{ "Event": { "analysis": "0", "date": "2026-02-01", "extends_uuid": "", "info": "\"Hanger Bulletin\": UAC-0001 (APT28) carries out cyberattacks against Ukraine and EU countries using the exploit CVE-2026-21509 (CERT-UA#19542)", "publish_timestamp": "1770211427", "published": true, "threat_level_id": "4", "timestamp": "1770211390", "uuid": "dbc619e5-1b69-44c6-81d0-7fb79390bde4", "Orgc": { "name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT28 - G0007\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-pre-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": "" }, { "colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": "" }, { "colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" } ], "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "filename", "uuid": "d8aec450-e7bd-407b-bcce-f80d75fd261b", "value": "smb)://freefoodid[.]com/documents/template_2_2.doc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "filename", "uuid": "cef914c2-635e-437d-9ad1-1bb96a410092", "value": "smb)://wellnesscaremed[.]c/davwwwroot/buch/Downloads/blank.doc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "filename", "uuid": "32b27a79-f7e7-40f0-8888-54cddd36fb58", "value": "smb)://wellnessmedcare[..]org@sl/cz/Downloads/blank.doc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "filename", "uuid": "6d39052f-3baa-4435-b7cb-ae3d18df3b03", "value": "smb)://wellnessedcare[..]org@sl/pol/Downloads/blank.doc" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "url", "uuid": "187362da-2126-4676-aa23-7e651f021ffb", "value": "http://freefoodadid.c/davwwwroot/2_2.lNk?" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "url", "uuid": "e4c52092-b7ab-4979-b508-7480223468f4", "value": "http://freefoodid.com/documents/2_2.lNk?" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "url", "uuid": "be1fca8e-4c61-45ec-a36f-134ad26702dd", "value": "https://wellnesscaremed.com/buch/Downloads/document.doc.LnK?" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "url", "uuid": "5424b9c7-f191-4cc1-a90f-c236a44ac607", "value": "http://wellnesscaremed.com/buch/Downloads/document.doc.LnK?" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770211110", "to_ids": true, "type": "url", "uuid": "ad4fe3fc-9059-4cd9-870c-dc3dc0772fa5", "value": "http://wellnesscaremed.com/veriza" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770211135", "to_ids": true, "type": "url", "uuid": "3c1115ad-73e7-4e19-9623-dc4ea9461aa6", "value": "http://wellnesscaremed.com/venezia/d/s.d" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "url", "uuid": "5b684bac-c06f-4fc9-ab38-831aecfd7405", "value": "https://wellnessmedcare[..]org/davwwwroot/cz/Downloads/document.LnK?" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "url", "uuid": "df11c50e-c299-47e0-893c-3ff420d41716", "value": "http://wellnessedcare[..]org/davwwwroot/cz/Downloads/document.LnK?" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "url", "uuid": "e6bd28e8-aab7-4b34-808a-aecbb2951bc3", "value": "https://wellnessedcare[..]org/davwwwroot/pol/Downloads/document.LnK?" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "url", "uuid": "690fe64d-118a-469c-92de-8f98c8ed87a9", "value": "http://wellnessedcare[..]org/davwwwroot/pol/Downloads/document.LnK?" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "domain", "uuid": "fd82c0d1-8525-43c3-9784-69e224f3b86e", "value": "freefoadid.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "domain", "uuid": "c33ea50b-890a-4c59-9a29-37082ae1aca5", "value": "wellnesscaremed.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038222", "to_ids": true, "type": "domain", "uuid": "44d1120b-fc92-4788-b533-cad60f74152c", "value": "wellnessedcare.org" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "6c27f5e4-af4c-4913-9956-f67b677033d9", "value": "*.filen.net" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "baeabc54-046e-4c17-9a54-b6bbd094bb33", "value": "*.filen-1.net" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "48b86542-1ffc-44a7-a46a-1c15e5e3a91f", "value": "*.filen-2.net" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "d3bbd4bb-ae31-499a-a6b7-a93cfc708997", "value": "*.filen-3.net" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "99f99b92-a988-4e7f-91b8-b27342072efb", "value": "*.filen-4.net" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "d52ac061-b0b8-4c93-bc48-41c288319b9b", "value": "*.filen-5.net" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "8c8d0ca0-96b5-493f-a633-22ca25b5aee3", "value": "*.filen-6.net" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "a739bea6-623f-462b-958f-7abe8e284583", "value": "*.filen.io" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "37317eb2-73ef-40c0-98c2-abc07b6f612a", "value": "*.filen.dev" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "dbe731d3-7dcd-4a40-9a86-aee53f8097d2", "value": "146.0.41.204" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "24a34997-3028-47cb-b227-075b414e8708", "value": "146.0.41.205" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "3066dc01-292a-4112-990e-47a2c52aa729", "value": "146.0.41.206" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "616f0957-b8a0-485e-98ee-36f8cd648e07", "value": "146.0.41.207" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "6eb11caa-0bcd-4c95-97c5-2fb0b8a0cf9e", "value": "146.0.41.208" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "c13e40e9-e6d8-4d24-93fe-2d197a98bdf6", "value": "146.0.41.231" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "0b9ab30d-fa9e-4b4e-b6bb-bef8d7f0c31f", "value": "146.0.41.232" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "53021ffe-49ca-400d-ae28-ec87ffb7dea0", "value": "146.0.41.233" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "ip-dst", "uuid": "72e671a4-69a3-4679-bc88-2e2e7f31cbca", "value": "146.0.41.234" }, { "category": "Persistence mechanism", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "regkey", "uuid": "2bd45767-ccd0-4f74-bcd6-e75042de327a", "value": "%PROGRAMDADA%\\Microsoft" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "1c6ef1c7-37f2-4c02-a557-212f64cbf011", "value": "OneDrive\\setup\\Cache\\SplashScreen.png" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "1d29c766-7c19-437e-8c4b-1ac88929c27a", "value": "%PROGRAMDAPATHAM%\\USPublic\\Data\\EhStoreShell.dll" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "473841f3-7f59-4d79-b805-9f84f741fefd", "value": "%TMP%\\Diagnostics\\office.xml" }, { "category": "Persistence mechanism", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "regkey", "uuid": "e77da6d5-9f54-47ca-9fd2-ceb398b48858", "value": "HKCU\\Software\\Classes\\CLSIS\\{D1944DCD-E998-4ECA-AB6A-DCD83CCBA16D}\\InProCServer32\\\"Default" }, { "category": "Persistence mechanism", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "regkey", "uuid": "a24bbb5c-ac9d-4aa2-9b98-6189d06a6a4e", "value": "HKCU\\Software\\Classe\\CLSS\\{D1944DCD-E998-4ECA-AB6A-DCD83CCB16D}\\InProCServer32\\ThreadingModel" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770211390", "to_ids": false, "type": "filename", "uuid": "47c59520-0010-4d87-8952-a73a0b3f2eef", "value": "schtasks.exe" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770038522", "to_ids": true, "type": "filename", "uuid": "78de6173-0787-41cb-9ded-4c314608ce40", "value": "%TMP%\\Diagnoscopeffice.xml" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770211387", "to_ids": false, "type": "filename", "uuid": "72f66d3e-1b44-47d8-92f1-46dfdec51d9b", "value": "explorer.exe" } ], "Object": [ { "comment": "", "deleted": false, "description": "Report object to describe a report along with its metadata.", "meta-category": "misc", "name": "report", "template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df", "template_version": "8", "timestamp": "1770035022", "uuid": "090375a1-1841-42ca-ba85-fcb9a808adda", "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "link", "timestamp": "1770034998", "to_ids": false, "type": "link", "uuid": "eaf47489-a8eb-4e9e-a19b-78b96c5f64a5", "value": "https://cert.gov.ua/article/6287250" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "title", "timestamp": "1770034998", "to_ids": false, "type": "text", "uuid": "c5b4652f-7134-4021-bffa-146f21f3a8f8", "value": "\"\u0411\u044e\u043b\u0435\u0442\u0435\u043d\u044c \u043d\u0435\u0431\u0435\u0437\u043f\u0435\u043a\u0438\": UAC-0001 (APT28) \u0437\u0434\u0456\u0439\u0441\u043d\u044e\u0454 \u043a\u0456\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 \u0443 \u0432\u0456\u0434\u043d\u043e\u0448\u0435\u043d\u043d\u0456 \u0423\u043a\u0440\u0430\u0457\u043d\u0438 \u0442\u0430 \u043a\u0440\u0430\u0457\u043d \u0404\u0421 \u0437 \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u0430\u043d\u043d\u044f\u043c \u0435\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 CVE-2026-21509 (CERT-UA#19542)" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "title", "timestamp": "1770035022", "to_ids": false, "type": "text", "uuid": "09da3972-cbfd-4725-84ad-a682b9079a84", "value": "\"Hanger Bulletin\": UAC-0001 (APT28) carries out cyberattacks against Ukraine and EU countries using the exploit CVE-2026-21509 (CERT-UA#19542)" } ] }, { "comment": "", "deleted": false, "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", "meta-category": "vulnerability", "name": "vulnerability", "template_uuid": "81650945-f186-437b-8945-9f31715d32da", "template_version": "9", "timestamp": "1770035237", "uuid": "9519a6c9-53f4-4854-abe9-8a22738d07af", "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "id", "timestamp": "1770035237", "to_ids": false, "type": "vulnerability", "uuid": "31630cac-c351-4600-bca5-c9358b49131c", "value": "CVE-2026-21509" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770036945", "uuid": "3d3b8036-64b5-4e4d-8587-39d0be7bf0f2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "filename", "timestamp": "1770036945", "to_ids": true, "type": "filename", "uuid": "c6b53c6e-76af-4a86-851d-5e739332e55d", "value": "BULLETEN_H.doc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770036945", "to_ids": true, "type": "md5", "uuid": "20a357e6-125c-4c0b-813f-25dd093ceb69", "value": "7c396677848776f9824ebe408bbba943" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770036945", "to_ids": true, "type": "sha256", "uuid": "8883b1f7-d95e-423e-80e1-00258dca6018", "value": "c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037068", "uuid": "dff65837-48eb-4c26-af2f-2934c9ec1ad1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "filename", "timestamp": "1770037068", "to_ids": true, "type": "filename", "uuid": "04af6099-7701-4a39-9cdd-43db00706d5e", "value": "SplashScreen.png" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037068", "to_ids": true, "type": "md5", "uuid": "3ea88fb2-28c1-40bb-8dc4-a25bb9241289", "value": "418dc7365e78f79ef7dfcfbfe1bc8b0e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037068", "to_ids": true, "type": "sha256", "uuid": "2bccc36f-b6a2-4555-8de2-847f798a7562", "value": "c4389cc34b672c4f885547f413bf38575e6ee2b23a0ddfdd306a69c1775db6fc" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770036996", "uuid": "1020336a-e5b8-40ea-8c8f-2dee7959b06b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "filename", "timestamp": "1770036996", "to_ids": true, "type": "filename", "uuid": "e6bd8ab3-493f-4040-92a2-7ac22f65c85d", "value": "EhSutterShell.dll" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770036996", "to_ids": true, "type": "md5", "uuid": "33a6e4bf-414e-44d2-b782-65256fbd16b3", "value": "4423b8f3456e54eb48dfbde0b4c7984b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770036996", "to_ids": true, "type": "sha256", "uuid": "6eb67068-06d9-4f01-ba7e-20bfc3bee1b0", "value": "52b6fb40e7efb09c2bebe8550178e7e30009600bdedd1acae085d753761b7598" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037146", "uuid": "2a329860-0cd0-47f9-9f44-86528a49bc2d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037146", "to_ids": true, "type": "filename", "uuid": "16c36603-6f6c-4e0d-a34d-1f82fb7dac82", "value": "document.doc.LnK" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037146", "to_ids": true, "type": "md5", "uuid": "9e7fc14b-3c3b-4a97-98d1-a77ce195766d", "value": "d8e880975ab01c745386663409a9d3aa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037146", "to_ids": true, "type": "sha256", "uuid": "02f096ef-3376-4216-8d09-c6bad85318ae", "value": "b2e771cbfa0a74d0774db162d28c1eecd3a7cb384dfe97522e9baabd1c04d304" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037214", "uuid": "14efd763-758a-4da7-84de-e39a3021780d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037214", "to_ids": true, "type": "filename", "uuid": "bdcda72d-eaa5-44ac-a680-937683f9cec7", "value": "s.d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037214", "to_ids": true, "type": "md5", "uuid": "06e2ce18-1408-4938-858e-558a7c878e1e", "value": "744bbe8d7c3d0421fa0deb582481f5ba" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037214", "to_ids": true, "type": "sha256", "uuid": "eca6c224-2bc9-449b-80bb-9aa68aa6ace1", "value": "8c1dc9732884c6078b23953b78314a8d0d8b8d9fe42e5f97a7cd09b8ace943a9" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037271", "uuid": "4a9b0757-96a4-4226-9664-9e792b5f3778", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037271", "to_ids": true, "type": "filename", "uuid": "ab1cf560-28ff-4169-83f9-b1731c151828", "value": "SplashScreen_shellcode.bin" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037271", "to_ids": true, "type": "md5", "uuid": "ab6725d9-412a-42ed-93b7-7143b48da7cd", "value": "331e055e6a519d443233bd740dbfe8ee" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037271", "to_ids": true, "type": "sha256", "uuid": "e7e62645-ab6f-4b65-ab79-f4f7b4daeab2", "value": "495cf3fd22d4fc2c6c86b689b68141ac7d0130b0bb5cbc834ef59275132ee5c2" } ] }, { "comment": "COVENANT", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037384", "uuid": "706830da-361b-4c78-b7fc-9c9c2b085b62", