{
    "count": 22,
    "indicators": [
        {
            "ioc_value": "http:\/\/gunshopuciykxsq2wrya3vvzfsbu56jq5ryuk2tu6m34zrrndpxktpid.onion\/",
            "ioc_type": "url",
            "category": "Dark Web",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 19:47:45",
            "last_seen": "2026-08-06 19:47:45"
        },
        {
            "ioc_value": "https:\/\/raw.githubusercontent.com\/ryukyagamilight\/terminal-skills\/main\/docker\/networking\/skills_terminal_v1.4.zip",
            "ioc_type": "url",
            "category": "Domains\/URLs",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:07:40",
            "last_seen": "2026-08-06 19:46:44"
        },
        {
            "ioc_value": "1KcWq3bgVajvhrG3HmmLoE64TU9rYUKvx5",
            "ioc_type": "bitcoin",
            "category": "Ransomware",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 5,
            "first_seen": "2026-08-06 13:10:18",
            "last_seen": "2026-08-06 14:49:11"
        },
        {
            "ioc_value": "coinberryuk.com",
            "ioc_type": "other",
            "category": "Cryptocurrency",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:08:54",
            "last_seen": "2026-08-06 14:48:48"
        },
        {
            "ioc_value": "uniswap.ryukyu",
            "ioc_type": "other",
            "category": "Cryptocurrency",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:08:52",
            "last_seen": "2026-08-06 14:48:45"
        },
        {
            "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-06 14:48:30"
        },
        {
            "ioc_value": "https:\/\/thedfirreport.com\/2020\/11\/05\/ryuk-speed-run-2-hours-to-ransom\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-06 14:48:30"
        },
        {
            "ioc_value": "https:\/\/thedfirreport.com\/2020\/10\/08\/ryuks-return\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-06 14:48:30"
        },
        {
            "ioc_value": "https:\/\/redcanary.com\/blog\/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-06 14:48:30"
        },
        {
            "ioc_value": "https:\/\/www.crowdstrike.com\/blog\/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 9,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-06 14:48:29"
        },
        {
            "ioc_value": "https:\/\/www.crowdstrike.com\/blog\/wizard-spider-adds-new-feature-to-ryuk-ransomware\/",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-06 14:45:33"
        },
        {
            "ioc_value": "animalsanctuaryuk.com",
            "ioc_type": "other",
            "category": "Malware Domains",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:09:35",
            "last_seen": "2026-08-06 14:42:11"
        },
        {
            "ioc_value": "myetherwallet.ryukyu",
            "ioc_type": "other",
            "category": "Cryptocurrency",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:09:05",
            "last_seen": "2026-08-06 14:41:40"
        },
        {
            "ioc_value": "http:\/\/myetherwallet.ryukyu",
            "ioc_type": "url",
            "category": "Cryptocurrency",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:09:05",
            "last_seen": "2026-08-06 14:41:40"
        },
        {
            "ioc_value": "ancestryuki.112.2o7.net",
            "ioc_type": "other",
            "category": "Scam",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 2,
            "first_seen": "2026-08-06 13:08:40",
            "last_seen": "2026-08-06 14:41:07"
        },
        {
            "ioc_value": "https:\/\/areteir.com\/wp-content\/uploads\/2020\/08\/Arete_Insight_Is-Conti-the-new-Ryuk_August2020.pdf",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        },
        {
            "ioc_value": "https:\/\/public.intel471.com\/blog\/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer\/",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        },
        {
            "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/ryuk-successor-conti-ransomware-releases-data-leak-site\/",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        },
        {
            "ioc_value": "https:\/\/www.trmlabs.com\/post\/analysis-corroborates-suspected-ties-between-conti-and-ryuk-ransomware-groups-and-wizard-spider",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        },
        {
            "ioc_value": "RyukReadMe.txt",
            "ioc_type": "other",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        },
        {
            "ioc_value": "https:\/\/news.sophos.com\/en-us\/2020\/10\/14\/inside-a-new-ryuk-ransomware-attack\/",
            "ioc_type": "url",
            "category": "ICS ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:09:23",
            "last_seen": "2026-08-06 13:09:23"
        },
        {
            "ioc_value": "https:\/\/thedfirreport.com\/2020\/10\/18\/ryuk-in-5-hours\/",
            "ioc_type": "url",
            "category": "ICS ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:09:23",
            "last_seen": "2026-08-06 13:09:23"
        }
    ]
}