{
    "count": 18,
    "indicators": [
        {
            "ioc_value": "https:\/\/securelist.com\/darkhalo-after-solarwinds-the-tomiris-connection\/104311\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 9,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/www.guidepointsecurity.com\/blog\/supernova-solarwinds-net-webshell-analysis",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/www.sentinelone.com\/labs\/solarwinds-understanding-detecting-the-supernova-webshell-trojan",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/blogs.blackberry.com\/en\/2022\/11\/romcom-spoofing-solarwinds-keepass",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/www.fireeye.com\/blog\/threat-research\/2020\/12\/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 9,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/blog.fox-it.com\/2021\/11\/08\/ta505-exploits-solarwinds-serv-u-vulnerability-cve-2021-35211-for-initial-access\/",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/07\/13\/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit\/",
            "ioc_type": "url",
            "category": "Threat Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 3,
            "first_seen": "2026-08-06 13:13:00",
            "last_seen": "2026-08-23 13:09:22"
        },
        {
            "ioc_value": "https:\/\/www.darkreading.com\/threat-intelligence\/fireeye-s-mandia-severity-zero-alert-led-to-discovery-of-solarwinds-attack",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:18",
            "last_seen": "2026-08-23 13:09:21"
        },
        {
            "ioc_value": "https:\/\/symantec-enterprise-blogs.security.com\/blogs\/threat-intelligence\/solarwinds-raindrop-malware",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:20"
        },
        {
            "ioc_value": "https:\/\/www.gov.uk\/government\/news\/russia-uk-exposes-russian-involvement-in-solarwinds-cyber-compromise",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:20"
        },
        {
            "ioc_value": "https:\/\/www.guidepointsecurity.com\/supernova-solarwinds-net-webshell-analysis\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:20"
        },
        {
            "ioc_value": "https:\/\/www.volexity.com\/blog\/2020\/12\/14\/dark-halo-leverages-solarwinds-compromise-to-breach-organizations\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:19"
        },
        {
            "ioc_value": "https:\/\/www.solarwinds.com\/sa-overview\/securityadvisory",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:19"
        },
        {
            "ioc_value": "https:\/\/orangematter.solarwinds.com\/2021\/01\/11\/new-findings-from-our-investigation-of-sunburst\/",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:19"
        },
        {
            "ioc_value": "https:\/\/www.ncsc.gov.uk\/news\/uk-and-us-call-out-russia-for-solarwinds-compromise",
            "ioc_type": "url",
            "category": "ATT&CK",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:09:17",
            "last_seen": "2026-08-23 13:09:19"
        },
        {
            "ioc_value": "www.solarwinds.com",
            "ioc_type": "other",
            "category": "Vulnerabilities",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:10:28",
            "last_seen": "2026-08-06 14:48:26"
        },
        {
            "ioc_value": "documentation.solarwinds.com",
            "ioc_type": "other",
            "category": "Vulnerabilities",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 6,
            "first_seen": "2026-08-06 13:10:28",
            "last_seen": "2026-08-06 14:48:26"
        },
        {
            "ioc_value": "https:\/\/news.sophos.com\/en-us\/2021\/02\/03\/mtr-casebook-uncovering-a-backdoor-implant-in-a-solarwinds-orion-server\/",
            "ioc_type": "url",
            "category": "Ransomware Actors",
            "threat_score": "0.50",
            "confidence_score": "0.50",
            "sighting_count": 1,
            "first_seen": "2026-08-06 13:13:01",
            "last_seen": "2026-08-06 13:13:01"
        }
    ]
}