{"generator":"Threat Intelligence Platform MISP Feed Publisher","tlp":"tlp:white","generated":"2026-08-07T00:03:59+00:00","indicators":[{"ioc_value":"https://archive.orkl.eu/cfdf7d895d9ebe4e3f80a8c722f8fa076a9d5915.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/cfdf7d895d9ebe4e3f80a8c722f8fa076a9d5915.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/cfdf7d895d9ebe4e3f80a8c722f8fa076a9d5915.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.ic3.gov/PSA/2026/PSA260515\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nwww.fbi.gov","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"www.fbi.gov","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nwww.ic3.gov","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.ic3.gov/PSA/2026/PSA260515\\n\\nVictim","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.ic3.gov/PSA/2026/PSA260515\\n\\nInternet","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"cfdf7d895d9ebe4e3f80a8c722f8fa076a9d5915","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/3a3be7db51b80f49b5c80715c787ee9eab89dead.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/3a3be7db51b80f49b5c80715c787ee9eab89dead.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/3a3be7db51b80f49b5c80715c787ee9eab89dead.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nSource:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nAnthropic","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n4.7/5\\n\\nTired","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"5e2ba7c4c53fa6e0cef58011acdd50682cf83fb7b989712d2fcf1b5173bad956","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"7df6cef7ab9aae2ea08f2f872f6456b5d51d896ddda907a238cd6668ccdc4bb7","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"f398f06eefcd3558c38820a397e3193856e4e6e7c67f81ecc8e533275284b152","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"c37c0ae9641d2e5329fcdee847a756bf1140fdb7f0b7c78a40fdc39055e7d926","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"0c0d206d5e68c0cf64d57ffa8bc5b1dad54f2dda52f24e96e02e237498cb9c3a","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"61ff00a81b19624adaad425b9129ba2f312f4ab76fb5ddc2c628a5037d31a4ba","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"e9b1e069efc778c1e77fb3f5fcc3bd3580bbc810604cbf4347897ddb4b8c163b","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nIndicators","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n}","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"tokens.join","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"process.execPath","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"registry.npmjs.org","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"tokens.add","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"val.split","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"k.includes","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Object.keys","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ntokens.add","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"line.match","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"content.split","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"process.cwd","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"npath.join","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"overall.failed.join","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"overall.failed.length","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"overall.success.join","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"overall.success.length","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"noverall.failed.push","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"noverall.success.push","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"pkg.version","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nconsole.log(`\ud83d\udd11","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nprocess.exit","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"tokens.length","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"n.filter","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"t.trim","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"n.map","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"n.split","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"process.env.NPM","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nfs.unlinkSync","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nresults.failed.push","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nresults.success.push","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"process.env","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n//","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"fs.existsSync","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"path.resolve","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ownedPackages.join","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ownedPackages.length","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nconsole.log(`\\\\n\ud83d\udd0d","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"whoami.username","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"err.message","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nconsole.error","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://registry.npmjs.org/-/whoami","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"result.total","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"packages.length","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"o.package.name","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"result.objects.map","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"packages.concat","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"result.objects.length","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"result.objects","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://registry.npmjs.org/-/v1/search?text=maintainer:${encodeURIComponent(\\n\\nusername\\n\\n)}\\u0026size=${size}\\u0026from=${from}`;\\n\\nconst","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n*/\\n\\nasync","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"parts.join","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"parts.some","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"parts.length","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"version.split","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"meta.readme","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://registry.npmjs.org/${encodeURIComponent(packageName)}`","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"n.on","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nres.on","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nlet","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"n.get","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n#!