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037384", "to_ids": true, "type": "filename", "uuid": "d07a83b3-5bb7-4cf8-9e01-7663dde3f26e", "value": "covenant.dll" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037367", "to_ids": true, "type": "md5", "uuid": "7216d246-d934-4a48-bb31-439ed7c9d5f0", "value": "6f528ad405bffa4a8c2f61b1fa2172fd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037367", "to_ids": true, "type": "sha256", "uuid": "22ed991b-3006-4ace-b783-6f444f083dd4", "value": "40c2e559992a7f595c593b419930a3f216516c3042ad86fb985348d53b6e01b9" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037457", "uuid": "5d77bbbb-6a9c-487b-9a2c-c0602e9d2ec9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037457", "to_ids": true, "type": "filename", "uuid": "d81e9596-822e-466a-9d20-9dcd2bb98a9f", "value": "office.xml" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037457", "to_ids": true, "type": "md5", "uuid": "43542211-a2e4-4661-b4d5-725c55b493f8", "value": "ee0b44346db028a621d1dec99f429823" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037457", "to_ids": true, "type": "sha256", "uuid": "f6c12468-ce77-41ae-a34e-976979a44a30", "value": "9f4672c1374034ac4556264f0d4bf96ee242c0b5a9edaa4715b5e61fe8d55cc8" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037521", "uuid": "80ed5178-f8cf-49d9-8887-48cc0b85fb33", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037521", "to_ids": true, "type": "filename", "uuid": "28150e1d-7efe-4fb6-9f05-92363b9618c7", "value": "4727582023cd8071a6f388ea3ba2feaa.doc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037521", "to_ids": true, "type": "md5", "uuid": "059c4de1-72f1-42d5-ba08-05822c5ac819", "value": "4727582023cd8071a6f388ea3ba2feaa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037521", "to_ids": true, "type": "sha256", "uuid": "1c05c15b-c913-4fa3-bcc0-b71e3e593c51", "value": "5a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037582", "uuid": "78e51c7b-b3b3-48a0-b9a1-d603c16c39a6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037582", "to_ids": true, "type": "filename", "uuid": "392614e4-026d-4e2e-949e-04a1e106335d", "value": "Consultation_Topics_Ukraine(Final).doc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037582", "to_ids": true, "type": "md5", "uuid": "8c5fc44e-5f95-4bd9-b3ab-651f61a8386d", "value": "95e59536455a089ced64f5af2539a449" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037582", "to_ids": true, "type": "sha256", "uuid": "cca721f1-e8d6-4256-9f5c-677616b4dcc9", "value": "b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037829", "uuid": "d426a89d-6fd7-4205-b333-3a3886720000", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037829", "to_ids": true, "type": "filename", "uuid": "f12b71f5-7cc3-4198-97de-17b1e05ca104", "value": "1291.doc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037829", "to_ids": true, "type": "md5", "uuid": "51e25b29-c3d1-415e-b308-3f675f94047f", "value": "d47261e52335b516a777da368208ee91" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037829", "to_ids": true, "type": "sha256", "uuid": "b44cdee4-1ee8-4911-aad9-2c888ae9d455", "value": "fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770037953", "uuid": "277f77d9-b213-478a-addb-41cba5774d25", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770037953", "to_ids": true, "type": "filename", "uuid": "2f24ee70-90fb-4f9b-af11-b8c86bc76c2c", "value": "1301.doc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770037953", "to_ids": true, "type": "md5", "uuid": "a040eefc-4db5-46ee-8cc8-d347639d3389", "value": "b6a86f44d0a3fa5a5ac979d691189f2d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770037953", "to_ids": true, "type": "sha256", "uuid": "f8f932a7-9d88-4b32-87fe-add8b7c6b9c9", "value": "969d2776df0674a1cca0f74c2fccbc43802b4f2b62ecccecc26ed538e9565eae" } ] }, { "comment": "CVE-2026-21509: Enriched via the vulnerability_lookup module", "deleted": false, "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", "meta-category": "vulnerability", "name": "vulnerability", "template_uuid": "81650945-f186-437b-8945-9f31715d32da", "template_version": "9", "timestamp": "1770211076", "uuid": "e5595dff-589f-4ebf-aec2-9e0834223fa5", "ObjectReference": [ { "comment": "", "object_uuid": "e5595dff-589f-4ebf-aec2-9e0834223fa5", "referenced_uuid": "9519a6c9-53f4-4854-abe9-8a22738d07af", "relationship_type": "related-to", "timestamp": "1770211076", "uuid": "0bb4600d-c13b-4df6-96e4-a695a1164331" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "references", "timestamp": "1770211076", "to_ids": false, "type": "link", "uuid": "ee21d4f5-2ac3-4777-9bdc-37a1ede044fb", "value": "https://vulnerability.circl.lu/vuln/CVE-2026-21509" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "id", "timestamp": "1770211076", "to_ids": false, "type": "vulnerability", "uuid": "d3ee859f-4dbd-4e5d-9eaa-d1ff10b9ce39", "value": "CVE-2026-21509" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "published", "timestamp": "1770211076", "to_ids": false, "type": "datetime", "uuid": "7c74a6f0-8940-4ae0-929b-f567de976fde", "value": "2026-01-26T17:06:35.512000+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "modified", "timestamp": "1770211076", "to_ids": false, "type": "datetime", "uuid": "922ede51-80b9-4eda-8e95-6396325fffec", "value": "2026-01-30T03:40:07.406000+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1770211076", "to_ids": false, "type": "text", "uuid": "ff275a7a-81a9-4e49-826a-92433e52ad7a", "value": "PUBLISHED" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "references", "timestamp": "1770211076", "to_ids": false, "type": "link", "uuid": "c36f6669-afc4-4ec0-a67b-b7ea1ce9314d", "value": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211216", "uuid": "34d5741e-e09f-41e3-a52a-82d94b04c958", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211216", "to_ids": true, "type": "url", "uuid": "18b09aa2-a9ba-4d79-9f8b-a1dc65f20bbc", "value": "http://freefoodadid.c/davwwwroot/2_2.lNk?" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "1932078d-ba95-43e6-96ee-41b031777f67", "value": "c" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "4f3badb3-12d7-4f7c-b9d7-be7c93b8aee8", "value": "/davwwwroot/2_2.lNk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "94d6367f-1bbd-493e-90af-1712a640b420", "value": "freefoodadid" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211216", "uuid": "d2715714-dbff-4449-9d12-26e9f60e1016", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211216", "to_ids": true, "type": "url", "uuid": "0ee12386-039a-4d2a-becb-ff206504a68b", "value": "http://freefoodid.com/documents/2_2.lNk?" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "69a6cf23-b2fb-4433-a882-b95e3d6f11fc", "value": "com" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "5bb9a669-ef1c-4a23-be07-5382a55520be", "value": "/documents/2_2.lNk" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "host", "timestamp": "1770211216", "to_ids": true, "type": "hostname", "uuid": "5bed3877-6f0f-4ac7-b769-e9d97fe10bca", "value": "freefoodid.com" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "97089b5f-bf2e-4b06-a2e2-301122967d8f", "value": "freefoodid" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1770211216", "to_ids": true, "type": "domain", "uuid": "048b1cc7-aa96-45f8-b19c-7fde572ec7a9", "value": "freefoodid.com" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211216", "uuid": "53f57ddf-786b-44b8-9db6-1746fcbe79f3", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211216", "to_ids": true, "type": "url", "uuid": "0fbe8ee2-3b41-4a4c-8b17-8c3ce979c1e3", "value": "https://wellnesscaremed.com/buch/Downloads/document.doc.LnK?" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "daf7ccb6-c9b8-4632-a638-c17cd60c757c", "value": "com" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "4f3785ef-190d-487b-bf1d-4af119575b54", "value": "/buch/Downloads/document.doc.LnK" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "host", "timestamp": "1770211216", "to_ids": true, "type": "hostname", "uuid": "ad6ce9e0-a89a-4da7-bf8f-307f194daca1", "value": "wellnesscaremed.com" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "ef82bffc-3dcb-4593-96ba-7f2682b98b0d", "value": "wellnesscaremed" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1770211216", "to_ids": true, "type": "domain", "uuid": "ddec7a16-14cd-4b62-acba-ce9f70c24fa6", "value": "wellnesscaremed.com" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211216", "uuid": "8e4795b1-2034-4286-8822-e3c3d958de5d", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211216", "to_ids": true, "type": "url", "uuid": "a7c85ad6-b507-4eee-be83-e7979297cf2f", "value": "http://wellnesscaremed.com/buch/Downloads/document.doc.LnK?" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "c860103f-3e0a-49a0-a3c6-5b16a8820da7", "value": "com" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "fc6fb41b-22d7-45d0-8fc4-9009c43e9d64", "value": "/buch/Downloads/document.doc.LnK" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "host", "timestamp": "1770211216", "to_ids": true, "type": "hostname", "uuid": "6047cee3-6df0-45bd-9872-ee5a7ccebd07", "value": "wellnesscaremed.com" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "f66d8919-44c8-40b6-b0b4-098b205d25b1", "value": "wellnesscaremed" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1770211216", "to_ids": true, "type": "domain", "uuid": "54e7eb15-2ddf-490e-bfed-754aa359458c", "value": "wellnesscaremed.com" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211216", "uuid": "d49bd8b6-1788-44f3-b19a-85bbf571301a", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211216", "to_ids": true, "type": "url", "uuid": "f3f3a0e1-29ee-45a3-83c5-c1f28470c99d", "value": "https://wellnessmedcare.org/davwwwroot/cz/Downloads/document.LnK?" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "0290fc06-9e80-4bc7-ac2b-ed5ee225ab45", "value": "org" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "b6ee65e2-8543-4ba8-b08a-b9f10231e978", "value": "/davwwwroot/cz/Downloads/document.LnK" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "host", "timestamp": "1770211216", "to_ids": true, "type": "hostname", "uuid": "0429578b-5467-4759-a630-5516c6e1c3db", "value": "wellnessmedcare.org" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "37947bbd-0efd-44c1-9cb1-08231d3afbab", "value": "wellnessmedcare" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1770211216", "to_ids": true, "type": "domain", "uuid": "2d75a754-063c-45ef-85bc-d3ef2bfc45d0", "value": "wellnessmedcare.org" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211216", "uuid": "e4326e5a-b89c-45b4-9f83-df28e20cca40", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211216", "to_ids": true, "type": "url", "uuid": "e0cde3d2-7a63-462a-8974-2b1b8bc95117", "value": "http://wellnessedcare.org/davwwwroot/cz/Downloads/document.LnK?" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "a2403446-3ec8-4c8a-98c2-1d88ca0fd6f0", "value": "org" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "cf645f44-0307-44f3-a079-a126153696e4", "value": "/davwwwroot/cz/Downloads/document.LnK" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "host", "timestamp": "1770211216", "to_ids": true, "type": "hostname", "uuid": "c54d8ff2-cba7-4863-b267-f4ad2ddb35b3", "value": "wellnessedcare.org" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "96ca0397-1ed8-4193-b47c-36aff6da156b", "value": "wellnessedcare" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1770211216", "to_ids": true, "type": "domain", "uuid": "8e495b4c-77d9-4a6f-abfc-a72e90f622b4", "value": "wellnessedcare.org" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211216", "uuid": "2741fb4d-baad-48d0-87b2-e2a09c93adc0", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211216", "to_ids": true, "type": "url", "uuid": "3950e821-7081-4702-b1de-6f2d3fdde837", "value": "https://wellnessedcare.org/davwwwroot/pol/Downloads/document.LnK?" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "55ebf2f7-7e1d-4463-bf7b-2d40825913a5", "value": "org" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "7e64fe71-ff4c-4303-a9af-3e03551c942c", "value": "/davwwwroot/pol/Downloads/document.LnK" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "host", "timestamp": "1770211216", "to_ids": true, "type": "hostname", "uuid": "252d74e2-f3f3-4565-8d00-6c2a14113c31", "value": "wellnessedcare.org" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "8f3dfa9d-3ef3-4190-831c-4c0569d597f4", "value": "wellnessedcare" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1770211216", "to_ids": true, "type": "domain", "uuid": "ae068836-23dc-402a-aa89-5c5b54684ea7", "value": "wellnessedcare.org" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211216", "uuid": "829a3c72-8d08-4cf8-b18b-5e6b49ee3cc9", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211216", "to_ids": true, "type": "url", "uuid": "3a1d6c9e-f3a4-4ecb-890f-7b173763f6c6", "value": "http://wellnessedcare.org/davwwwroot/pol/Downloads/document.LnK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "85d115ce-1454-4a3c-8c00-11fa26f62367", "value": "org" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "b260fc1b-bca0-407f-ad1e-7f37871c676c", "value": "/davwwwroot/pol/Downloads/document.LnK" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "host", "timestamp": "1770211216", "to_ids": true, "type": "hostname", "uuid": "21473e41-b22b-47ad-9992-cf4db3d57402", "value": "wellnessedcare.org" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211216", "to_ids": false, "type": "text", "uuid": "b4e2f22c-6060-49cb-97ab-24adf4580b94", "value": "wellnessedcare" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1770211216", "to_ids": true, "type": "domain", "uuid": "cb5da0fd-3df7-4947-948c-42a291bd58cc", "value": "wellnessedcare.org" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211300", "uuid": "25a03202-7f8a-4715-af2f-5f83f6ddab4a", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