{
    "count": 13,
    "indicators": [
        {
            "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/22\/j\/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html",
            "ioc_type": "url",
            "category": "Malware Attribution",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 8,
            "first_seen": "2026-08-06 13:07:44",
            "last_seen": "2026-08-06 19:46:52"
        },
        {
            "ioc_value": "https:\/\/www.trellix.com\/blogs\/research\/qakbot-evolves-to-onenote-malware-distribution\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 5,
            "first_seen": "2026-08-06 13:09:18",
            "last_seen": "2026-08-06 14:48:30"
        },
        {
            "ioc_value": "https:\/\/www.netskope.com\/blog\/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 5,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-06 14:48:30"
        },
        {
            "ioc_value": "https:\/\/securelist.com\/qakbot-technical-analysis\/103931\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 5,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-06 14:48:30"
        },
        {
            "ioc_value": "https:\/\/cybersecurity.att.com\/blogs\/labs-research\/the-rise-of-qakbot",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 5,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-06 14:48:30"
        },
        {
            "ioc_value": "https:\/\/isc.sans.edu\/diary\/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exploit+msmsdt\/28728",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-06 14:45:33"
        },
        {
            "ioc_value": "https:\/\/github.com\/pr0xylife\/Qakbot\/blob\/main\/Qakbot_obama230_19.12.2022.txt",
            "ioc_type": "url",
            "category": "Domains\/URLs",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:11:09",
            "last_seen": "2026-08-06 14:43:50"
        },
        {
            "ioc_value": "http:\/\/osint.bambenekconsulting.com\/feeds\/qakbot-iplist.txt",
            "ioc_type": "url",
            "category": "IP Blocklists",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:05:20",
            "last_seen": "2026-08-06 14:37:34"
        },
        {
            "ioc_value": "http:\/\/iplists.firehol.org\/?ipset=bambenek_qakbot",
            "ioc_type": "url",
            "category": "IP Blocklists",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:05:20",
            "last_seen": "2026-08-06 14:37:34"
        },
        {
            "ioc_value": "https:\/\/www.cynet.com\/blog\/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware\/",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        },
        {
            "ioc_value": "https:\/\/www.hornetsecurity.com\/en\/security-information\/qakbot-malspam-leading-to-prolock\/",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        },
        {
            "ioc_value": "https:\/\/www.hornetsecurity.com\/en\/threat-research\/qakbot-reducing-its-on-disk-artifacts\/",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        },
        {
            "ioc_value": "https:\/\/www.zdnet.com\/article\/fbi-prolock-ransomware-gains-access-to-victim-networks-via-qakbot-infections\/",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        }
    ]
}