{"Event":{"uuid":"044db7d5-ed95-400d-ac3f-6affe3c31e78","info":"Threat Intelligence Platform \u2014 Threat Reports (379 indicators)","date":"2026-08-06","threat_level_id":"2","analysis":"2","published":true,"timestamp":"1786041934","Orgc":{"name":"Threat Intelligence Platform","uuid":"4111b1e9-1393-4551-8b41-1b1a91d5e016"},"Org":{"name":"Threat Intelligence Platform","uuid":"4111b1e9-1393-4551-8b41-1b1a91d5e016"},"Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}],"Attribute":[{"uuid":"543523ac-045e-4f42-83b1-ace5a1e344aa","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/cfdf7d895d9ebe4e3f80a8c722f8fa076a9d5915.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6823365f-5bde-457d-b617-fe17889ebc4a","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/cfdf7d895d9ebe4e3f80a8c722f8fa076a9d5915.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1248a5e5-27e4-43a6-a47d-eb1b1c817d66","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/cfdf7d895d9ebe4e3f80a8c722f8fa076a9d5915.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a779984c-77cb-4a86-a949-6dd4ec297e69","type":"url","category":"Network activity","to_ids":true,"value":"https://www.ic3.gov/PSA/2026/PSA260515\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"46350765-e9f5-4c82-a29d-b9386828989c","type":"domain","category":"Network activity","to_ids":true,"value":"nwww.fbi.gov","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"54fb96b8-af56-477b-99d1-7fb04d06fa24","type":"domain","category":"Network activity","to_ids":true,"value":"www.fbi.gov","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e08d233c-096f-4e40-80e9-8ec96f1e6d46","type":"domain","category":"Network activity","to_ids":true,"value":"nwww.ic3.gov","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e84be112-ed91-48de-a72d-d34cda6b3b97","type":"url","category":"Network activity","to_ids":true,"value":"https://www.ic3.gov/PSA/2026/PSA260515\\n\\nVictim","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"11ac4fee-35b5-4bd1-b10c-00e6ea481225","type":"url","category":"Network activity","to_ids":true,"value":"https://www.ic3.gov/PSA/2026/PSA260515\\n\\nInternet","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"35a3457b-76c7-45e0-91ec-a75c3ce938c9","type":"sha1","category":"Payload delivery","to_ids":true,"value":"cfdf7d895d9ebe4e3f80a8c722f8fa076a9d5915","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c92872ee-cb5c-40b5-8323-57a2063b5d48","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/3a3be7db51b80f49b5c80715c787ee9eab89dead.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0292a62e-0fb3-4123-8b8a-ed87f17a3618","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/3a3be7db51b80f49b5c80715c787ee9eab89dead.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d07ec223-6d82-40f0-b4d6-3fab58b93962","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/3a3be7db51b80f49b5c80715c787ee9eab89dead.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b2570d12-dd62-45a9-9c02-c0915db3782d","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3c77ae89-2af4-4c9b-a07c-110927ce056c","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nSource:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c9b3c06e-5e6f-4885-a6a0-f572f021b0e3","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nAnthropic","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"989a0be5-7b77-4800-8279-ab36eabe937a","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n4.7/5\\n\\nTired","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9ff8e537-06f1-495b-a387-789f1eab0e95","type":"sha256","category":"Payload delivery","to_ids":true,"value":"5e2ba7c4c53fa6e0cef58011acdd50682cf83fb7b989712d2fcf1b5173bad956","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0f247ad6-2492-4c3d-9de8-c05ef3e3fe25","type":"sha256","category":"Payload delivery","to_ids":true,"value":"7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2c0c634a-7a5d-4fd4-9026-9e1111410c7b","type":"sha256","category":"Payload delivery","to_ids":true,"value":"f398f06eefcd3558c38820a397e3193856e4e6e7c67f81ecc8e533275284b152","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"8c0fa03c-02f5-4bcf-a954-7296f0564299","type":"sha256","category":"Payload delivery","to_ids":true,"value":"c37c0ae9641d2e5329fcdee847a756bf1140fdb7f0b7c78a40fdc39055e7d926","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4a69e5c1-01b7-40e0-8a11-155c5feecfa4","type":"sha256","category":"Payload delivery","to_ids":true,"value":"0c0d206d5e68c0cf64d57ffa8bc5b1dad54f2dda52f24e96e02e237498cb9c3a","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ab0847a8-b805-4c5e-800c-8e93680ecac5","type":"sha256","category":"Payload delivery","to_ids":true,"value":"61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"477db16d-31a0-410c-aa94-5dc02dc4d118","type":"sha256","category":"Payload delivery","to_ids":true,"value":"e9b1e069efc778c1e77fb3f5fcc3bd3580bbc810604cbf4347897ddb4b8c163b","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b47951ff-53fe-442d-9199-5445bf76939a","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nIndicators","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"463d3c62-f970-48e4-bc9b-1ff0903d7590","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n}","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1695b085-5bdf-4310-9b89-a8d64158df9c","type":"domain","category":"Network activity","to_ids":true,"value":"tokens.join","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6087313e-2669-45b4-836e-7e637e28b15b","type":"domain","category":"Network activity","to_ids":true,"value":"process.execPath","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f2ae7c5b-ab0e-4563-8cc9-26e7894b0e20","type":"domain","category":"Network activity","to_ids":true,"value":"registry.npmjs.org","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c4718751-7979-4f33-9545-aa7bf5ee1d34","type":"domain","category":"Network activity","to_ids":true,"value":"tokens.add","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"619ad151-1a48-4b83-9009-07dea0508452","type":"domain","category":"Network activity","to_ids":true,"value":"val.split","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f0436968-6563-48b6-9e5e-e75cc77f257c","type":"domain","category":"Network activity","to_ids":true,"value":"k.includes","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"77476ebe-b9a3-42e5-b6ea-322528a25d90","type":"domain","category":"Network activity","to_ids":true,"value":"Object.keys","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"edbefe35-08d7-444c-bc99-744c6492caa6","type":"domain","category":"Network activity","to_ids":true,"value":"ntokens.add","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"332a2122-f1a5-4c6c-ac00-75a821393a85","type":"domain","category":"Network activity","to_ids":true,"value":"line.match","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3c8faacf-fe84-4824-8b60-501e08e2cd86","type":"domain","category":"Network activity","to_ids":true,"value":"content.split","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9741a90f-40ee-4c4e-8f72-5500a545f9fd","type":"domain","category":"Network activity","to_ids":true,"value":"process.cwd","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4e8cf2ed-294a-43f6-8d28-32c08c8b2267","type":"domain","category":"Network activity","to_ids":true,"value":"npath.join","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"90517af8-dc18-488f-a750-6df1b5df81e7","type":"domain","category":"Network activity","to_ids":true,"value":"overall.failed.join","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"fcb6e904-65d2-4a47-99ad-68cfa627a5a7","type":"domain","category":"Network activity","to_ids":true,"value":"overall.failed.length","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5dae2967-8a0d-4576-89d9-c2e997172aa0","type":"domain","category":"Network activity","to_ids":true,"value":"overall.success.join","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"44e22533-850e-455b-91eb-6d4d8a2435d2","type":"domain","category":"Network activity","to_ids":true,"value":"overall.success.length","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2ed34822-5881-44b4-a4d5-c2375bed8385","type":"domain","category":"Network activity","to_ids":true,"value":"noverall.failed.push","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"44c0258d-1b3d-4ed3-a632-c36c8be9c697","type":"domain","category":"Network activity","to_ids":true,"value":"noverall.success.push","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e5bfd5d1-0ebb-42f9-8f7e-d8bbe5bee026","type":"domain","category":"Network activity","to_ids":true,"value":"pkg.version","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a982c01d-99f8-44a1-9632-b322af9e7ceb","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nconsole.log(`\ud83d\udd11","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b1c8ba26-975e-4adb-8785-efda740fe5f4","type":"domain","category":"Network