{
  "Event": {
    "analysis": "1",
    "date": "2026-02-27",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-27",
    "publish_timestamp": "1772208725",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1772208724",
    "uuid": "9a8e444f-c5a6-4e6f-b99b-03ee771a1c03",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T01:44:34.866431+00:00",
        "timestamp": "1772156677",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4199f5b0-86bc-458a-aec4-0c65235507a8",
        "value": "172.94.9.249",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T04:22:39.257554+00:00",
        "timestamp": "1772166160",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "798ff581-53f7-43e6-a30b-1289ca6b0950",
        "value": "65.49.20.68",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T04:22:43.190759+00:00",
        "timestamp": "1772166164",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "38bbc755-a070-47a6-b535-974d1a1ba2d6",
        "value": "2001:470:1:c84::23",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T07:35:33.265410+00:00",
        "timestamp": "1772177734",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4ea7657f-7609-49d9-802b-81a8b3b711de",
        "value": "41.249.151.99",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T10:18:30.254258+00:00",
        "timestamp": "1772187511",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "88e883f8-d15f-4c18-85cb-c67f7846bc94",
        "value": "2a02:4780:2b:2016:0:3a9d:3648:1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T13:38:27.065502+00:00",
        "timestamp": "1772199508",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5e67b1ad-d9d3-442b-b27a-102daa98639e",
        "value": "192.109.139.184",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T13:41:25.955541+00:00",
        "timestamp": "1772199687",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "31cd96ae-73c5-4843-b51c-baf00e629278",
        "value": "110.93.150.157",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T13:41:29.335458+00:00",
        "timestamp": "1772199690",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "36474c23-ca1d-433f-830c-3bb28f32e7a2",
        "value": "211.249.46.201",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER PHP tags in HTTP POST",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T15:21:31.156456+00:00",
        "timestamp": "1772205693",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "eb0ca09f-d1bb-4e3d-893b-102b5f242e32",
        "value": "202.73.26.78",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER Fake Googlebot UA 2 Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-27T16:12:03.350092+00:00",
        "timestamp": "1772208724",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4081f65a-7c4e-40f5-b0bf-89793369dce6",
        "value": "18.236.164.4",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}