/usr/bin/env","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"npackage.json","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"time.sleep","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nif","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ntime.sleep","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nf.write","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nsubprocess.Popen","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nos.chmod","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nurllib.request.urlretrieve","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"link.startswith","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"r.read","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"urllib.request.urlopen","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"urllib.request.Request","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io/\\","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"urllib.request","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"default.target","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Buffer.from","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nfs.writeFileSync","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nfs.mkdirSync","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nconst","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"os.homedir","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"process.exit","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"package.json","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"path.join","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"fs.readFileSync","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"JSON.parse","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"pgmon.service","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"n.pg","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\n\ud83c\udf10","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"teale.io","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise\\n\\nTeamPCP","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"3a3be7db51b80f49b5c80715c787ee9eab89dead","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/2206672f013450aa8ad49eefee84da5af92140be.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/2206672f013450aa8ad49eefee84da5af92140be.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/2206672f013450aa8ad49eefee84da5af92140be.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/\\n\\n#10425\\n\\nFootnotes\\n\\n1","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nGitHub","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"45.148.10.212","ioc_type":"ip","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nscan.aquasecurtiy.org","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"5e5fb53cf4ce5555171ff5206302ba2f4f66f5381bbf673c354c87a925473f07","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"9efd59534d2b6b81b8b7a0eeb3ad0e74015f358650e24b9dab00c900d3118593","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"4b22cedea58780ff76735c3e08b9ee8cb5d06c908ffa868152f11d45349eb696","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"dd8beb3b40df080b3fd7f9a0f5a1b02f3692f65c68980f46da8328ce8bb788ef","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"425cd3e1a2846ac73944e891250377d2b03653e6f028833e30fc00c1abbc6d33","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"edef8e5816eced552a909b878ff262c0c47776d3297bcc23796ad4cce1e85414","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"4f7a06bb51714713ab308d2f8125f3b09ee1c3ffbba1a5ffd0cc80da95fbb6cc","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"95ff680103570179feb0c6667a9b9b2d98c53fa5a9a451265036810390bbe70a","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"5aaa1d7cfa9ca4649d6ffad165435c519dc836fa6e21b729a2174ad10b057d2b","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"cc464a3961e1dbe145c75343b55c2f446e08b821782ec993728c4222b0d85589","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"43f46547efd488e56dcf862ed4d7cc342730a803f8d5bec5cac443028fefabef","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ae3494bd6ae860d7727116681bd09fc7b20dc994ec7a8105738f0a623ea93427","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"2d7cee41048988eec27615412e7c6e2e21046f2b5faa888c24e11ca6764058ed","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"12c702212dee1cbec9471e9261501a3335963321fe76e60e5a715b5acd3c40a2","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"27f446230c60bbf0b70e008db798bd4f33b7826f9f76f756606f5417100beef3","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859c","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94c","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecf","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nSHA256","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"0376b98064636c30f5fbe60fb3b1225516e23e88dd7e909937f81d9265292e7d","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"1dc871b02cd7a1fd80babb1b8762a2fd9cc2b735d4d3759d012626de3ccc7a5b","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"90d61cf37355b89fae9ff84867100e1721c1876007ef1771e465ce5a721141ad","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"16c855c398a8b185a907790054b70164358844a893bf9965651b88d6967c7c0a","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"107be2081bdc3ddad2889ae037ab2ad6bbd214fb9a43eaa25390d00411d1c7dd","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"62585efcdc7767f3fe0b9ae2897fe03bf331934492fd7a5da46f14fd7bf705c8","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"52518d441fd6dd25fa5126683a330592d3be80d5ce3fb9e0b1becb806ff4f857","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"5fac89e66d70cadec5c0e30c0b0cf8bf38c145cbf06422d40d076985195e1dd6","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"284622577cf6a7c58704de60194205f765fcef432934c200b462ef0290aa5f57","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"e401ae1e6d2442fa9a0c79dc0f3b0457ecfebf74a9c0a920159c49437f663aef","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"451ce0c4deb620894d07a2f4a37c8ea3b7a4f9b6d111651b4ac3bcc737b0fac0","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"9a833d68a49ec6d44bc50fb9ff3b184bafb0edc913e1293daebe51d334676a70","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"f7a9bbfec8add36c548add4d875848b8b57c21fabe236d115f1c49113d12b332","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"c5df9d1bc6275711b2884a9ed4aacfe4e10dbe3c8f6c79df59126fd0e6dcd83f","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"8f0c7b92b251c61cbca2add06c676dd21fde8fbb2d0cd6616383fae29b21756a","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"385d498d18a3a7c67878ca7322716f9da25683eb1a4bf9e9592da0d5f2ab09f6","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"a5696321a6c93071f46c8bb8cbd0a8d2bce6d1860cc3c109247a4e8b64ebd317","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"0ca60dd18178d1c79d59cc06be12c540c121a4aea467484244667131aa13c311","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ba04ba6a0c028cde17599c8ddaefdb854055c5a23c595e06630732002ea59a76","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"55047c55a5ceab6d80b13884b4a4e8cd27a0bab7a218a952a00aae9e05f16f80","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"cff74e3e9ac0cda2078d31800d8fcad832d7b52c9920b085054d1e96dacff8a3","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"c5b16c42dbd2a1494141cd651a406ec9094d5031a421c0aa624c4d139ae81239","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nIntegratedTime:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"critical.image","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ghcr.io","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nghcr.io","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"verificationMaterial.tlogEntries","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Linux-64bit.tar.gz.sigstore.json","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://token.actions.githubusercontent.com","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github\\\\.com/aquasecurity/","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_Linux-64bit.tar\\n\\n#","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_Linux-64bit.tar\\n\\ncurl","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\n#","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions\\n\\nHow","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nersions\\n\\ntrivy-action\\n\\nsetup-trivy\\n\\nRegarding","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Runner.Worker","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"get.trivy.dev","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nwindow","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\n2","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23\\n\\nTrivy","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"2206672f013450aa8ad49eefee84da5af92140be","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/8ae6452064e6535526083d08be54c419543266c8.