activity","to_ids":true,"value":"nprocess.exit","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"cf3dae8e-f37a-4416-8d59-9e397f28dba6","type":"domain","category":"Network activity","to_ids":true,"value":"tokens.length","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3e0668f6-49ff-4124-9fa9-5b5244af22df","type":"domain","category":"Network activity","to_ids":true,"value":"n.filter","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4e48e83f-5d4b-4b14-ab17-501133c23197","type":"domain","category":"Network activity","to_ids":true,"value":"t.trim","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b437834d-313b-48a0-970e-f22522219648","type":"domain","category":"Network activity","to_ids":true,"value":"n.map","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"60733463-cd86-4e9e-9650-8109e55edd7c","type":"domain","category":"Network activity","to_ids":true,"value":"n.split","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f2aa4d5a-7d2a-4f3f-b65e-095d1361b242","type":"domain","category":"Network activity","to_ids":true,"value":"process.env.NPM","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"02912244-4895-46b7-bff9-687f03f1741c","type":"domain","category":"Network activity","to_ids":true,"value":"nfs.unlinkSync","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9884be6d-cb8c-4521-a525-111200232b43","type":"domain","category":"Network activity","to_ids":true,"value":"nresults.failed.push","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2beaedf0-a5a5-4e9b-a903-1a8070459b0f","type":"domain","category":"Network activity","to_ids":true,"value":"nresults.success.push","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"98023016-9621-4726-8140-0074302e8db1","type":"domain","category":"Network activity","to_ids":true,"value":"process.env","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"7ef1f1c3-1bdf-49a6-8c1f-7bdf5bb136ca","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n//","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"160d4cca-e559-47b9-8a3a-db51b2324594","type":"domain","category":"Network activity","to_ids":true,"value":"fs.existsSync","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"285b39e4-3651-4a5a-981d-dd06b9e95056","type":"domain","category":"Network activity","to_ids":true,"value":"path.resolve","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2e2e5430-202a-450f-b74f-a04f5409f546","type":"domain","category":"Network activity","to_ids":true,"value":"ownedPackages.join","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2275b9ad-4b1d-4d14-9175-12f76896c32e","type":"domain","category":"Network activity","to_ids":true,"value":"ownedPackages.length","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4b523e55-d640-443d-bb7b-109df75c2848","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nconsole.log(`\\\\n\ud83d\udd0d","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"33128830-6ec5-45e3-8f94-2e402a0c0ae4","type":"domain","category":"Network activity","to_ids":true,"value":"whoami.username","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c4a05c8f-08db-48d1-af8b-2ec1feaf86f4","type":"domain","category":"Network activity","to_ids":true,"value":"err.message","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"903cf681-da59-470f-a232-3f6254d72cce","type":"domain","category":"Network activity","to_ids":true,"value":"nconsole.error","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f1cd6a86-2053-4d51-9d73-4109df44e1c1","type":"url","category":"Network activity","to_ids":true,"value":"https://registry.npmjs.org/-/whoami","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"bb73b2ba-c96c-4531-84dd-460cd9467303","type":"domain","category":"Network activity","to_ids":true,"value":"result.total","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"43e1cb6c-f4b5-477d-8a24-f8299226c4c2","type":"domain","category":"Network activity","to_ids":true,"value":"packages.length","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d0ecdb73-d5a8-4968-bd23-c9eee2b7e724","type":"domain","category":"Network activity","to_ids":true,"value":"o.package.name","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b3eb4423-7821-43ee-9805-521521c92e69","type":"domain","category":"Network activity","to_ids":true,"value":"result.objects.map","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4c17604a-1eea-4f65-bad3-cdddda1e5737","type":"domain","category":"Network activity","to_ids":true,"value":"packages.concat","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"64e180d6-720e-4889-a637-ae7d6cdfa06c","type":"domain","category":"Network activity","to_ids":true,"value":"result.objects.length","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"29558ce5-54ed-44bd-8af9-f34e393d5740","type":"domain","category":"Network activity","to_ids":true,"value":"result.objects","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5dbd8f67-2b8c-4ecc-bb8c-49ee3be9dddf","type":"url","category":"Network activity","to_ids":true,"value":"https://registry.npmjs.org/-/v1/search?text=maintainer:${encodeURIComponent(\\n\\nusername\\n\\n)}\\u0026size=${size}\\u0026from=${from}`;\\n\\nconst","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a68f590f-87d8-47ff-b06a-d040a01b92f6","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n*/\\n\\nasync","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"73302e02-e2e7-4c08-a983-a687cee79b24","type":"domain","category":"Network activity","to_ids":true,"value":"parts.join","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a046abd4-7507-4b1a-bf36-665830279e57","type":"domain","category":"Network activity","to_ids":true,"value":"parts.some","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"7ca9a6a3-79ca-44a4-a9ab-70b1e034854a","type":"domain","category":"Network activity","to_ids":true,"value":"parts.length","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"39856ab7-c77f-49db-9582-fa79e6f04c3b","type":"domain","category":"Network activity","to_ids":true,"value":"version.split","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6808961c-e69f-4b5d-8a66-375c59765cbf","type":"domain","category":"Network activity","to_ids":true,"value":"meta.readme","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a7ece32b-f555-4d68-beb5-20547f0f96eb","type":"url","category":"Network activity","to_ids":true,"value":"https://registry.npmjs.org/${encodeURIComponent(packageName)}`","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a270fa1e-0ff4-41e2-9c29-0210d84bc8be","type":"domain","category":"Network activity","to_ids":true,"value":"n.on","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"bd38fd15-e29c-4997-9ca2-bbf33f58a0df","type":"domain","category":"Network activity","to_ids":true,"value":"nres.on","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1611223b-f63b-48fa-96ca-3ad138261466","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nlet","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0db3f988-9915-409a-a47d-2c4092b741cb","type":"domain","category":"Network activity","to_ids":true,"value":"n.get","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"73b31d9c-6796-4397-a450-fcc219ef577e","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n#!/usr/bin/env","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3edba19b-88d8-44fa-a534-d3c942a926fd","type":"domain","category":"Network activity","to_ids":true,"value":"npackage.json","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"af66e2be-c4df-4946-b310-ab36d117e6cc","type":"domain","category":"Network activity","to_ids":true,"value":"time.sleep","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2b7c8c7a-9ce7-4be1-9c4b-3823e3f8ec48","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nif","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ef32a0ee-7736-4c9f-87db-1cca47452707","type":"domain","category":"Network activity","to_ids":true,"value":"ntime.sleep","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"23282cea-8c6c-4845-a6c5-98eb5b7d6fda","type":"domain","category":"Network activity","to_ids":true,"value":"nf.write","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"37b22e1e-1c68-4a2b-a8bc-c6c67cdff285","type":"domain","category":"Network activity","to_ids":true,"value":"nsubprocess.Popen","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"01cf8c33-ee5f-494e-bcea-48110c8a84ab","type":"domain","category":"Network activity","to_ids":true,"value":"nos.chmod","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"926a1f9f-9ca1-4084-ad07-f5e52729e4ac","type":"domain","category":"Network activity","to_ids":true,"value":"nurllib.request.urlretrieve","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b384463f-dddc-4549-847e-cbbfafdf7f3f","type":"domain","category":"Network activity","to_ids":true,"value":"link.startswith","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"72912e98-a2d5-490f-adcf-84e8397219e0","type":"domain","category":"Network