906ad","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://mp.weixin.qq.com/s/S-hiGFNC6WXGrkjytAVbpA","pattern":"[url:value = 'https://mp.weixin.qq.com/s/S-hiGFNC6WXGrkjytAVbpA']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1648bdb6-0a55-b984-b39a-00001cc9de4d","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.welivesecurity.com/2019/10/10/eset-discovers-attor-spy-platform","pattern":"[url:value = 'https://www.welivesecurity.com/2019/10/10/eset-discovers-attor-spy-platform']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c57cbb2-1aa5-9859-5fd0-0000efada55e","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.research-collection.ethz.ch/bitstream/handle/20.500.11850/389371/1/Cyber-Reports-2020-01-A-one-sided-Affair.pdf","pattern":"[url:value = 'https://www.research-collection.ethz.ch/bitstream/handle/20.500.11850/389371/1/Cyber-Reports-2020-01-A-one-sided-Affair.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4eaa8cd6-0e29-5416-d429-0000dc4791d3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://app.box.com/s/xqh458fe1url7mgl072hhd0yxqw3x0jm","pattern":"[url:value = 'https://app.box.com/s/xqh458fe1url7mgl072hhd0yxqw3x0jm']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--788f3e72-c569-cf56-bde7-00009fc17c24","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan","pattern":"[url:value = 'https://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2a99cd3-d878-8d6b-9449-00000947102f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg","pattern":"[url:value = 'https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6366e46-6c16-bde6-f6d0-0000b4a5679a","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://medium.com/@Sebdraven/apt-sidewinder-tricks-powershell-anti-forensics-and-execution-side-loading-5bc1a7e7c84c","pattern":"[url:value = 'https://medium.com/@Sebdraven/apt-sidewinder-tricks-powershell-anti-forensics-and-execution-side-loading-5bc1a7e7c84c']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6305f856-d758-0014-6e56-0000304888f5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://s.tencent.com/research/report/479.html","pattern":"[url:value = 'https://s.tencent.com/research/report/479.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e593e870-4a28-99f6-1738-00005f269601","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/fireeye-sidewinder-targeted-attack.pdf","pattern":"[url:value = 'https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/fireeye-sidewinder-targeted-attack.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6bfee02-80bf-80f2-ecab-00006cd1e109","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://s.tencent.com/research/report/659.html","pattern":"[url:value = 'https://s.tencent.com/research/report/659.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39691035-5793-6880-e7db-0000a87aa941","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/l/sidewinder-leverages-south-asian-territorial-issues-for-spear-ph.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba2d0a42-942b-d414-5c81-00003858a845","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://otx.alienvault.com/pulse/5fd10760f9afb730d37c4742/","pattern":"[url:value = 'https://otx.alienvault.com/pulse/5fd10760f9afb730d37c4742/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--774b2c0a-448c-d79a-326c-000021de33b9","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/","pattern":"[url:value = 'https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e5b6a11-5ea4-5bb0-c9f5-00008a3987c6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.systemtek.co.uk/2018/07/luoxk-malware-exploiting-cve-2018-2893/","pattern":"[url:value = 'https://www.systemtek.co.uk/2018/07/luoxk-malware-exploiting-cve-2018-2893/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db3adb21-7653-a4a3-0fa3-00006939acc4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.zdnet.com/article/extensive-hacking-operation-discovered-in-kazakhstan/","pattern":"[url:value = 'https://www.zdnet.com/article/extensive-hacking-operation-discovered-in-kazakhstan/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--058543c5-832f-4b27-6a2d-000025947a69","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: http://blogs.360.cn/post/APT-C-34_Golden_Falcon.html","pattern":"[url:value = 'http://blogs.360.cn/post/APT-C-34_Golden_Falcon.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a91073a7-3269-6d9a-bd47-000031e434b3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://youtu.be/U7p0J8aMZhM?t=193","pattern":"[url:value = 'https://youtu.be/U7p0J8aMZhM?t=193']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46e02080-8a20-482f-f41e-000020cd98b2","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations","pattern":"[url:value = 'https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afee8d29-83a3-62f1-e260-00000a751117","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://x.com/MsftSecIntel/status/1730383711437283757","pattern":"[url:value = 'https://x.com/MsftSecIntel/status/1730383711437283757']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c94cbee6-d63f-12eb-d902-00005c3567f8","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cysecurity.news/2023/12/twisted-spiders-dangerous-cactus.html","pattern":"[url:value = 'https://www.cysecurity.news/2023/12/twisted-spiders-dangerous-cactus.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0efe282-7847-db89-a275-00004a3ae477","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: http://www.secureworks.com/research/threat-profiles/gold-village","pattern":"[url:value = 'http://www.secureworks.com/research/threat-profiles/gold-village']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6081dfff-0eae-4179-d181-0000d6f11b45","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf","pattern":"[url:value = 'https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99bd98fa-0b0a-2f2e-7943-0000406d7c12","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://adversary.crowdstrike.com/adversary/twisted-spider/","pattern":"[url:value = 'https://adversary.crowdstrike.com/adversary/twisted-spider/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2cfab05-fe9b-4dd9-9034-0000b4953da4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:01-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/ta2101-plays-government-imposter-distribute-malware-german-italian-and-us","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/ta2101-plays-government-imposter-distribute-malware-german-italian-and-us']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df3ef008-5cb6-5f84-80b6-00002fb8e8df","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/red-lamassu-open-season.html","pattern":"[url:value = 'https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/red-lamassu-open-season.