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/8ae6452064e6535526083d08be54c419543266c8.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/8ae6452064e6535526083d08be54c419543266c8.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.silentpush.com/blog/scattered-spider-2025/\\n\\nSource:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.browserstack.com/integrations\\n\\n[18]\u00a0P","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.virustotal.com/gui/file/0383c0d109b7cfdef058b0197125c85d276510724be33a746056f9a7c181d761/\\n\\n[17]\u00a0\u201cBrowserstack","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://reliaquest.com/blog/threat-spotlight-shinyhunters-data-breach-targets-salesforce-amid-scattered-\\n\\nspider-collaboration/\\n\\n[16]\u00a0\u201cVirusTotal","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.bloomberg.com/news/articles/2025-07-04/louis-vuitton-korea-\\n\\nsuffers-cyberattack-as-customer-data-leaked\\n\\n[15]","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Bloomberg.com","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.okta.com/integrations/\\n\\n[14]\u00a0J","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://help.salesforce.com/s/articleView?language=en_US\\u0026id=service.voice_agents_make_calls.htm\\u0026type=5\\n\\n[13]\u00a0\u201cOkta","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.malwarebytes.com/blog/news/2025/08/how-google-adidas-and-more-were-breached-\\n\\nin-a-salesforce-scam\\n\\n[12]\u00a0\u201cSalesforce","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://x.com/vxunderground/status/1850975928421167171\\n\\n[11]\u00a0D","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://docs.bland.ai/tutorials/pathways\\n\\n[10]","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.bland.ai\\n\\n[9]\u00a0\u201cConversational","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://vapi.ai\\n\\n[8]\u00a0\u201cBland","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://t.me/angelraasreborn\\n\\n[7]\u00a0\u201cVapi","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion\\n\\n[6]\u00a0\u201cTelegram:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.cisa.gov/resources-tools/resources/review-attacks-associated-lapsus-and-related-threat-\\n\\ngroups-report\\n\\n[5]","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.ic3.gov/PSA/2025/PSA250723\\n\\n[4]","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nrecommendations\\n\\n[3]","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-\\n\\nextortion/\\n\\n[2]\u00a0\u201cDefending","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"bc1q5530apqz86eywm2f84mpcyuux3dv9mmztsdxt2","ioc_type":"bitcoin","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"4e20f2c4c90e3654a8c43fb10003978d61d2b48426414dede3b1bd5a2c891b54","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"6aa51de51a6b352fd073b5b9080011d358d42fa190a8a9ee216e3ef6e657b801","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"36de93aaf26727f6dd55ff2100b08dfb52abccfb57a7bf4d07a7fb703a86623d","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"e5c5617c8676e9a5cf6108d344fe7fcb6590671efd6baccb02b9313da0f0d289","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"0383c0d109b7cfdef058b0197125c85d276510724be33a746056f9a7c181d761","ioc_type":"hash_sha256","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nbmcorpuser.internal","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\n23[.]94[.]126[.]63\\n\\n198[.]244[.]224[.]200\\n\\nadmiring-shockley[.]196-251-83-162[.]plesk[.]page\\n\\nbless-invite[.]com\\n\\nget-carrot-zoom[.]com\\n\\nmodernatx-zoom[.]com\\n\\nrecurly-zoom[.]com\\n\\nEvilginx","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nNew","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\naffiliates","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nmanufacturing","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"12.2.0.1","ioc_type":"ip","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\ntesting","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nFigure\\n\\n15","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"fbi.gov","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"trial-6857053.okta","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nEclecticIQ","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nThese","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nThreat","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nFigure","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nShinyHunters","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"8ae6452064e6535526083d08be54c419543266c8","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/6cb5b2ac04703bb961759123855335e084420534.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/6cb5b2ac04703bb961759123855335e084420534.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/6cb5b2ac04703bb961759123855335e084420534.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nSource:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nDuring","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nNow","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"DC.FQDN","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nlsadump::dcsync","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nWe","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"8b7c904343e530c4f81c53e8f614caf7","ioc_type":"hash_md5","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"System.Security","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"System.Security.Principal.NTAccount","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"RootDomain.Name","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"System.DirectoryServices.ActiveDirectory.Forest","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nthe","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"testlab.local","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nOne","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nHere\u2019s","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nThis","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nNTDS.dit","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"SECONDARY.dev.testlab.local","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"dev.testlab.local","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nYou\u00a0land","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Invoke-Mimikatz.ps","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"powerkatz.dlls","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/\\n\\nMimikatz","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"6cb5b2ac04703bb961759123855335e084420534","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/7d465ed5e6c3507494f1e55ce072801d3f0986c2.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/7d465ed5e6c3507494f1e55ce072801d3f0986c2.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/7d465ed5e6c3507494f1e55ce072801d3f0986c2.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Agent.DNE","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 14:45:34","tlp":"tlp:white"},{"ioc_value":"kl.ps","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Get-LAPSP.ps","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Decrypt-RDCMan.ps","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-s\\nector-in-the-middle-east/\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nBuild","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nVarious","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"extension.aspx","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nThe","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nto","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/\\n\\nNew","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"7d465ed5e6c3507494f1e55ce072801d3f0986c2","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/b2386bef6e70b932af44e6bb3f3d3f1cc3cc69ec.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/b2386bef6e70b932af44e6bb3f3d3f1cc3cc69ec.