activity","to_ids":true,"value":"r.read","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f94a01b5-84a3-4fd2-be44-0f69b6a3cca4","type":"domain","category":"Network activity","to_ids":true,"value":"urllib.request.urlopen","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4520eab2-7ba3-4a42-b63d-9bd903600ab2","type":"domain","category":"Network activity","to_ids":true,"value":"urllib.request.Request","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"83eb9137-2d73-43aa-95de-1045a713a59a","type":"url","category":"Network activity","to_ids":true,"value":"https://tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io/\\","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c6ad99de-b15f-4dd8-914f-62d7b67378e2","type":"domain","category":"Network activity","to_ids":true,"value":"urllib.request","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c5340bdf-cf4d-4fb1-81e0-fe666f0b67e0","type":"domain","category":"Network activity","to_ids":true,"value":"default.target","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"46639282-373d-4941-bf04-2cd060bab8e6","type":"domain","category":"Network activity","to_ids":true,"value":"Buffer.from","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9953092b-c125-4877-9089-5ba69c0debbd","type":"domain","category":"Network activity","to_ids":true,"value":"nfs.writeFileSync","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"8bae9bfc-bf51-406e-a06c-215f5734c5c4","type":"domain","category":"Network activity","to_ids":true,"value":"nfs.mkdirSync","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e3c0c77e-03c9-40a6-a696-ad753f294d4b","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nconst","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2f932078-1ad7-4593-9871-8c7e6dbee7ae","type":"domain","category":"Network activity","to_ids":true,"value":"os.homedir","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0b7f3a71-d375-4821-bf73-dd7081e1a44e","type":"domain","category":"Network activity","to_ids":true,"value":"process.exit","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"916ff4f0-f71f-40e9-afee-d673afdad783","type":"domain","category":"Network activity","to_ids":true,"value":"package.json","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"49485a49-108c-4493-959c-3b916d26d90b","type":"domain","category":"Network activity","to_ids":true,"value":"path.join","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5b7cce9f-c43c-450e-a4f3-19b3561bf399","type":"domain","category":"Network activity","to_ids":true,"value":"fs.readFileSync","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"907c0aae-105e-4dce-a697-47b3f2e8ba37","type":"domain","category":"Network activity","to_ids":true,"value":"JSON.parse","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"05499fd7-d065-45a4-b29d-4f65b4a8cbd8","type":"domain","category":"Network activity","to_ids":true,"value":"pgmon.service","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e26c3d6f-bfb9-4e22-a155-4c2c2ac028ec","type":"domain","category":"Network activity","to_ids":true,"value":"n.pg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a4b7bf8b-9c2c-4cd5-9331-0ffa6ae3e974","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n\ud83c\udf10","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1ff764b9-65f7-4449-8409-4ba46ab9a916","type":"domain","category":"Network activity","to_ids":true,"value":"teale.io","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6337c655-a36a-4a16-92cd-07d07e35ade3","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nTeamPCP","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"07416ec4-65fd-4469-9dcc-ebb7982c0ee0","type":"sha1","category":"Payload delivery","to_ids":true,"value":"3a3be7db51b80f49b5c80715c787ee9eab89dead","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"65960570-1b0d-4283-a11b-176dc134f780","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/2206672f013450aa8ad49eefee84da5af92140be.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d778f147-88ca-4135-a5ec-6f50aeff6520","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/2206672f013450aa8ad49eefee84da5af92140be.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3ee801b9-ed4d-4e5a-acbf-4092354d719f","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/2206672f013450aa8ad49eefee84da5af92140be.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"599b04c3-8a60-464d-8b28-bdc56116dbed","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"27f4404b-6e71-4112-bade-90e054cd327b","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/\\n\\n#10425\\n\\nFootnotes\\n\\n1","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"7139134e-653c-494e-9bcc-345144c85040","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nGitHub","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"aa56ce53-b5c2-4d74-b609-30cba1e3d46b","type":"ip-dst","category":"Network activity","to_ids":true,"value":"45.148.10.212","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"98a61a9b-24b0-47ab-84f4-7a97d455faa8","type":"domain","category":"Network activity","to_ids":true,"value":"nscan.aquasecurtiy.org","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"78ffd197-8670-4585-a6dd-d8ff364882a3","type":"sha256","category":"Payload delivery","to_ids":true,"value":"5e5fb53cf4ce5555171ff5206302ba2f4f66f5381bbf673c354c87a925473f07","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a358cafe-f204-443d-85dc-29fa2b4ed107","type":"sha256","category":"Payload delivery","to_ids":true,"value":"9efd59534d2b6b81b8b7a0eeb3ad0e74015f358650e24b9dab00c900d3118593","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"753141f1-5c48-45c5-9671-bfd613e2cfc0","type":"sha256","category":"Payload delivery","to_ids":true,"value":"4b22cedea58780ff76735c3e08b9ee8cb5d06c908ffa868152f11d45349eb696","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1730790f-a90e-462b-8820-2aa31b9f1315","type":"sha256","category":"Payload delivery","to_ids":true,"value":"dd8beb3b40df080b3fd7f9a0f5a1b02f3692f65c68980f46da8328ce8bb788ef","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c564efaf-05d7-4878-bcd0-1bcb8daa1f6c","type":"sha256","category":"Payload delivery","to_ids":true,"value":"425cd3e1a2846ac73944e891250377d2b03653e6f028833e30fc00c1abbc6d33","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"84b63b29-1c5f-4170-9e08-6618fcc7e066","type":"sha256","category":"Payload delivery","to_ids":true,"value":"edef8e5816eced552a909b878ff262c0c47776d3297bcc23796ad4cce1e85414","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"229a81c0-8919-438e-bda5-7e9db068b572","type":"sha256","category":"Payload delivery","to_ids":true,"value":"4f7a06bb51714713ab308d2f8125f3b09ee1c3ffbba1a5ffd0cc80da95fbb6cc","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"af2c7d04-d3bc-4585-8396-4340ded8379a","type":"sha256","category":"Payload delivery","to_ids":true,"value":"95ff680103570179feb0c6667a9b9b2d98c53fa5a9a451265036810390bbe70a","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"55a4253c-f6a8-46dc-a98c-735c7e3f7d3b","type":"sha256","category":"Payload delivery","to_ids":true,"value":"5aaa1d7cfa9ca4649d6ffad165435c519dc836fa6e21b729a2174ad10b057d2b","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4af86486-32df-440c-91b9-80510c2d3f9d","type":"sha256","category":"Payload delivery","to_ids":true,"value":"cc464a3961e1dbe145c75343b55c2f446e08b821782ec993728c4222b0d85589","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"767f4885-4f32-4281-a1c9-021c95b28c08","type":"sha256","category":"Payload delivery","to_ids":true,"value":"43f46547efd488e56dcf862ed4d7cc342730a803f8d5bec5cac443028fefabef","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ef48961c-4540-43c1-9a17-2ff4872a2f7e","type":"sha256","category":"Payload delivery","to_ids":true,"value":"ae3494bd6ae860d7727116681bd09fc7b20dc994ec7a8105738f0a623ea93427","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d20388de-4624-4a39-9857-6d5b58512a0d","type":"sha256","category":"Payload delivery","to_ids":true,"value":"2d7cee41048988eec27615412e7c6e2e21046f2b5faa888c24e11ca6764058ed","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d014667e-5e0e-4399-b8ee-728af0579c21","type":"sha256","category":"Payload delivery","to_ids":true,"value":"12c702212dee1cbec9471e9261501a3335963321fe76e60e5a715b5acd3c40a2","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"82252366-0f77-432b-b762-b0b77e4bb74c","type":"sha256","category":"Payload delivery","to_ids":true,"value":"27f446230c60bbf0b70e008db798bd4f33b7826f9f76f756606f5417100beef3","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d71101ca-9e62-4174-910b-65d06359b158","type":"sha256","category":"Payload delivery","to_ids":true,"value":"ecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859c","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e3f20f72-0294-461d-a79c-ab84fba60eac","type":"sha256","category":"Payload