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7242611-d9cb-706d-5941-0000164febfb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.ptsecurity.com/upload/corporate/ru-ru/analytics/calypso-apt-2019-rus.pdf","pattern":"[url:value = 'https://www.ptsecurity.com/upload/corporate/ru-ru/analytics/calypso-apt-2019-rus.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a1b16b4-9b12-9c1b-e321-0000a0dc6fc3","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/","pattern":"[url:value = 'https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e6da57f-074e-8c3f-ae12-00004ba83fb4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.proofpoint.com/us/threat-insight/post/lookback-forges-ahead-continued-targeting-united-states-utilities-sector-reveals","pattern":"[url:value = 'https://www.proofpoint.com/us/threat-insight/post/lookback-forges-ahead-continued-targeting-united-states-utilities-sector-reveals']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--385bd70e-e8fe-d500-1b1f-0000cc28b338","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/20/f/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/20/f/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07f21855-2b48-c705-dbf0-00004fa9a29b","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/","pattern":"[url:value = 'https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ed8f96e-ebef-1d57-b409-0000fb49a398","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits/","pattern":"[url:value = 'https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6d3b986-0367-1357-7ffb-00003b13b4b5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ics-cert.kaspersky.com/publications/reports/2023/09/25/apt-and-financial-attacks-on-industrial-organizations-in-h1-2023/","pattern":"[url:value = 'https://ics-cert.kaspersky.com/publications/reports/2023/09/25/apt-and-financial-attacks-on-industrial-organizations-in-h1-2023/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a248317f-f4e7-e9dc-88ed-00001581a471","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-october","pattern":"[url:value = 'https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-october']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88ab1670-a692-2410-919e-0000fd1be2c1","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.darkreading.com/threat-intelligence/iranian-government-hackers-target-us-veterans/d/d-id/1335897","pattern":"[url:value = 'https://www.darkreading.com/threat-intelligence/iranian-government-hackers-target-us-veterans/d/d-id/1335897']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a38bf9a2-e58b-c73f-4738-0000919ecc5f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain","pattern":"[url:value = 'https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--958ce380-fe63-f1e2-fcc6-0000841e319f","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.trendmicro.com/en_us/research/24/d/earth-freybug.html","pattern":"[url:value = 'https://www.trendmicro.com/en_us/research/24/d/earth-freybug.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1f4dd4d-b30c-7ed9-390c-00000272d6cb","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf","pattern":"[url:value = 'https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19508fd0-b1a4-7ff1-58ab-0000ae8fa5f7","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cfr.org/cyber-operations/apt-41","pattern":"[url:value = 'https://www.cfr.org/cyber-operations/apt-41']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27fde1d4-0adc-4243-2835-0000fa9f9469","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.mandiant.com/resources/report-apt41-double-dragon-a-dual-espionage-and-cyber-crime-operation","pattern":"[url:value = 'https://www.mandiant.com/resources/report-apt41-double-dragon-a-dual-espionage-and-cyber-crime-operation']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--581e34aa-2997-afab-3a8e-000061bc53d4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/","pattern":"[url:value = 'https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e2d8a55-ebb3-1587-6bb3-00001ab285cf","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html","pattern":"[url:value = 'https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61c200f0-49ac-4080-2878-000034d89583","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.cfr.org/cyber-operations/winnti-umbrella","pattern":"[url:value = 'https://www.cfr.org/cyber-operations/winnti-umbrella']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ba9a6c6-07f3-0b59-0a63-00003603af14","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://assets.documentcloud.org/documents/7210602/FLASH-AC-000133-TT-Published.pdf","pattern":"[url:value = 'https://assets.documentcloud.org/documents/7210602/FLASH-AC-000133-TT-Published.pdf']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c4c2d10-98ae-968b-869a-0000b710b1a6","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer","pattern":"[url:value = 'https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae8cb730-b04c-e12a-36e0-00009f9757e4","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/bronze-export","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/bronze-export']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--115954ce-5cec-0fe4-5adc-0000a3278ff5","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.secureworks.com/research/threat-profiles/bronze-atlas","pattern":"[url:value = 'https://www.secureworks.com/research/threat-profiles/bronze-atlas']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5be7cb43-9cf1-1d88-6dc6-000090ca0f32","created":"2026-08-06T13:13:00-04:00","modified":"2026-08-06T13:13:00-04:00","name":"url: https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-july-wicked-spider/","pattern":"[url:value = 'https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-july-wicked-spider/']","pattern_type":"stix","valid_from":"2026-08-06T13:13:00-04:00","confidence":50,"labels":["malicious-activity"],"object_marking_refs":["marking-definition--550e8400-e29b-41d4-a716-446655440000"]}]}