{
  "Event": {
    "analysis": "2",
    "date": "2025-02-19",
    "extends_uuid": "",
    "info": "OSINT - Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger",
    "publish_timestamp": "1739984099",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1739984090",
    "uuid": "590dd2db-c431-4d97-9b0c-5d1f26ab24b8",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"russia\"",
        "relationship_type": "attributed-to"
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"ukraine\"",
        "relationship_type": "targets"
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#001fc2",
        "local": false,
        "name": "estimative-language:likelihood-probability=\"almost-certain\"",
        "relationship_type": ""
      },
      {
        "colour": "#0029ff",
        "local": false,
        "name": "estimative-language:confidence-in-analytic-judgment=\"high\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "WAVESIGN batch scripts",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1739978403",
        "to_ids": true,
        "type": "md5",
        "uuid": "8b4c90a0-c5ff-486d-a96f-a9fffe8ee657",
        "value": "a97a28276e4f88134561d938f60db495",
        "Tag": [
          {
            "colour": "#12e300",
            "local": true,
            "name": "misp-galaxy:threat-actor=\"Sandworm\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "WAVESIGN batch scripts",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1739978403",
        "to_ids": true,
        "type": "md5",
        "uuid": "7edf20c1-96cd-4eb8-9aae-41c4ff1049be",
        "value": "b379d8f583112cad3cf60f95ab3a67fd",
        "Tag": [
          {
            "colour": "#12e300",
            "local": true,
            "name": "misp-galaxy:threat-actor=\"Sandworm\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "WAVESIGN batch scripts",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1739978403",
        "to_ids": true,
        "type": "md5",
        "uuid": "9de9dba3-eba0-406b-a2a6-97488a8bbc4a",
        "value": "b27ff24870d93d651ee1d8e06276fa98",
        "Tag": [
          {
            "colour": "#12e300",
            "local": true,
            "name": "misp-galaxy:threat-actor=\"Sandworm\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Fake Signal security alert",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1739978959",
        "to_ids": true,
        "type": "domain",
        "uuid": "576dd3ae-bd6b-4b63-ae56-408633c10501",
        "value": "signal-protect.host"
      },
      {
        "category": "Payload delivery",
        "comment": "Example of altered group invite HTML code",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1739979198",
        "to_ids": true,
        "type": "md5",
        "uuid": "e5637442-19c5-4e6e-9343-9c40462fda81",
        "value": "e078778b62796bab2d7ab2b04d6b01bf"
      }
    ],
    "Object": [
      {
        "comment": "Dynamically generated device-linking QR code provisioned by APT44",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1739978606",
        "uuid": "7a40374d-fccf-43d1-873b-01ee12226ba7",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1739978606",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "4468b86d-86b4-40bc-b71f-41dbe7b3e350",
            "value": "150.107.31.194",
            "Tag": [
              {
                "colour": "#12e300",
                "local": true,
                "name": "misp-galaxy:threat-actor=\"Sandworm\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "dst-port",
            "timestamp": "1739978606",
            "to_ids": false,
            "type": "port",
            "uuid": "afe0a928-7c29-4028-b863-a3b33ea34c89",
            "value": "18000",
            "Tag": [
              {
                "colour": "#12e300",
                "local": true,
                "name": "misp-galaxy:threat-actor=\"Sandworm\"",
                "relationship_type": ""
              }
            ]
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1739978778",
        "uuid": "e08e1c85-18b6-4aa9-82ae-25f604166065",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "Fake Kropyva group invites",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "hostname",
            "timestamp": "1739978778",
            "to_ids": true,
            "type": "hostname",
            "uuid": "81974a41-d82b-4522-933f-55e60bbb0cba",
            "value": "teneta.join-group.online"
          },
          {
            "category": "Network activity",
            "comment": "Fake Kropyva group invites",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "hostname",
            "timestamp": "1739978778",
            "to_ids": true,
            "type": "hostname",