delivery","to_ids":true,"value":"d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94c","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b240f9f7-3217-4fa0-b595-ada6051cbec6","type":"sha256","category":"Payload delivery","to_ids":true,"value":"e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b254a159-1676-4a83-8b11-f1dd44b551dd","type":"sha256","category":"Payload delivery","to_ids":true,"value":"822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"29335df6-26de-4084-8977-db42e70c9728","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nSHA256","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1e74f04a-3882-4d66-ab3f-69d0f2d43776","type":"sha256","category":"Payload delivery","to_ids":true,"value":"0376b98064636c30f5fbe60fb3b1225516e23e88dd7e909937f81d9265292e7d","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3c999877-6d78-440a-b1c2-455bbc4201d9","type":"sha256","category":"Payload delivery","to_ids":true,"value":"1dc871b02cd7a1fd80babb1b8762a2fd9cc2b735d4d3759d012626de3ccc7a5b","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ec14b581-153b-4b26-a4e8-a7de0edb78c3","type":"sha256","category":"Payload delivery","to_ids":true,"value":"90d61cf37355b89fae9ff84867100e1721c1876007ef1771e465ce5a721141ad","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"7500bcbe-1f3c-4e2a-94e4-5df350ea7c64","type":"sha256","category":"Payload delivery","to_ids":true,"value":"16c855c398a8b185a907790054b70164358844a893bf9965651b88d6967c7c0a","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e7f998ce-16a3-44a9-b4d7-96b0e8c4af34","type":"sha256","category":"Payload delivery","to_ids":true,"value":"107be2081bdc3ddad2889ae037ab2ad6bbd214fb9a43eaa25390d00411d1c7dd","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"46c59571-ee9f-4767-bc71-ed1103cf5f1f","type":"sha256","category":"Payload delivery","to_ids":true,"value":"62585efcdc7767f3fe0b9ae2897fe03bf331934492fd7a5da46f14fd7bf705c8","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5dff9532-a10f-4ffc-ac98-e0eb09714b0a","type":"sha256","category":"Payload delivery","to_ids":true,"value":"52518d441fd6dd25fa5126683a330592d3be80d5ce3fb9e0b1becb806ff4f857","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"01bcb643-d393-4a2c-b203-78733a0be4ae","type":"sha256","category":"Payload delivery","to_ids":true,"value":"5fac89e66d70cadec5c0e30c0b0cf8bf38c145cbf06422d40d076985195e1dd6","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"74a6080c-feac-4760-9265-63185e165d30","type":"sha256","category":"Payload delivery","to_ids":true,"value":"284622577cf6a7c58704de60194205f765fcef432934c200b462ef0290aa5f57","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ce5c882c-c5cb-4e6b-bc09-f938b439f854","type":"sha256","category":"Payload delivery","to_ids":true,"value":"e401ae1e6d2442fa9a0c79dc0f3b0457ecfebf74a9c0a920159c49437f663aef","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a7875a8f-3546-40cc-8501-c42b1fc6acd5","type":"sha256","category":"Payload delivery","to_ids":true,"value":"451ce0c4deb620894d07a2f4a37c8ea3b7a4f9b6d111651b4ac3bcc737b0fac0","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0bd08d0b-b5d1-460b-8f58-37b98ed53e12","type":"sha256","category":"Payload delivery","to_ids":true,"value":"9a833d68a49ec6d44bc50fb9ff3b184bafb0edc913e1293daebe51d334676a70","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ad7b9932-af3d-4fb8-a1f4-0a5a837fa4af","type":"sha256","category":"Payload delivery","to_ids":true,"value":"f7a9bbfec8add36c548add4d875848b8b57c21fabe236d115f1c49113d12b332","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"119112d0-8574-4ad1-823b-dd1d08cb036a","type":"sha256","category":"Payload delivery","to_ids":true,"value":"c5df9d1bc6275711b2884a9ed4aacfe4e10dbe3c8f6c79df59126fd0e6dcd83f","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"49a27118-82e4-436c-8372-9b278897207f","type":"sha256","category":"Payload delivery","to_ids":true,"value":"8f0c7b92b251c61cbca2add06c676dd21fde8fbb2d0cd6616383fae29b21756a","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1c46f1ea-b6a8-4e35-bcd0-e440446b468f","type":"sha256","category":"Payload delivery","to_ids":true,"value":"385d498d18a3a7c67878ca7322716f9da25683eb1a4bf9e9592da0d5f2ab09f6","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"86ea2744-c971-4260-a4a5-9c4f2ae60fde","type":"sha256","category":"Payload delivery","to_ids":true,"value":"a5696321a6c93071f46c8bb8cbd0a8d2bce6d1860cc3c109247a4e8b64ebd317","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3d5e19bb-03e5-4a17-8fd9-12a239599a76","type":"sha256","category":"Payload delivery","to_ids":true,"value":"0ca60dd18178d1c79d59cc06be12c540c121a4aea467484244667131aa13c311","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e122a40d-48bc-422b-82ec-b2fe12f0d453","type":"sha256","category":"Payload delivery","to_ids":true,"value":"ba04ba6a0c028cde17599c8ddaefdb854055c5a23c595e06630732002ea59a76","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a4385b3c-0159-48d2-a98b-3e19f80da3c1","type":"sha256","category":"Payload delivery","to_ids":true,"value":"55047c55a5ceab6d80b13884b4a4e8cd27a0bab7a218a952a00aae9e05f16f80","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3761ee89-3f40-464f-af56-874a0092f767","type":"sha256","category":"Payload delivery","to_ids":true,"value":"cff74e3e9ac0cda2078d31800d8fcad832d7b52c9920b085054d1e96dacff8a3","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"fabc4a90-141b-49cc-adcf-f79b8d7b6460","type":"sha256","category":"Payload delivery","to_ids":true,"value":"c5b16c42dbd2a1494141cd651a406ec9094d5031a421c0aa624c4d139ae81239","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5471533a-33a0-416f-beb6-fd81720c52cb","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nIntegratedTime:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e5b55218-869f-4545-a86a-297821d645f9","type":"domain","category":"Network activity","to_ids":true,"value":"critical.image","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5c68b191-c7a4-481d-9801-b6c57d412f47","type":"domain","category":"Network activity","to_ids":true,"value":"ghcr.io","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"41340274-01c3-446a-a798-90ebf88dfc23","type":"domain","category":"Network activity","to_ids":true,"value":"nghcr.io","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"cd49e297-aa17-4e9b-b964-221c5878f331","type":"domain","category":"Network activity","to_ids":true,"value":"verificationMaterial.tlogEntries","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"871e48b4-00af-4bc0-b000-2f92f4cb0f43","type":"domain","category":"Network activity","to_ids":true,"value":"Linux-64bit.tar.gz.sigstore.json","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"65335d4c-e243-4407-bc43-91974dccc232","type":"url","category":"Network activity","to_ids":true,"value":"https://token.actions.githubusercontent.com","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"39035fe3-8305-4e11-9d97-05ff09b7b481","type":"url","category":"Network activity","to_ids":true,"value":"https://github\\\\.com/aquasecurity/","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"39a4943c-1706-4d3a-9a94-6f8590ba98b0","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_Linux-64bit.tar\\n\\n#","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"179553d1-b447-4b4b-b226-5d0e60928505","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_Linux-64bit.tar\\n\\ncurl","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c4ad056f-a9ad-40a9-85bb-97b747775979","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\n#","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b1a1bde4-292a-41dd-b93c-289fcb9f6d6f","type":"url","category":"Network activity","to_ids":true,"value":"https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions\\n\\nHow","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4ae14500-3a56-4633-8c00-534046a8cd15","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nersions\\n\\ntrivy-action\\n\\nsetup-trivy\\n\\nRegarding","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"eb24954e-b0eb-4035-a619-369854134b65","type":"domain","category":"Network activity","to_ids":true,"value":"Runner.Worker","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"8e37fb06-19ce-4ef6-aa68-7064c44426fa","type":"domain","category":"Network activity","to_ids":true,"value":"get.trivy.dev","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b15eb874-8323-47fb-b3b2-7dd811ac9995","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nwindow","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"bb56ac46-4ac2-4ff5-b5c7-361bfaf13544","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\n2","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"fc72e1f1-0548-48cf-9a98-5d4861c10944","type":"url","category":"Network activity","to_ids":true,"value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nTrivy","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2da61ad8-b00f-4ee1-b611-ee97e6dd4507","type":"sha1","category":"Payload delivery","to_ids":true,"value":"2206672f013450aa8ad49eefee84da5af92140be","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3a6ae9d5-8541-459e-903d-025204bacc21","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/8ae6452064e6535526083d08be54c419543266c8.