211300", "to_ids": true, "type": "url", "uuid": "657ff82c-9d5a-4772-a0fc-4f1eca2746cc", "value": "smb://freefoodid.com/documents/template_2_2.doc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "b87f813e-a222-4b9f-bdee-dab4fdf744c2", "value": "com" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "453dec0d-9e2e-4017-8c97-ac311aff514f", "value": "/documents/template_2_2.doc" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "host", "timestamp": "1770211300", "to_ids": true, "type": "hostname", "uuid": "11fc9164-9c30-4d00-bad7-b9b3cbaddd87", "value": "freefoodid.com" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "b3bc203f-6949-4cb5-91c4-8cafdfa9b64e", "value": "freefoodid" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain", "timestamp": "1770211300", "to_ids": true, "type": "domain", "uuid": "cc614f4b-e57c-4fe7-a0c8-66a56bb41dc1", "value": "freefoodid.com" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211300", "uuid": "56832471-a9f2-4c34-b932-98e586956b60", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211300", "to_ids": true, "type": "url", "uuid": "fe3b29a9-6c81-4823-97d0-bbfe63abea29", "value": "smb://wellnesscaremed.c/davwwwroot/buch/Downloads/blank.doc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "bf68f0e5-649a-43bc-9da2-0f830fa4e80c", "value": "c" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "24fbb098-dea3-4c46-a9e1-1edfbd9c04d2", "value": "/davwwwroot/buch/Downloads/blank.doc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "domain_without_tld", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "b0bdc87b-4e7d-4dd4-84ad-65f66968bb3f", "value": "wellnesscaremed" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211300", "uuid": "6bd8efbe-9df6-4647-94fc-196743e71ad6", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211300", "to_ids": true, "type": "url", "uuid": "27700748-aced-4c6d-b7f0-e9480a75940a", "value": "smb://wellnessmedcare.org@sl/cz/Downloads/blank.doc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "4a9f3cc9-ccc1-4c49-ab74-57d7f5e53ef1", "value": "sl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "bc359870-7b9a-4057-a093-709430bdc850", "value": "/cz/Downloads/blank.doc" } ] }, { "comment": "Enriched via the url_import module", "deleted": false, "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.", "meta-category": "network", "name": "url", "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5", "template_version": "10", "timestamp": "1770211300", "uuid": "a50529b9-34f8-4e8e-b371-8b8719b41546", "Attribute": [ { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "url", "timestamp": "1770211300", "to_ids": true, "type": "url", "uuid": "1e0d881e-1287-403e-91a8-ca959d5984ba", "value": "smb://wellnessedcare.org@sl/pol/Downloads/blank.doc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "tld", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "df20dd2d-3c8a-4fde-8f4f-c3cd3e30de9b", "value": "sl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "resource_path", "timestamp": "1770211300", "to_ids": false, "type": "text", "uuid": "02080483-a6d9-4edd-9399-8dea155aec90", "value": "/pol/Downloads/blank.doc" } ] } ], "EventReport": [ { "name": "Event report (1770211313)", "content": "## \"Hanger Bulletin\": UAC-0001 (APT28) carries out cyberattacks against Ukraine and EU countries using the exploit CVE-2026-21509 (CERT-UA#19542)\n - *Date*: 2026-02-01\n - *Last update*: 2026-02-04 13:21:40\n - *Threat level*: Undefined\n - *Attribute count*: 152\n#### Tags\n - @[tag](type:OSINT)\n - @[tag](osint:lifetime=\"perpetual\")\n - @[tag](osint:certainty=\"50\")\n - @[tag](tlp:white)\n - @[tag](tlp:clear)\n#### Galaxies\n - *Name*: Microsoft Activity Group actor\n - *Description*: Activity groups as described by Microsoft\n - @[tag](misp-galaxy:microsoft-activity-group=\"STRONTIUM\")\n - *Name*: Enterprise Attack - Intrusion Set\n - *Description*: Name of ATT&CK Group\n - @[tag](misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28 - G0007\")\n - *Name*: Intrusion Set\n - *Description*: Name of ATT&CK Group\n - @[tag](misp-galaxy:mitre-intrusion-set=\"APT28 - G0007\")\n - *Name*: Mobile Attack - Intrusion Set\n - *Description*: Name of ATT&CK Group\n - @[tag](misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28\")\n - @[tag](misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28 - G0007\")\n - *Name*: Pre Attack - Intrusion Set\n - *Description*: Name of ATT&CK Group\n - @[tag](misp-galaxy:mitre-pre-attack-intrusion-set=\"APT28 - G0007\")\n - *Name*: Threat Actor\n - *Description*: Threat actors are characteristics of malicious actors (or adversaries) representing a cyber attack threat including presumed intent and historically observed behaviour.