{
    "count": 12,
    "indicators": [
        {
            "ioc_value": "https:\/\/web.archive.org\/web\/20190202205824\/https:\/\/www.fireeye.com\/blog\/threat-research\/2018\/10\/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html",
            "ioc_type": "url",
            "category": "ICS ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 4,
            "first_seen": "2026-08-06 13:09:23",
            "last_seen": "2026-08-24 12:52:01"
        },
        {
            "ioc_value": "https:\/\/github.com\/MDudek-ICS\/TRISIS-TRITON-HATMAN\/tree\/master\/decompiled_code\/library",
            "ioc_type": "url",
            "category": "ICS ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 4,
            "first_seen": "2026-08-06 13:09:23",
            "last_seen": "2026-08-24 12:52:01"
        },
        {
            "ioc_value": "https:\/\/www.midnightbluelabs.com\/blog\/2018\/1\/16\/analyzing-the-triton-industrial-malware",
            "ioc_type": "url",
            "category": "ICS ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 4,
            "first_seen": "2026-08-06 13:09:23",
            "last_seen": "2026-08-24 12:52:00"
        },
        {
            "ioc_value": "https:\/\/www.fireeye.com\/blog\/threat-research\/2017\/12\/attackers-deploy-new-ics-attack-framework-triton.html",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 15,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-24 12:52:00"
        },
        {
            "ioc_value": "https:\/\/web.archive.org\/web\/20200618231942\/https:\/\/www.fireeye.com\/blog\/threat-research\/2018\/06\/totally-tubular-treatise-on-triton-and-tristation.html",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 10,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-24 12:52:00"
        },
        {
            "ioc_value": "https:\/\/www.fireeye.com\/blog\/threat-research\/2019\/04\/triton-actor-ttp-profile-custom-attack-tools-detections.html",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 10,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-24 12:52:00"
        },
        {
            "ioc_value": "https:\/\/www.fireeye.com\/blog\/threat-research\/2018\/10\/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 10,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-24 12:52:00"
        },
        {
            "ioc_value": "https:\/\/www.fireeye.com\/content\/dam\/fireeye-www\/blog\/files\/TRITON_Appendix_C.html",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 10,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-24 12:52:00"
        },
        {
            "ioc_value": "https:\/\/raw.githubusercontent.com\/darkvibs\/libtriton_jit\/main\/Fagopyrum\/jit-libtriton-v2.1.zip",
            "ioc_type": "url",
            "category": "Domains\/URLs",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 5,
            "first_seen": "2026-08-06 13:07:40",
            "last_seen": "2026-08-24 11:11:36"
        },
        {
            "ioc_value": "https:\/\/raw.githubusercontent.com\/Anggipratama17\/triton-accelerated-attention\/main\/results\/accelerated_triton_attention_2.8.zip",
            "ioc_type": "url",
            "category": "Domains\/URLs",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 5,
            "first_seen": "2026-08-06 13:07:40",
            "last_seen": "2026-08-24 11:11:36"
        },
        {
            "ioc_value": "https:\/\/raw.githubusercontent.com\/Incensecedarthreepointswitch884\/MoDA\/main\/libs\/moda_triton\/fla\/models\/mamba\/DA-Mo-v1.4.zip",
            "ioc_type": "url",
            "category": "Domains\/URLs",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 5,
            "first_seen": "2026-08-06 13:07:40",
            "last_seen": "2026-08-24 11:11:35"
        },
        {
            "ioc_value": "https:\/\/www.fireeye.com\/blog\/threat-research\/2018\/06\/totally-tubular-treatise-on-TRITON-and-tristation.html",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:20"
        }
    ]
}