{ "Event": { "analysis": "0", "date": "2026-01-29", "extends_uuid": "", "info": "Disrupting the World's Largest Residential Proxy Network", "publish_timestamp": "1770211510", "published": true, "threat_level_id": "4", "timestamp": "1770211493", "uuid": "f7c90110-c01f-4d3c-81ac-a92e4fb45e2b", "Orgc": { "name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#809daf", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Use Alternate Authentication Material - T1550\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"One-Way Communication - T1102.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": "" }, { "colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770017271", "to_ids": false, "type": "vulnerability", "uuid": "69a45355-6861-4eb4-854e-669ddbe77f51", "value": "CVE-2025-55182" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770017271", "to_ids": false, "type": "vulnerability", "uuid": "6613cbc6-5680-4030-a910-896b5803fa26", "value": "CVE-2025-8088" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "51ee9660-a2e8-45a4-ac9b-7b41a093cbca", "value": "00857cca77b615c369f48ead5f8eb7f3.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "e9532b23-35ca-4a9b-af88-728843dcd618", "value": "3k7m1n9p4q2r6s8t0v5w2x4y6z8u9.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "150c0945-69b4-42c7-84cb-70c4d6136f16", "value": "6b86b273ff34fce1.online" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "25d90475-9ec9-4192-a37d-e18c04048ac3", "value": "8f00b204e9800998.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "5991226b-c0e4-4174-bdcd-34ee92e73ee3", "value": "a7b37115ce3cc2eb.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "1bd92c70-4d24-475d-b727-a14cd85c8192", "value": "e4f8c1b9a2d7e3f6c0b5a8d9e2f1c4d.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "4a23cfd3-5833-45bc-bf99-644b2df6b1e5", "value": "0aa0cf0637d66c0d.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "080a8452-bc84-45b2-8f04-7d21be9fabe1", "value": "31d58c226fc5a0aa976e13ca9ecebcc8.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "8dec4d34-39f3-4dea-9a05-e62fcb166930", "value": "442fe7151fb1e9b5.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "0ac99b95-eaf5-4d9d-a0cf-64d4e5ca1fd5", "value": "7x2k9n4p1q0r5s8t3v6w0y2z4u7b9.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "47eda920-bcb2-4314-8a8c-888cf38179f5", "value": "8b21a945159f23b740c836eb50953818.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "6ce17c60-e059-46bd-988a-2ea66d30766a", "value": "a8d3b9e1f5c7024d6e0b7a2c9f1d83e5.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "d06b56e9-f109-476f-9e2d-4f5dfe5780e6", "value": "aa86a52a98162b7d.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "a0a1b0ce-8a05-42a5-906a-c9a871110d8f", "value": "af4760df2c08896a9638e26e7dd20aae.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "c9371639-9cd2-46ae-be0a-ea67fab04a1f", "value": "b5e9a2d7f4c8e3b1a0d6f2e9c5b8a7d.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "b7dd902d-be88-4e89-92c9-c2199292e06e", "value": "bdrv7wlbszfotkqf.uk" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "74137b3c-6c2b-4c2c-a91c-6a0b5a8c5051", "value": "cfe47df26c8eaf0a7c136b50c703e173.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "ebb08117-c37e-48d4-94fd-67337d3aef9b", "value": "hexsdk.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "9c52dd36-4c44-4f58-8c70-e3557ccbd260", "value": "packetsdk.io" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "8814129d-c736-4b74-a56e-3036db4fbb5a", "value": "packetsdk.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "d648e98c-3bc5-439c-83b8-71f89597a163", "value": "packetsdk.xyz" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "660f0633-db70-4101-9362-f885ae868d2d", "value": "v46wd6uramzkmeeo.in" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770019680", "to_ids": true, "type": "domain", "uuid": "38b75de8-696c-45de-b399-54368a753a65", "value": "willmam.com" } ], "Object": [ { "comment": "", "deleted": false, "description": "Report object to describe a report along with its