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/b2386bef6e70b932af44e6bb3f3d3f1cc3cc69ec.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Trojan.Heur.PT","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 14:45:34","tlp":"tlp:white"},{"ioc_value":"Agent.dhwf","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 14:45:34","tlp":"tlp:white"},{"ioc_value":"TEMP.Hippo","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 14:45:33","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nhttps://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nT1588.007:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nT1592.001:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nAML.T0040:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ngenerativelanguage.googleapis.com","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nTactic","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nmade","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nBuilding","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nThroughout","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nTable","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nAPI","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nTEMP.Hex","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nAs","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nGTIG","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nmodel","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\n\\","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nIn","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nFigure","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nTo","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nThreat","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nSupply","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access\\n\\nAdversaries","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"b2386bef6e70b932af44e6bb3f3d3f1cc3cc69ec","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/a02b28e3ffab42076e427d0a633318e4cb6c8d4f.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/a02b28e3ffab42076e427d0a633318e4cb6c8d4f.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/a02b28e3ffab42076e427d0a633318e4cb6c8d4f.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nLegal","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nAWS-style","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"ok.ru","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"yadi.sk","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nMail.ru","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"document.open","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nAll","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"febb622cd9eeb5c8860dcef4cbfd4b74","ioc_type":"hash_md5","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"window.TELEGRAM","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\n1","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"6894a51278ec89118276c2dd2dc36e6f9ea2790a","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nlogin.microsoftonline.com/common/oauth2/deviceauth","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nFigure","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"Microsoft.com","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nKali365","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/\\n\\nFrom","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"a02b28e3ffab42076e427d0a633318e4cb6c8d4f","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/8d41a8e2a1c3d323e9372fe6c6503e7e23d1a978.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/8d41a8e2a1c3d323e9372fe6c6503e7e23d1a978.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/8d41a8e2a1c3d323e9372fe6c6503e7e23d1a978.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack\\n\\nExfiltration","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack\\n\\nbeing","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack\\n\\nHere\u2019s","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"8d41a8e2a1c3d323e9372fe6c6503e7e23d1a978","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/151bf563f232f0cd8cfd95826f9c34b04f067848.jpg","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/151bf563f232f0cd8cfd95826f9c34b04f067848.txt","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://archive.orkl.eu/151bf563f232f0cd8cfd95826f9c34b04f067848.pdf","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nPage","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nHost\\n\\n/var/lib/svc_internal/runner.py\\n\\n/etc/systemd/system/internal-monitor.service\\n\\n/tmp/pglog\\n\\n/tmp/.pg_state\\n\\n/var/lib/pgmon/pgmon.py\\n\\n/etc/systemd/system/pgmonitor.service\\n\\nSystemd","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://championships-peoples-point-cassette.trycloudflare[.]com","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://investigation-launches-hearings-copying.trycloudflare[.]com/","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://souls-entire-defined-routes.trycloudflare[.]com/","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"json.dumps","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nconn.request","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\ncmd","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"keys.append","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"os.path.join","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"os.path.expanduser","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"match.groups","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"re.search","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://championships-peoples-point-\\n\\ncassette.trycloudflare[.]com/prop.py","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nOutbound","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"os.system","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"os.getuid","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"subprocess.run","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\npath:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"multi-user.target","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"network.target","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nname:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"yaml.encode","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nsubprocess.run","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nmetadata:\\n\\nlabels:\\n\\nname:","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nrm","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"os.environ.get","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"subprocess.DEVNULL","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"subprocess.check","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"f.read","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"os.environ","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"os.path.exists","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"nsys.exit","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://souls-entire-defined-routes.trycloudflare[.]com/kube.py\\","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/k\\n\\nchmod","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://dl.k8s.io/release/$(curl","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nif","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://souls-entire-defined-\\n\\n","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"trycloudflare.com","ioc_type":"domain","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran\\n\\nCanisterWorm","ioc_type":"url","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"},{"ioc_value":"151bf563f232f0cd8cfd95826f9c34b04f067848","ioc_type":"hash_sha1","category":"Threat Reports","threat_score":"0.50","confidence_score":"0.50","first_seen":"2026-08-06 13:12:36","last_seen":"2026-08-06 13:12:36","tlp":"tlp:white"}]}