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"54d16085-fb63-4dbb-b0e4-5aa910b0b161","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/8ae6452064e6535526083d08be54c419543266c8.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2e6be292-b514-467a-94e9-03f511131327","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/8ae6452064e6535526083d08be54c419543266c8.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"dcf1cb47-5032-4e30-ab0a-f3c5ef59f9b6","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1eeb8c92-868d-4616-9db5-7ef4503e2696","type":"url","category":"Network activity","to_ids":true,"value":"https://www.silentpush.com/blog/scattered-spider-2025/\\n\\nSource:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"17e1073e-f6f0-48d4-bb78-226b3e2a1d99","type":"url","category":"Network activity","to_ids":true,"value":"https://www.browserstack.com/integrations\\n\\n[18]\u00a0P","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"50a4b545-95f2-42c0-8144-9709d1a9b73e","type":"url","category":"Network activity","to_ids":true,"value":"https://www.virustotal.com/gui/file/0383c0d109b7cfdef058b0197125c85d276510724be33a746056f9a7c181d761/\\n\\n[17]\u00a0\u201cBrowserstack","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6876f6d6-d38c-43b6-8114-78d478264375","type":"url","category":"Network activity","to_ids":true,"value":"https://reliaquest.com/blog/threat-spotlight-shinyhunters-data-breach-targets-salesforce-amid-scattered-\\n\\nspider-collaboration/\\n\\n[16]\u00a0\u201cVirusTotal","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e3f62c12-40b2-4cd6-9d01-9b84b173b6ec","type":"url","category":"Network activity","to_ids":true,"value":"https://www.bloomberg.com/news/articles/2025-07-04/louis-vuitton-korea-\\n\\nsuffers-cyberattack-as-customer-data-leaked\\n\\n[15]","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"44d4194c-96c8-411d-974f-63786d9dba52","type":"domain","category":"Network activity","to_ids":true,"value":"Bloomberg.com","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"94574374-5064-4f96-b027-edc9a4fea68b","type":"url","category":"Network activity","to_ids":true,"value":"https://www.okta.com/integrations/\\n\\n[14]\u00a0J","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d944933d-cb46-4491-b4e5-0e4c07de3422","type":"url","category":"Network activity","to_ids":true,"value":"https://help.salesforce.com/s/articleView?language=en_US\\u0026id=service.voice_agents_make_calls.htm\\u0026type=5\\n\\n[13]\u00a0\u201cOkta","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"af20c8ad-cc87-4612-ad24-9b83ca781269","type":"url","category":"Network activity","to_ids":true,"value":"https://www.malwarebytes.com/blog/news/2025/08/how-google-adidas-and-more-were-breached-\\n\\nin-a-salesforce-scam\\n\\n[12]\u00a0\u201cSalesforce","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c84d3fa8-3b6c-4ba0-a15b-7fcebbaf1048","type":"url","category":"Network activity","to_ids":true,"value":"https://x.com/vxunderground/status/1850975928421167171\\n\\n[11]\u00a0D","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"15b556ba-ec9b-4be1-8eae-cd472ca87512","type":"url","category":"Network activity","to_ids":true,"value":"https://docs.bland.ai/tutorials/pathways\\n\\n[10]","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"030075f9-7ffe-4344-a672-51cf0d27f542","type":"url","category":"Network activity","to_ids":true,"value":"https://www.bland.ai\\n\\n[9]\u00a0\u201cConversational","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"adf5e815-0303-4614-b401-b26984ec3339","type":"url","category":"Network activity","to_ids":true,"value":"https://vapi.ai\\n\\n[8]\u00a0\u201cBland","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"15330eec-7a55-471a-b06d-af94a6a8f685","type":"url","category":"Network activity","to_ids":true,"value":"https://t.me/angelraasreborn\\n\\n[7]\u00a0\u201cVapi","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"19127c58-1d6b-41cc-a4a0-3178faf80927","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion\\n\\n[6]\u00a0\u201cTelegram:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"fa81f7b6-6a8f-4097-b61f-f297b2f94527","type":"url","category":"Network activity","to_ids":true,"value":"https://www.cisa.gov/resources-tools/resources/review-attacks-associated-lapsus-and-related-threat-\\n\\ngroups-report\\n\\n[5]","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"776e85de-7d48-481f-99d6-85d20c667675","type":"url","category":"Network activity","to_ids":true,"value":"https://www.ic3.gov/PSA/2025/PSA250723\\n\\n[4]","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"7a60348d-c5dc-4a39-b51a-2251de605659","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nrecommendations\\n\\n[3]","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"765a2c57-bd0d-4da1-83c2-28701c1e53eb","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"015ec3f9-64b8-4267-9290-4a6a0e487eb9","type":"url","category":"Network activity","to_ids":true,"value":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-\\n\\nextortion/\\n\\n[2]\u00a0\u201cDefending","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"15823571-5978-46c3-8765-b3a1619f23e6","type":"btc","category":"Financial fraud","to_ids":true,"value":"bc1q5530apqz86eywm2f84mpcyuux3dv9mmztsdxt2","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e2d21d2b-1a3a-4a84-bf33-a53ff01bfd36","type":"sha256","category":"Payload delivery","to_ids":true,"value":"4e20f2c4c90e3654a8c43fb10003978d61d2b48426414dede3b1bd5a2c891b54","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"67d9e9f0-e8e3-4ff1-b773-d583e25be432","type":"sha256","category":"Payload delivery","to_ids":true,"value":"6aa51de51a6b352fd073b5b9080011d358d42fa190a8a9ee216e3ef6e657b801","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a8fe57fe-0b45-4c52-8e7f-d7cd86d00825","type":"sha256","category":"Payload delivery","to_ids":true,"value":"36de93aaf26727f6dd55ff2100b08dfb52abccfb57a7bf4d07a7fb703a86623d","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"621126a4-331d-4c38-bcb8-804c896c8720","type":"sha256","category":"Payload delivery","to_ids":true,"value":"e5c5617c8676e9a5cf6108d344fe7fcb6590671efd6baccb02b9313da0f0d289","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ab217302-4d60-4bab-883b-9fee84a9d6ce","type":"sha256","category":"Payload delivery","to_ids":true,"value":"0383c0d109b7cfdef058b0197125c85d276510724be33a746056f9a7c181d761","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9174e9f1-9990-442a-a684-0eb795776c0c","type":"domain","category":"Network activity","to_ids":true,"value":"nbmcorpuser.internal","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"768a672c-4b4f-4ae5-bf94-98e95314c9cd","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\n23[.]94[.]126[.]63\\n\\n198[.]244[.]224[.]200\\n\\nadmiring-shockley[.]196-251-83-162[.]plesk[.]page\\n\\nbless-invite[.]com\\n\\nget-carrot-zoom[.]com\\n\\nmodernatx-zoom[.]com\\n\\nrecurly-zoom[.]com\\n\\nEvilginx","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"038bbbac-8e2f-4f1a-87a9-3aef9d53ebc6","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nNew","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2d27e8c6-7974-49bb-8e00-7b3bf20f8bd2","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\naffiliates","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f3250a4f-5ca6-4671-9d75-4e7feda34ec3","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nmanufacturing","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"44007155-1959-444f-9f1a-81bfeef3e121","type":"ip-dst","category":"Network activity","to_ids":true,"value":"12.2.0.1","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2ae187fc-a462-4c01-9b67-06233d3bf746","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\ntesting","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"883172f6-ff5a-4db9-aada-bf5611dcd78c","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nFigure\\n\\n15","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1ac1a61e-98ff-4eee-a7aa-0c5ec432b5ec","type":"domain","category":"Network activity","to_ids":true,"value":"fbi.gov","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b8d8012a-fe32-4568-b51b-46466a4e1810","type":"domain","category":"Network activity","to_ids":true,"value":"trial-6857053.okta","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2869955f-bc79-4a7d-89ab-2335342dcfba","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nEclecticIQ","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"df349e71-339a-4ef8-be0a-e013dcba9116","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nThese","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f4f2afb7-d293-47c3-aaad-d8128d6c3d62","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nThreat","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4669a75d-9953-4293-ae28-1fba8e59bdd2","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nFigure","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"51c047a8-988d-4ef5-a79d-e4f8ac4c6699","type":"url","category":"Network activity","to_ids":true,"value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nShinyHunters","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a9ad41d9-e5c4-47cc-abd7-ac6b3f22c78d","type":"sha1","category":"Payload delivery","to_ids":true,"value":"8ae6452064e6535526083d08be54c419543266c8","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1edd7bcc-df47-421b-985d-f869dec97086","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/6cb5b2ac04703bb961759123855335e084420534.