            "uuid": "9733f27c-47d2-48dd-a3fd-4cdf405f349a",
            "value": "teneta.add-group.site"
          },
          {
            "category": "Network activity",
            "comment": "Fake Kropyva group invites",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739978778",
            "to_ids": true,
            "type": "domain",
            "uuid": "863a3547-104f-4805-af72-a3fb631fd3ad",
            "value": "group-teneta.online"
          },
          {
            "category": "Network activity",
            "comment": "Fake Kropyva group invites",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739978778",
            "to_ids": true,
            "type": "domain",
            "uuid": "36c56d68-45c4-4a3a-991f-297f23670585",
            "value": "helperanalytics.ru"
          },
          {
            "category": "Network activity",
            "comment": "Fake Kropyva group invites",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739978778",
            "to_ids": true,
            "type": "domain",
            "uuid": "a37a1a89-ebd5-41f7-888e-dfd13f4cd5cd",
            "value": "teneta.group"
          },
          {
            "category": "Network activity",
            "comment": "Fake Kropyva group invites",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "hostname",
            "timestamp": "1739978778",
            "to_ids": true,
            "type": "hostname",
            "uuid": "7ba12bbd-5e80-47b4-9c2a-90ff7ec38a05",
            "value": "group.kropyva.site"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1739978992",
        "uuid": "02d3e59a-8fa8-4655-8a28-5639e70dfce5",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "Device-linking instructions phishing page",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739978992",
            "to_ids": true,
            "type": "domain",
            "uuid": "5baf65d3-5975-47cc-b6ca-39b99152e702",
            "value": "signal-confirm.site"
          },
          {
            "category": "Network activity",
            "comment": "Device-linking instructions phishing page",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739978992",
            "to_ids": true,
            "type": "domain",
            "uuid": "4d6ce775-c873-4a31-8f74-f9a87848d694",
            "value": "confirm-signal.site"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1739979079",
        "uuid": "56f2d48b-aba8-49e2-be49-5b603d2864a2",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "3cc84a5d-0506-40ef-9d6c-8813214c9187",
            "value": "add-signal-group.com"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "a0587553-c610-44b8-a43b-675d47ae9a45",
            "value": "add-signal-groups.com"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "2b0666d0-61c9-49c1-99b5-0e4ac745d241",
            "value": "group-signal.com"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "d275a14a-da4f-434e-b0c5-b299aa2bf620",
            "value": "groups-signal.site"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "2f88e5b8-2d5d-443d-a9e6-59eb77c237ba",
            "value": "signal-device-off.online"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "72b5cdb4-cce3-4a53-b948-5f2fd953a427",
            "value": "signal-group-add.com"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "c3502220-87f0-49af-8551-2a9257045df4",
            "value": "signal-group.site"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "e25ae9c1-f8d6-4e8a-b982-cab6f5a948f5",
            "value": "signal-group.tech"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "952b307c-2e57-41a1-95b5-37ac66a03a3f",
            "value": "signal-groups-add.com"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "85f103d7-0143-46dd-aaa1-05a2daea6e0b",
            "value": "signal-groups.site"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "52460b7e-45ee-4c6e-bc1c-7520074236ad",
            "value": "signal-groups.tech"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "4f5795b9-acfd-403d-a7f1-7fd81aaedf4d",
            "value": "signal-security.online"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "d3e6a6e9-5e6f-4738-8ba7-88782940e0aa",
            "value": "signal-security.site"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "88ac6cc1-1240-4c40-b723-b85f3f1f0fc7",
            "value": "signalgroup.site"
          },
          {
            "category": "Network activity",
            "comment": "Fake group invite phishing pages",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "domain",
            "timestamp": "1739979079",
            "to_ids": true,
            "type": "domain",
            "uuid": "f40ebb1a-9975-458a-92b5-3a160d8b44c3",
            "value": "signals-group.com"
          }
        ]
      }
    ]
  }
}