\n - @[tag](misp-galaxy:threat-actor=\"Sofacy\")\n#### Correlations\n - \"Danger Bulletin\": UAC-0001 (APT28) carries out cyberattacks against Ukraine and EU countries using the CVE-2026-21509 exploit (CERT-UA#19542)\n - CVE-2026-21509 \u0432 \u0440\u0443\u043a\u0430\u0445 UAC-0001 (CERT-UA#19542)\n - MalwareBazaar malware samples for 2024-05-21\n - Mixed IOCs, Week 27\n - Mixed IOCs, Week 25\n - RegretLocker - VMRay Analyzer Report for Sample #1500977\n - 'Blahfoobar'\n### Objects\n - @[object](090375a1-1841-42ca-ba85-fcb9a808adda)\n - @[object](9519a6c9-53f4-4854-abe9-8a22738d07af)\n - @[object](3d3b8036-64b5-4e4d-8587-39d0be7bf0f2)\n - @[object](dff65837-48eb-4c26-af2f-2934c9ec1ad1)\n - @[object](1020336a-e5b8-40ea-8c8f-2dee7959b06b)\n - @[object](2a329860-0cd0-47f9-9f44-86528a49bc2d)\n - @[object](14efd763-758a-4da7-84de-e39a3021780d)\n - @[object](4a9b0757-96a4-4226-9664-9e792b5f3778)\n - @[object](706830da-361b-4c78-b7fc-9c9c2b085b62)\n - @[object](5d77bbbb-6a9c-487b-9a2c-c0602e9d2ec9)\n - @[object](80ed5178-f8cf-49d9-8887-48cc0b85fb33)\n - @[object](78e51c7b-b3b3-48a0-b9a1-d603c16c39a6)\n - @[object](d426a89d-6fd7-4205-b333-3a3886720000)\n - @[object](277f77d9-b213-478a-addb-41cba5774d25)\n - @[object](e5595dff-589f-4ebf-aec2-9e0834223fa5)\n - @[object](34d5741e-e09f-41e3-a52a-82d94b04c958)\n - @[object](d2715714-dbff-4449-9d12-26e9f60e1016)\n - @[object](53f57ddf-786b-44b8-9db6-1746fcbe79f3)\n - @[object](8e4795b1-2034-4286-8822-e3c3d958de5d)\n - @[object](d49bd8b6-1788-44f3-b19a-85bbf571301a)\n - @[object](e4326e5a-b89c-45b4-9f83-df28e20cca40)\n - @[object](2741fb4d-baad-48d0-87b2-e2a09c93adc0)\n - @[object](829a3c72-8d08-4cf8-b18b-5e6b49ee3cc9)\n - @[object](25a03202-7f8a-4715-af2f-5f83f6ddab4a)\n - @[object](56832471-a9f2-4c34-b932-98e586956b60)\n - @[object](6bd8efbe-9df6-4647-94fc-196743e71ad6)\n - @[object](a50529b9-34f8-4e8e-b371-8b8719b41546)\n### Attributes\n - @[attribute](d8aec450-e7bd-407b-bcce-f80d75fd261b)\n - @[attribute](cef914c2-635e-437d-9ad1-1bb96a410092)\n - @[attribute](32b27a79-f7e7-40f0-8888-54cddd36fb58)\n - @[attribute](6d39052f-3baa-4435-b7cb-ae3d18df3b03)\n - @[attribute](187362da-2126-4676-aa23-7e651f021ffb)\n - @[attribute](e4c52092-b7ab-4979-b508-7480223468f4)\n - @[attribute](be1fca8e-4c61-45ec-a36f-134ad26702dd)\n - @[attribute](5424b9c7-f191-4cc1-a90f-c236a44ac607)\n - @[attribute](ad4fe3fc-9059-4cd9-870c-dc3dc0772fa5)\n - @[attribute](3c1115ad-73e7-4e19-9623-dc4ea9461aa6)\n - @[attribute](5b684bac-c06f-4fc9-ab38-831aecfd7405)\n - @[attribute](df11c50e-c299-47e0-893c-3ff420d41716)\n - @[attribute](e6bd28e8-aab7-4b34-808a-aecbb2951bc3)\n - @[attribute](690fe64d-118a-469c-92de-8f98c8ed87a9)\n - @[attribute](fd82c0d1-8525-43c3-9784-69e224f3b86e)\n - @[attribute](c33ea50b-890a-4c59-9a29-37082ae1aca5)\n - @[attribute](44d1120b-fc92-4788-b533-cad60f74152c)\n - @[attribute](6c27f5e4-af4c-4913-9956-f67b677033d9)\n - @[attribute](baeabc54-046e-4c17-9a54-b6bbd094bb33)\n - @[attribute](48b86542-1ffc-44a7-a46a-1c15e5e3a91f)\n - @[attribute](d3bbd4bb-ae31-499a-a6b7-a93cfc708997)\n - @[attribute](99f99b92-a988-4e7f-91b8-b27342072efb)\n - @[attribute](d52ac061-b0b8-4c93-bc48-41c288319b9b)\n - @[attribute](8c8d0ca0-96b5-493f-a633-22ca25b5aee3)\n - @[attribute](a739bea6-623f-462b-958f-7abe8e284583)\n - @[attribute](37317eb2-73ef-40c0-98c2-abc07b6f612a)\n - @[attribute](dbe731d3-7dcd-4a40-9a86-aee53f8097d2)\n - @[attribute](24a34997-3028-47cb-b227-075b414e8708)\n - @[attribute](3066dc01-292a-4112-990e-47a2c52aa729)\n - @[attribute](616f0957-b8a0-485e-98ee-36f8cd648e07)\n - @[attribute](6eb11caa-0bcd-4c95-97c5-2fb0b8a0cf9e)\n - @[attribute](c13e40e9-e6d8-4d24-93fe-2d197a98bdf6)\n - @[attribute](0b9ab30d-fa9e-4b4e-b6bb-bef8d7f0c31f)\n - @[attribute](53021ffe-49ca-400d-ae28-ec87ffb7dea0)\n - @[attribute](72e671a4-69a3-4679-bc88-2e2e7f31cbca)\n - @[attribute](2bd45767-ccd0-4f74-bcd6-e75042de327a)\n - @[attribute](1c6ef1c7-37f2-4c02-a557-212f64cbf011)\n - @[attribute](1d29c766-7c19-437e-8c4b-1ac88929c27a)\n - @[attribute](473841f3-7f59-4d79-b805-9f84f741fefd)\n - @[attribute](e77da6d5-9f54-47ca-9fd2-ceb398b48858)\n - @[attribute](a24bbb5c-ac9d-4aa2-9b98-6189d06a6a4e)\n - @[attribute](47c59520-0010-4d87-8952-a73a0b3f2eef)\n - @[attribute](78de6173-0787-41cb-9ded-4c314608ce40)\n - @[attribute](72f66d3e-1b44-47d8-92f1-46dfdec51d9b)\n### ATT&CK Matrix\n@[galaxymatrix](c4e851fa-775f-11e7-8163-b774922098cd)", "id": "2202", "event_id": "407085", "timestamp": "1770211313", "uuid": "9383afb9-bfef-443d-a01c-aeb128f8c16b", "deleted": false } ] } }