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9adbac7d-143a-448f-b755-0fbf8a02e053","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/6cb5b2ac04703bb961759123855335e084420534.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"75219935-d315-4a7d-8d88-8de69ddfa711","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/6cb5b2ac04703bb961759123855335e084420534.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"81a84efe-4219-400f-8831-caff751f1551","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"abc35a1d-8b28-497f-a32e-22dcbbffbcd6","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c6b92717-c6f3-47ca-9450-3cb0bfa358c7","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nSource:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5aeacde7-45bf-4c90-8e8d-5c8195609f06","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nDuring","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"719382ef-98fd-4cee-83ed-157f406e8abb","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nNow","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9087c685-ceb3-41e8-ac7f-cc253fc1a9b2","type":"domain","category":"Network activity","to_ids":true,"value":"DC.FQDN","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f441c6c6-1091-46d1-b89f-d5c176a5b553","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nlsadump::dcsync","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"500d4c38-f399-4b80-9fcd-f841ed433948","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nWe","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5574e12e-0acc-4d34-a1b6-723f9c1401b7","type":"md5","category":"Payload delivery","to_ids":true,"value":"8b7c904343e530c4f81c53e8f614caf7","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b07b70ee-5561-4dc7-8edb-a6b1840ad8ab","type":"domain","category":"Network activity","to_ids":true,"value":"System.Security","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"50d14816-da06-4695-98d4-89371534f836","type":"domain","category":"Network activity","to_ids":true,"value":"System.Security.Principal.NTAccount","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1f458b21-5fec-4f7d-ab79-2b6ffda60598","type":"domain","category":"Network activity","to_ids":true,"value":"RootDomain.Name","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"8c1be5fb-3aa5-44b0-9d27-b03cbfdc2f28","type":"domain","category":"Network activity","to_ids":true,"value":"System.DirectoryServices.ActiveDirectory.Forest","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"7878ed6a-4847-4bb3-9246-9d5be6bee729","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nthe","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"17e68382-b951-4092-a970-a70175bc4817","type":"domain","category":"Network activity","to_ids":true,"value":"testlab.local","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"536cc745-1d08-4d40-9090-7834015a0615","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nOne","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d0d4f963-5b97-487b-8416-9b88b75b2583","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nHere\u2019s","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"13aed2af-6fd8-4402-baf2-4dd798e8c8f7","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nThis","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e3c80098-7d7b-407a-919d-eb543d9ea24e","type":"domain","category":"Network activity","to_ids":true,"value":"nNTDS.dit","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"52f0380d-e1d2-4fbc-8c4b-9b2832d1fbda","type":"domain","category":"Network activity","to_ids":true,"value":"SECONDARY.dev.testlab.local","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2dc8d574-ea22-4d44-8523-afa624a6995a","type":"domain","category":"Network activity","to_ids":true,"value":"dev.testlab.local","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5bcf1722-21f3-46c3-8040-e4f5102d3c90","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nYou\u00a0land","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"bd4829a0-5a3b-46f6-9e91-f50fe091ebb9","type":"domain","category":"Network activity","to_ids":true,"value":"Invoke-Mimikatz.ps","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"7989d918-9365-4b6f-8c66-8299c932ca61","type":"domain","category":"Network activity","to_ids":true,"value":"powerkatz.dlls","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"825d636b-7416-400e-a760-e97f98510af1","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nMimikatz","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"dc00be47-20c4-479e-b932-dcc8b0caddbf","type":"sha1","category":"Payload delivery","to_ids":true,"value":"6cb5b2ac04703bb961759123855335e084420534","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f7c78c1d-32c2-4a79-af77-6747923ee1ab","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/7d465ed5e6c3507494f1e55ce072801d3f0986c2.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"13d21b09-1a52-409f-9627-0562257bf5ce","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/7d465ed5e6c3507494f1e55ce072801d3f0986c2.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"33a6aa95-15b6-4b5e-8228-a2a71e931ce0","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/7d465ed5e6c3507494f1e55ce072801d3f0986c2.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4e05cc92-2359-41e3-b87b-634856da99ac","type":"domain","category":"Network activity","to_ids":true,"value":"Agent.DNE","timestamp":"1786041934","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"cd7da33e-cee1-4c76-bb10-e387c6f1eb5a","type":"domain","category":"Network activity","to_ids":true,"value":"kl.ps","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"804956a7-8da1-4d06-b96b-422f6a0b7383","type":"domain","category":"Network activity","to_ids":true,"value":"Get-LAPSP.ps","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e99203e4-26c5-4c60-9df7-f762a9317651","type":"domain","category":"Network activity","to_ids":true,"value":"Decrypt-RDCMan.ps","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6b98c3a4-e18b-4d92-8474-1d48e7642254","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"45b79de5-42ec-467f-b44b-0d19cc322da5","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-s\\nector-in-the-middle-east/\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a83eb49c-69b4-4f0a-a5cc-3968330254de","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nBuild","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e1eb36b0-2a5f-42af-a23e-0cbda9e57687","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nVarious","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6acfc334-1263-4599-be05-4704b39491a9","type":"domain","category":"Network activity","to_ids":true,"value":"extension.aspx","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"04ff53ad-bd6c-431a-be51-b3f26d09903e","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nThe","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"016bfee9-f821-48b5-927a-b8488efbdcd5","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nto","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2e34513b-0326-4999-a257-4a876fbd0988","type":"url","category":"Network activity","to_ids":true,"value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nNew","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9e624b06-096c-4231-9dc8-734e98004054","type":"sha1","category":"Payload delivery","to_ids":true,"value":"7d465ed5e6c3507494f1e55ce072801d3f0986c2","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"03fa6020-bf1a-416f-9dfb-09166937421c","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/b2386bef6e70b932af44e6bb3f3d3f1cc3cc69ec.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c8df648e-ad15-4740-b3ff-1d06cfa165d9","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/b2386bef6e70b932af44e6bb3f3d3f1cc3cc69ec.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"694a2cd0-50af-4123-adc5-8dbc7603cef0","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/b2386bef6e70b932af44e6bb3f3d3f1cc3cc69ec.