{
    "count": 11,
    "indicators": [
        {
            "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/24\/i\/how-ransomhub-ransomware-uses-edrkillshifter-to-disable-edr-and-.html",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/www.welivesecurity.com\/en\/eset-research\/cosmicbeetle-steps-up-probation-period-ransomhub\/",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/symantec-enterprise-blogs.security.com\/threat-intelligence\/ransomhub-knight-ransomware",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/ransomware-spotlight\/ransomware-spotlight-ransomhub",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:20"
        },
        {
            "ioc_value": "https:\/\/www.group-ib.com\/blog\/ransomhub-never-sleeps-episode-1\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:20"
        },
        {
            "ioc_value": "https:\/\/www.cisa.gov\/sites\/default\/files\/2024-09\/aa24-242a-stopransomware-ransomhub-ransomware_1.pdf",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:20"
        },
        {
            "ioc_value": "https:\/\/www.welivesecurity.com\/en\/eset-research\/shifting-sands-ransomhub-edrkillshifter\/",
            "ioc_type": "url",
            "category": "Domains\/URLs",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:11:10",
            "last_seen": "2026-08-23 09:01:39"
        },
        {
            "ioc_value": "https:\/\/github.com\/eset\/malware-ioc\/tree\/master\/ransomhub",
            "ioc_type": "url",
            "category": "Domains\/URLs",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:11:10",
            "last_seen": "2026-08-23 09:01:39"
        },
        {
            "ioc_value": "win.ransomhub",
            "ioc_type": "malware",
            "category": "Malware Attribution",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:07:43",
            "last_seen": "2026-08-12 00:08:24"
        },
        {
            "ioc_value": "https:\/\/www.ransomware.live\/group\/ransomhub",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:12:26",
            "last_seen": "2026-08-06 14:45:05"
        },
        {
            "ioc_value": "https:\/\/www.ransomlook.io\/group\/ransomhub",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:02",
            "last_seen": "2026-08-06 13:13:02"
        }
    ]
}