{
  "Event": {
    "analysis": "1",
    "date": "2026-02-23",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-23",
    "publish_timestamp": "1771871401",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1771871400",
    "uuid": "ba6eb2c8-966a-4aa9-891a-491968e19b68",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-23T02:52:31.192845+00:00",
        "timestamp": "1771815152",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6876371b-7310-4124-98ab-718f1977d344",
        "value": "2001:470:1:fb5:1e78:6c5e:1f47:8a54",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-23T03:16:25.474457+00:00",
        "timestamp": "1771816587",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d7395136-9c14-44a9-994c-233e90965c2e",
        "value": "2602:f915:e:c26f::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-23T05:35:59.154030+00:00",
        "timestamp": "1771824960",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0e25b970-e834-49a8-933d-4c66f8d1f2ad",
        "value": "2001:470:1:c84::12",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-23T06:36:14.625271+00:00",
        "timestamp": "1771828576",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d3c62585-6ee0-49c6-a1d7-7d559c01109c",
        "value": "110.93.150.104",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-23T08:55:02.755485+00:00",
        "timestamp": "1771836904",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6fcbe403-037d-4b4a-a136-6975f01b3d1a",
        "value": "20.5.80.84",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-23T16:17:38.986669+00:00",
        "timestamp": "1771863460",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9fdb375c-0ca2-470e-9118-774a5218dfeb",
        "value": "20.189.202.45",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-23T17:14:17.680101+00:00",
        "timestamp": "1771866859",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3722816a-c154-425e-86c4-621a72cbf40e",
        "value": "114.111.32.101",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-23T18:29:58.609684+00:00",
        "timestamp": "1771871400",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "df994ece-6030-484b-9b87-97505cb99aac",
        "value": "35.92.226.67",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}