{
  "Event": {
    "analysis": "1",
    "date": "2026-04-06",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-06",
    "publish_timestamp": "1775505730",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1775505707",
    "uuid": "e16fa7b3-35d5-44a6-8274-439e29874a95",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T23:12:06.900630+00:00",
        "timestamp": "1775430728",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0af7c85b-9f66-43f5-b512-313f14770228",
        "value": "181.224.67.68",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-06T01:24:44.373369+00:00",
        "timestamp": "1775438686",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "182607c5-eaf6-4617-97bf-63d6e6e6c82a",
        "value": "15.220.169.114",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-06T01:25:21.376162+00:00",
        "timestamp": "1775438723",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cdf33b94-fce4-4418-be6b-f1e69cc37e2d",
        "value": "103.61.252.206",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN FTPSync Settings Disclosure Attempt",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-06T02:17:15.199792+00:00",
        "timestamp": "1775441837",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "27686261-6a30-4c5e-bd47-1a665a2a92bf",
        "value": "70.153.25.65",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-06T05:03:38.423393+00:00",
        "timestamp": "1775451820",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "52e47d95-8edb-4721-812c-a4a82223878a",
        "value": "178.16.52.80",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-06T08:54:32.402134+00:00",
        "timestamp": "1775465673",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "096b46a0-9f5d-4930-b9aa-619a8ad65490",
        "value": "125.209.235.170",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-06T18:39:49.712391+00:00",
        "timestamp": "1775500791",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "15516be5-ab21-4851-b5c6-9a664d39938a",
        "value": "111.90.182.75",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-06T20:01:45.545154+00:00",
        "timestamp": "1775505707",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "327d1017-42ab-4653-9eee-f48fc38b7516",
        "value": "45.148.10.174",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}