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2bab0606-59c6-4630-8e07-dd25ec3055a1","type":"domain","category":"Network activity","to_ids":true,"value":"Trojan.Heur.PT","timestamp":"1786041934","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c11176c1-5c90-4dea-9133-bc51aac59979","type":"domain","category":"Network activity","to_ids":true,"value":"Agent.dhwf","timestamp":"1786041934","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"542011bc-1390-4c43-990d-e0346eda8cd2","type":"domain","category":"Network activity","to_ids":true,"value":"TEMP.Hippo","timestamp":"1786041933","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f873f4ac-f558-46f4-88d7-47bd4211f2a3","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nhttps://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nT1588.007:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"acbdd3f0-d328-4122-875a-f4aca3fe4c7b","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nT1592.001:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e8dd5984-6ae6-4edd-9397-a970100564f1","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nAML.T0040:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"08953e20-4c09-416e-8d50-8a3c433608fa","type":"domain","category":"Network activity","to_ids":true,"value":"ngenerativelanguage.googleapis.com","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0417a8f2-d1b3-4516-868a-c238b1aa9eb2","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nTactic","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3d73a5a2-8ff0-4a1a-a4e6-1a253807d275","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nmade","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ea488816-dbeb-4b8a-a9db-9880745290aa","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nBuilding","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2f22036f-c5a0-460d-b137-1f56e99b5038","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nThroughout","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ccbc75cb-2fad-4cda-842e-75a34363970a","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nTable","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5faa588e-20ff-4d63-95ae-2193ff7d3b3a","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nAPI","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"faf9cd59-9be1-424c-9266-0a74eb2f9d0c","type":"domain","category":"Network activity","to_ids":true,"value":"nTEMP.Hex","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4a8928e7-70a8-4de1-9c5a-a1bdbfdcde67","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nAs","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"79f73d42-5d2f-4e88-a594-4cabedbd974f","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nGTIG","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"cd33640d-bf6f-4d3e-8dda-1757c57425d9","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nmodel","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5f691f33-4044-4d51-b64f-9283c6e8420a","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\n\\","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"15928d20-ce40-4be3-8bde-5c6e517a075d","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nIn","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6cff22c7-a62f-46b5-895c-0a15a0dfd974","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nFigure","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"86dc53c8-74e9-4a8e-a45d-0554748bd9f9","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nTo","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"78f49770-5989-4969-8a29-3bd53739c09e","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nThreat","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1f468b13-d6d9-48f8-b46c-48b17d777565","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nSupply","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"332d5454-b3e1-48b8-b441-9f6f2beb5358","type":"url","category":"Network activity","to_ids":true,"value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nAdversaries","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"19e8183e-c046-4fe6-97ea-3f5f1ae3a5f9","type":"sha1","category":"Payload delivery","to_ids":true,"value":"b2386bef6e70b932af44e6bb3f3d3f1cc3cc69ec","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"f197e243-56f0-4ce2-887f-8ba790044465","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/a02b28e3ffab42076e427d0a633318e4cb6c8d4f.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"50c8c254-26e8-40ca-944d-9339f002f316","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/a02b28e3ffab42076e427d0a633318e4cb6c8d4f.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"923f1bb0-d999-49ff-b54c-dc992c358a3a","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/a02b28e3ffab42076e427d0a633318e4cb6c8d4f.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"66c2ac05-4e37-492d-a7ef-d92851bbdb6e","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"81f89534-8af4-459f-b328-90e63bc2544d","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nLegal","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6f2386b7-fe2d-4dcc-b7df-143035792bff","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nAWS-style","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"220e8b94-2c14-4ad4-b8a8-f4a0ad0dc873","type":"domain","category":"Network activity","to_ids":true,"value":"ok.ru","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1e4ea036-79ce-46b4-aed1-bfaeeedc30c7","type":"domain","category":"Network activity","to_ids":true,"value":"yadi.sk","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0024ff2a-4f5d-4539-ab86-a9b7b1f25604","type":"domain","category":"Network activity","to_ids":true,"value":"nMail.ru","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2dd21e80-1cbc-4af4-bb87-ed92ca9b0355","type":"domain","category":"Network activity","to_ids":true,"value":"document.open","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"69e3f06e-34ce-4fe9-9508-46b6f5de1df8","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nAll","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"8a787e45-f58e-47b3-acfd-552a8de00caa","type":"md5","category":"Payload delivery","to_ids":true,"value":"febb622cd9eeb5c8860dcef4cbfd4b74","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a9ec9866-bc18-4395-b4c7-05380a0a0409","type":"domain","category":"Network activity","to_ids":true,"value":"window.TELEGRAM","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9f1692a6-6c25-411e-8f5b-0b3fa33a058b","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\n1","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"feac20f4-edaa-4ac9-84b7-63265da8ec99","type":"sha1","category":"Payload delivery","to_ids":true,"value":"6894a51278ec89118276c2dd2dc36e6f9ea2790a","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"9efb9a97-2a8f-4a2a-8d35-9e11bd64e4f6","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nlogin.microsoftonline.com/common/oauth2/deviceauth","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ff157d29-28bb-476d-a204-2a596c04abad","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nFigure","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"31c81261-cd03-4260-b992-77a10f2dc8ca","type":"domain","category":"Network activity","to_ids":true,"value":"Microsoft.com","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"82acceae-956b-4ef8-9300-edc9ecd2ee7c","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nKali365","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5716630a-9140-43ef-81df-f6e60fa12242","type":"url","category":"Network activity","to_ids":true,"value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nFrom","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0496104f-1db0-4a2a-96dc-f15cb648e551","type":"sha1","category":"Payload delivery","to_ids":true,"value":"a02b28e3ffab42076e427d0a633318e4cb6c8d4f","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"06f90a6f-c4a8-4b8a-8005-92f7d8ecdc91","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/8d41a8e2a1c3d323e9372fe6c6503e7e23d1a978.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6a2a8f98-649f-40cf-b4db-ebd1454ec12e","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/8d41a8e2a1c3d323e9372fe6c6503e7e23d1a978.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"a12cf7c8-b63d-4c2b-be62-013412e58f35","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/8d41a8e2a1c3d323e9372fe6c6503e7e23d1a978.