metadata.", "meta-category": "misc", "name": "report", "template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df", "template_version": "8", "timestamp": "1770016640", "uuid": "3c108fea-de99-4e80-86e8-1f7d47a7cb89", "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "link", "timestamp": "1770016640", "to_ids": false, "type": "link", "uuid": "37dace01-2377-4fb5-b65d-8627cf93e449", "value": "https://otx.alienvault.com/pulse/697ad713f6769b6ddf61162b/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "summary", "timestamp": "1770016640", "to_ids": false, "type": "text", "uuid": "f3bf5a3c-fff5-4d65-a96e-7faa15d2dd60", "value": "Google and partners took action to disrupt the IPIDEA proxy network, believed to be one of the largest residential proxy networks globally. The operation involved legal action to take down control domains, sharing technical intelligence on IPIDEA software development kits, and implementing protections for Android users. IPIDEA's network enabled various malicious activities by routing traffic through residential IP addresses, making it difficult to detect and block. The network was built using SDKs embedded in applications, often without user knowledge. Google's analysis revealed connections between multiple proxy brands and SDKs controlled by the same actors. The disruption aimed to degrade IPIDEA's operations and protect consumers from security risks associated with residential proxies." }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "title", "timestamp": "1770016640", "to_ids": false, "type": "text", "uuid": "5daf9f1c-44e8-4da7-ad79-8f20c1fcbe44", "value": "Disrupting the World's Largest Residential Proxy Network" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "type", "timestamp": "1770016640", "to_ids": false, "type": "text", "uuid": "7857f5d4-3d72-4f74-8e27-1ae4826c0454", "value": "Report" } ] }, { "comment": "", "deleted": false, "description": "Report object to describe a report along with its metadata.", "meta-category": "misc", "name": "report", "template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df", "template_version": "8", "timestamp": "1770017208", "uuid": "cb36da03-4448-426c-9c05-842614037661", "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "link", "timestamp": "1770017208", "to_ids": false, "type": "link", "uuid": "e6f8dcd5-1c48-40fc-9794-8546423a8986", "value": "https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "summary", "timestamp": "1770017208", "to_ids": false, "type": "text", "uuid": "b0d76f0f-9e15-4e68-9b05-51ebeb63f664", "value": "This week Google and partners took action to disrupt what we believe is one of the largest residential proxy networks in the world, the IPIDEA proxy network. IPIDEA\u2019s proxy infrastructure is a little-known component of the digital ecosystem leveraged by a wide array of bad actors." }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "title", "timestamp": "1770017208", "to_ids": false, "type": "text", "uuid": "fb6c1df5-dd92-47c6-8029-6f5d0d69e0f6", "value": "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "type", "timestamp": "1770017208", "to_ids": false, "type": "text", "uuid": "b267fbd1-5076-4113-bf10-762b31bd94ce", "value": "Blog" } ] }, { "comment": " PEXE - PE32 executable (GUI) Intel 80386, for MS Windows ", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770018261", "uuid": "5e983077-b224-49b1-b8ca-02ca51a76d38", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770018035", "to_ids": true, "type": "sha256", "uuid": "294a284f-a6d1-4128-b349-6fbbafd3c0c9", "value": "01ac6012d4316b68bb3165ee451f2fcc494e4e37011a73b8cf2680de3364fcf4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770018035", "to_ids": true, "type": "md5", "uuid": "8700fb4e-0887-421a-8e1e-9563bde89199", "value": "306184f7c308d95da3bf169d9a615bcf" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770018035", "to_ids": true, "type": "sha1", "uuid": "1d062629-c0ca-41bf-984d-8a773bfd6941", "value": "f9060c09cbd328756f01d69b95498713ce1eff04" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "imphash", "timestamp": "1770018189", "to_ids": true, "type": "imphash", "uuid": "9b313bca-94d1-4bf6-8120-3a6a2a15dc9f", "value": "027ea80e8125c6dda271246922d4c3b0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "compilation-timestamp", "timestamp": "1770018035", "to_ids": false, "type": "datetime", "uuid": "f89ab686-af23-485b-b1df-de19ba768d88", "value": "2017-08-08T15:54:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770018035", "to_ids": false, "type": "size-in-bytes", "uuid": "803b9958-d8ef-478d-aa4b-d4b9e80ceb42", "value": "56358856" } ] }, { "comment": " PEXE - PE32 executable (GUI) Intel 80386, for MS Windows ", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770018236", "uuid": "89e8572c-bc67-40c7-9c94-95f8001b34c9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770018236", "to_ids": true, "type": "sha256", "uuid": "e1f73f43-d2e8-4a19-88d6-329431de7ed7", "value": "ba9b1f4cc2c7f4aeda7a1280bbc901671f4ec3edaa17f1db676e17651e9bff5f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770018236", "to_ids": true, "type": "md5", "uuid": "8564d017-f4a3-448e-9888-7175927ea420", "value": "b1523d2f5929296a5170a4d6c9db93c8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770018236", "to_ids": true, "type": "sha1", "uuid": "87439f73-d3d2-48b7-a221-2cd10c3faff7", "value": "173d2d8935d7df09c9f0e9a3976de3c6ab612106" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "imphash", "timestamp": "1770018236", "to_ids": true, "type": "imphash", "uuid": "a8779278-5f64-4677-b201-57b5f197fa5d", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770018236", "to_ids": false, "type": "size-in-bytes", "uuid": "e6efabd7-76a2-4f65-a180-43de3f4a6a46", "value": "24889336" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "compilation-timestamp", "timestamp": "1770018236", "to_ids": false, "type": "datetime", "uuid": "3b509658-3707-4b40-9848-3afc961979a0", "value": "2020-03-03T07:25:13+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770018288", "uuid": "bdaf9028-a20e-47e6-a953-8b109b009b40", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770018289", "to_ids": true, "type": "sha256", "uuid": "894b51f2-9f59-40f9-bdb7-04bcc64a7830", "value": "b0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5b" } ] }, { "comment": " PEXE - PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows ", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770018797", "uuid": "ba6759ed-89ac-4b42-bc76-7e62fb412462", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770018797", "to_ids": true, "type": "sha256", "uuid": "510a3076-cef0-436a-8c69-9647d2ff3dd5", "value": "aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770018797", "to_ids": true, "type": "md5", "uuid": "aef0c4f8-a8f9-42e2-84b5-ef1e52912c4d", "value": "fbb784dfe5712c4c0cc82a8b22e7287c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770018797", "to_ids": true, "type": "sha1", "uuid": "983158bd-0aee-4dee-949f-5c20536a4315", "value": "0f3aa9431d95f1f823bc341b83b5b3b716faa902" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "compilation-timestamp", "timestamp": "1770018797", "to_ids": false, "type": "datetime", "uuid": "bce04c71-b15a-4bd9-80a8-03f685b00d87", "value": "2083-10-10T20:34:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "imphash", "timestamp": "1770018797", "to_ids": true, "type": "imphash", "uuid": "c8bf1fb4-e7ca-4aa8-8d99-8c22082c43e4", "value": "dae02f32a21e03ce65412f6e56942daa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770018797", "to_ids": false, "type": "size-in-bytes", "uuid": "03a2f28e-bce0-48fb-8154-d9575e705602", "value": "75624" } ] }, { "comment": " PEXE - PE32 executable (GUI) Intel 80386, for MS Windows ", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770019090", "uuid": "f2bf06b3-11f1-4806-97a8-079ece803b29", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770019090", "to_ids": true, "type": "sha256", "uuid": "77163c86-de5c-44f4-b9a3-4710220e21b6", "value": "59cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770019090", "to_ids": true, "type": "md5", "uuid": "656694a0-9a18-41e2-8731-96a7a6ec6319", "value": "f252bf30e2635d9fed8fd3f54b2a0ddf" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770019090", "to_ids": true, "type": "sha1", "uuid": "c37b93f4-c0df-4627-85aa-dd56dab8b7e8", "value": "01b52f840d67fe9bc9120ba5499b0db99b9fcf6d" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "compilation-timestamp", "timestamp": "1770019090", "to_ids": false, "type": "datetime", "uuid": "0dd32be8-765e-49e4-8e71-4aefd70ab772", "value": "2017-08-08T15:54:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "imphash", "timestamp": "1770019090", "to_ids": true, "type": "imphash", "uuid": "a72501b2-ae79-427e-bdb4-a7465f3ceadb", "value": "027ea80e8125c6dda271246922d4c3b0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770019090", "to_ids": false, "type": "size-in-bytes", "uuid": "2c84f150-9d0e-41ad-8823-5f69b0db7e45", "value": "43056480" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770019151", "uuid": "cce0541f-c7c0-4732-abd9-1b0680931a4f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770019151", "to_ids": true, "type": "sha256", "uuid": "702d822b-9d8d-4225-a24b-9af2f960abd5", "value": "2d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e45" } ] }, { "comment": "CVE-2025-8088: Enriched via the vulnerability_lookup module", "deleted": false, "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", "meta-category": "vulnerability", "name": "vulnerability", "template_uuid": "81650945-f186-437b-8945-9f31715d32da", "template_version": "9", "timestamp": "1770211452", "uuid": "a2532c12-6b70-4f50-94f1-10b14c3b0d34", "ObjectReference": [ { "comment": "", "object_uuid": "a2532c12-6b70-4f50-94f1-10b14c3b0d34", "referenced_uuid": "6613cbc6-5680-4030-a910-896b5803fa26", "relationship_type": "related-to", "timestamp": "1770211452", "uuid": "244fb8bc-63bb-4338-986a-5a192bdc1255" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "references", "timestamp": "1770211452", "to_ids": false, "type": "link", "uuid": "d4f7fee2-d212-46cb-9ba1-96979850794e", "value": "https://vulnerability.circl.lu/vuln/CVE-2025-8088" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "id", "timestamp": "1770211452", "to_ids": false, "type": "vulnerability", "uuid": "2fcb0cc8-8e3a-4ac0-b2fe-5b9e1f0e221f", "value": "CVE-2025-8088" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "published", "timestamp": "1770211452", "to_ids": false, "type": "datetime", "uuid": "0921fe06-ce74-4923-9d1b-fddbd9deab21", "value": "2025-08-08T11:11:41.842000+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "modified", "timestamp": "1770211452", "to_ids": false, "type": "datetime", "uuid": "b63bce81-b1e7-46c4-9083-8162fb8739f9", "value": "2025-10-21T22:45:21.069000+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1770211452", "to_ids": false, "type": "text", "uuid": "08f026c3-9245-4b69-a426-f798ca20168c", "value": "PUBLISHED" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "references", "timestamp": "1770211452", "to_ids": false, "type": "link", "uuid": "f87466d3-88ae-41b2-9e44-42aba159050f", "value": "https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5" } ] }, { "comment": "CVE-2025-55182: Enriched via the vulnerability_lookup module", "deleted": false, "description": "Vulnerability object describing a common vulnerability enumeration which can describe published, unpublished, under review or embargo vulnerability for software, equipments or hardware.", "meta-category": "vulnerability", "name": "vulnerability", "template_uuid": "81650945-f186-437b-8945-9f31715d32da", "template_version": "9", "timestamp": "1770211460", "uuid": "cc19de5d-bc58-4592-9122-fe4f93cccf82", "ObjectReference": [ { "comment": "", "object_uuid": "cc19de5d-bc58-4592-9122-fe4f93cccf82", "referenced_uuid": "69a45355-6861-4eb4-854e-669ddbe77f51", "relationship_type": "related-to", "timestamp": "1770211460", "uuid": "d940dad2-40d9-4602-800e-afe68f440710" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "references", "timestamp": "1770211460", "to_ids": false, "type": "link", "uuid": "9e730eca-8624-4b44-ae07-e7a5f7b41e65", "value": "https://vulnerability.circl.lu/vuln/CVE-2025-55182" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "id", "timestamp": "1770211460", "to_ids": false, "type": "vulnerability", "uuid": "45c4c62e-502f-4d46-b142-8836df169d71", "value": "CVE-2025-55182" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "published", "timestamp": "1770211460", "to_ids": false, "type": "datetime", "uuid": "e58010e6-90c2-4e39-9811-e757922871d5", "value": "2025-12-03T15:40:56.894000+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "modified", "timestamp": "1770211460", "to_ids": false, "type": "datetime", "uuid": "41986238-1ca8-4777-a242-b948962fed9f", "value": "2025-12-11T20:15:37.699000+