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c742e59d-c62e-41fe-8f21-e6fdb86bb528","type":"url","category":"Network activity","to_ids":true,"value":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"033bbeb7-ab78-4519-8dc4-e3919d2f076f","type":"url","category":"Network activity","to_ids":true,"value":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack\\n\\nExfiltration","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"59ccbf2e-400d-42fb-b326-4fb5efbf8ff9","type":"url","category":"Network activity","to_ids":true,"value":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack\\n\\nbeing","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"cb5bd3f2-71b1-473d-83f1-22f554fa6f99","type":"url","category":"Network activity","to_ids":true,"value":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack\\n\\nHere\u2019s","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"41c7f51e-9ebb-4ea0-810f-df1b4fd054f5","type":"sha1","category":"Payload delivery","to_ids":true,"value":"8d41a8e2a1c3d323e9372fe6c6503e7e23d1a978","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"2326df5d-c0ab-426d-a0c4-36630432827f","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/151bf563f232f0cd8cfd95826f9c34b04f067848.jpg","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0a3ba246-6e13-46da-be92-33168e9a547c","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/151bf563f232f0cd8cfd95826f9c34b04f067848.txt","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"724bedab-1757-4061-ac16-fbaec0ed38da","type":"url","category":"Network activity","to_ids":true,"value":"https://archive.orkl.eu/151bf563f232f0cd8cfd95826f9c34b04f067848.pdf","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e63c0fa3-7c60-4ca7-aa92-4cce9fbfcbee","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nPage","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"abf7aed1-0f92-4349-ba10-e2ea1d7e27b3","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nHost\\n\\n/var/lib/svc_internal/runner.py\\n\\n/etc/systemd/system/internal-monitor.service\\n\\n/tmp/pglog\\n\\n/tmp/.pg_state\\n\\n/var/lib/pgmon/pgmon.py\\n\\n/etc/systemd/system/pgmonitor.service\\n\\nSystemd","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"373efbf0-9368-4c5b-8f0a-a94f853bd36e","type":"url","category":"Network activity","to_ids":true,"value":"https://championships-peoples-point-cassette.trycloudflare[.]com","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"8a86a35b-9096-4ecc-898a-cdeed9537966","type":"url","category":"Network activity","to_ids":true,"value":"https://investigation-launches-hearings-copying.trycloudflare[.]com/","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"4a2f35d1-7f18-4bbd-98c0-31bdc9b270a1","type":"url","category":"Network activity","to_ids":true,"value":"https://souls-entire-defined-routes.trycloudflare[.]com/","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"3128daa3-c956-4295-bd09-ea310d98377f","type":"domain","category":"Network activity","to_ids":true,"value":"json.dumps","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ea0b6b76-f617-4df5-8140-531f5dd2587c","type":"domain","category":"Network activity","to_ids":true,"value":"nconn.request","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"76635549-0f2e-4d93-ae1a-7279558de651","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\ncmd","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1f20593c-376b-4173-8f21-ce13191e314c","type":"domain","category":"Network activity","to_ids":true,"value":"keys.append","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"57eca909-f2bb-4cbc-9045-3905008326ad","type":"domain","category":"Network activity","to_ids":true,"value":"os.path.join","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c1f7456a-8923-42d4-b411-9e00fbca6c33","type":"domain","category":"Network activity","to_ids":true,"value":"os.path.expanduser","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"7c603e30-062f-4edc-b29a-84c9a717cdf8","type":"domain","category":"Network activity","to_ids":true,"value":"match.groups","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"1f582e91-a11b-430b-a849-6b509e201cbd","type":"domain","category":"Network activity","to_ids":true,"value":"re.search","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"5c7bc8cc-a386-496e-8034-5ee0b0a5b143","type":"url","category":"Network activity","to_ids":true,"value":"https://championships-peoples-point-\\n\\ncassette.trycloudflare[.]com/prop.py","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"87c18381-967e-4f8d-af62-870c08880784","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nOutbound","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"27822861-8fb9-4db9-a119-94a579509787","type":"domain","category":"Network activity","to_ids":true,"value":"os.system","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"282adb53-e541-4cbc-b472-23b2f1ec4b8f","type":"domain","category":"Network activity","to_ids":true,"value":"os.getuid","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c271df91-daec-4680-b3b6-ee5a55efac49","type":"domain","category":"Network activity","to_ids":true,"value":"subprocess.run","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"28d3a121-5422-4bce-9cd8-ee7cd6ea7702","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\npath:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"42c6fd3a-239a-4906-a2b1-dcf6cc3c7fdd","type":"domain","category":"Network activity","to_ids":true,"value":"multi-user.target","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e6369d9d-a337-4ac4-ae5f-ceaee635dd60","type":"domain","category":"Network activity","to_ids":true,"value":"network.target","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6646fbce-2840-4c4d-bcc7-9b6cfc4c9b37","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nname:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6d0aba5e-ccf3-4f00-8ba2-44c82a6ca709","type":"domain","category":"Network activity","to_ids":true,"value":"yaml.encode","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"e050e9b4-e9b1-45bb-8c73-7aedcaef1635","type":"domain","category":"Network activity","to_ids":true,"value":"nsubprocess.run","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b68e7eb3-8038-4ee4-a552-25f793a46e84","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nmetadata:\\n\\nlabels:\\n\\nname:","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"92cf9b3d-ff4e-4da7-bacb-2ec1da557976","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nrm","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"c52dd573-9841-4cc8-8594-ebe185b48f73","type":"domain","category":"Network activity","to_ids":true,"value":"os.environ.get","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b4bc023d-65bb-41ca-855a-8c2de0dbb3b1","type":"domain","category":"Network activity","to_ids":true,"value":"subprocess.DEVNULL","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"6cafa6d3-6265-47d2-9583-e8ce77488393","type":"domain","category":"Network activity","to_ids":true,"value":"subprocess.check","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"d7230fed-deea-42c7-b69d-29da9c416bc4","type":"domain","category":"Network activity","to_ids":true,"value":"f.read","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"8623dd3d-2e65-47ec-971b-acfc8a3a14b1","type":"domain","category":"Network activity","to_ids":true,"value":"os.environ","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"8e86c62d-fe83-40f5-9104-37716f3abec7","type":"domain","category":"Network activity","to_ids":true,"value":"os.path.exists","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0dfe1a18-0aa0-4c5d-89a2-3eedf52f368f","type":"domain","category":"Network activity","to_ids":true,"value":"nsys.exit","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"825b01a2-029c-4fb6-8cd8-e6354a80a6df","type":"url","category":"Network activity","to_ids":true,"value":"https://souls-entire-defined-routes.trycloudflare[.]com/kube.py\\","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ee36c9b9-d6e2-4120-9662-378c1c6cca63","type":"url","category":"Network activity","to_ids":true,"value":"https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/k\\n\\nchmod","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"b287df5d-ce76-45c5-bb8a-f82aeba3b244","type":"url","category":"Network activity","to_ids":true,"value":"https://dl.k8s.io/release/$(curl","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ea11535e-2426-4a40-bc15-011dc898b39f","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nif","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"0561df45-da1f-4244-805b-24e969d826d7","type":"url","category":"Network activity","to_ids":true,"value":"https://souls-entire-defined-\\n\\n","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"38d90869-476b-4bfe-bb7c-75051e678901","type":"domain","category":"Network activity","to_ids":true,"value":"trycloudflare.com","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"84b9f96a-6301-4f20-b8bf-989f2abce8f2","type":"url","category":"Network activity","to_ids":true,"value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nCanisterWorm","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]},{"uuid":"ef9bee63-97b4-44dc-9299-ad2e6516b5c4","type":"sha1","category":"Payload delivery","to_ids":true,"value":"151bf563f232f0cd8cfd95826f9c34b04f067848","timestamp":"1786036356","comment":"Category: Threat Reports; confidence: 50%","Tag":[{"colour":"#ffffff","name":"tlp:white","exportable":true}]}]}}