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "state", "timestamp": "1770211460", "to_ids": false, "type": "text", "uuid": "04abbf37-f7a5-4250-a27f-da11c1e14ede", "value": "PUBLISHED" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "references", "timestamp": "1770211460", "to_ids": false, "type": "link", "uuid": "688ddfbb-ad4c-4332-a2e5-215acfc19a13", "value": "https://www.facebook.com/security/advisories/cve-2025-55182" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "references", "timestamp": "1770211460", "to_ids": false, "type": "link", "uuid": "76450c12-d7df-47b0-8f48-8b4e0e927e76", "value": "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components" } ] } ], "EventReport": [ { "name": "Event report (1770211493)", "content": "## Disrupting the World's Largest Residential Proxy Network\n - *Date*: 2026-01-29\n - *Last update*: 2026-02-04 13:24:20\n - *Threat level*: Undefined\n - *Attribute count*: 72\n#### Tags\n - @[tag](type:OSINT)\n - @[tag](osint:lifetime=\"perpetual\")\n - @[tag](osint:certainty=\"50\")\n - @[tag](tlp:white)\n - @[tag](tlp:clear)\n#### Galaxies\n - *Name*: Attack Pattern\n - *Description*: ATT&CK Tactic\n - @[tag](misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Use Alternate Authentication Material - T1550\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"One-Way Communication - T1102.003\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\")\n - @[tag](misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\")\n#### Correlations\n - Desmantelan Infraestructura Clave de Proxies-047\n - Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088\n - Disrupting the World's Largest Residential Proxy Network\n - Tracing a Paper Werewolf campaign through AI-generated decoys and Excel XLLs\n - Distribution of EtherRAT Malware Exploiting React2Shell Vulnerability (CVE-2025-55182)\n - The Anatomy of a React2Shell Compromise\n - Vulnerability Report : CVE-2025-55182\n - Vulnerability Report : CVE-2025-8088\n - MalwareBazaar malware samples for 2024-11-20\n - Malware Family Indicators (2024-11) : Amadey - A simple but effective loader\n### Objects\n - @[object](3c108fea-de99-4e80-86e8-1f7d47a7cb89)\n - @[object](cb36da03-4448-426c-9c05-842614037661)\n - @[object](5e983077-b224-49b1-b8ca-02ca51a76d38)\n - @[object](89e8572c-bc67-40c7-9c94-95f8001b34c9)\n - @[object](bdaf9028-a20e-47e6-a953-8b109b009b40)\n - @[object](ba6759ed-89ac-4b42-bc76-7e62fb412462)\n - @[object](f2bf06b3-11f1-4806-97a8-079ece803b29)\n - @[object](cce0541f-c7c0-4732-abd9-1b0680931a4f)\n - @[object](a2532c12-6b70-4f50-94f1-10b14c3b0d34)\n - @[object](cc19de5d-bc58-4592-9122-fe4f93cccf82)\n### Attributes\n - @[attribute](69a45355-6861-4eb4-854e-669ddbe77f51)\n - @[attribute](6613cbc6-5680-4030-a910-896b5803fa26)\n - @[attribute](51ee9660-a2e8-45a4-ac9b-7b41a093cbca)\n - @[attribute](e9532b23-35ca-4a9b-af88-728843dcd618)\n - @[attribute](150c0945-69b4-42c7-84cb-70c4d6136f16)\n - @[attribute](25d90475-9ec9-4192-a37d-e18c04048ac3)\n - @[attribute](5991226b-c0e4-4174-bdcd-34ee92e73ee3)\n - @[attribute](1bd92c70-4d24-475d-b727-a14cd85c8192)\n - @[attribute](4a23cfd3-5833-45bc-bf99-644b2df6b1e5)\n - @[attribute](080a8452-bc84-45b2-8f04-7d21be9fabe1)\n - @[attribute](8dec4d34-39f3-4dea-9a05-e62fcb166930)\n - @[attribute](0ac99b95-eaf5-4d9d-a0cf-64d4e5ca1fd5)\n - @[attribute](47eda920-bcb2-4314-8a8c-888cf38179f5)\n - @[attribute](6ce17c60-e059-46bd-988a-2ea66d30766a)\n - @[attribute](d06b56e9-f109-476f-9e2d-4f5dfe5780e6)\n - @[attribute](a0a1b0ce-8a05-42a5-906a-c9a871110d8f)\n - @[attribute](c9371639-9cd2-46ae-be0a-ea67fab04a1f)\n - @[attribute](b7dd902d-be88-4e89-92c9-c2199292e06e)\n - @[attribute](74137b3c-6c2b-4c2c-a91c-6a0b5a8c5051)\n - @[attribute](ebb08117-c37e-48d4-94fd-67337d3aef9b)\n - @[attribute](9c52dd36-4c44-4f58-8c70-e3557ccbd260)\n - @[attribute](8814129d-c736-4b74-a56e-3036db4fbb5a)\n - @[attribute](d648e98c-3bc5-439c-83b8-71f89597a163)\n - @[attribute](660f0633-db70-4101-9362-f885ae868d2d)\n - @[attribute](38b75de8-696c-45de-b399-54368a753a65)\n### ATT&CK Matrix\n@[galaxymatrix](c4e851fa-775f-11e7-8163-b774922098cd)", "id": "2203", "event_id": "407070", "timestamp": "1770211493", "uuid": "b8bbef1c-f9ce-4636-8a94-ae9fd4f58e0e", "deleted": false } ] } }