{"55b7c901-614c-44d1-a638-440e950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Black Vine: Formidable cyberespionage group targeted aerospace, healthcare since 2012 by Symantec", "date": "2015-07-28", "analysis": 2, "threat_level_id": 2, "timestamp": 1456329107}, "56bf399d-c46c-4fdb-a9cf-d9bb02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Hunting for Malware with Machine Learning", "date": "2015-12-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1455373240}, "56c44d9a-a738-4a22-9306-058c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Dridex Actors Get In the Ransomware Game With \"Locky\"", "date": "2016-02-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1455720179}, "56cdcbde-4fb4-4523-b01d-ff01950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Dust Storm Campaign Targeting Japanese Critical Infrastructure", "date": "2016-02-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1456328672}, "568e62b7-0930-4398-a617-4147950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Android-based Smart TVs Hit By Backdoor Spread Via Malicious App", "date": "2016-01-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1452172225}, "56587437-7f08-4381-85bc-a829950d210b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Botnet bruteforcing Point Of Sale terminals via Remote Desktop", "date": "2014-03-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1448637781}, "56bf4797-aaf4-4e08-ab5f-6cf102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Turla - Harnessing SSL Certificates Using Infrastructure Chaining", "date": "2016-02-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1455618994}, "56d42420-c838-4c85-80ee-1365950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - ATMZombie: banking trojan in Israeli waters", "date": "2016-02-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1456743712}, "56d4b32d-664c-4647-a748-1362950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT - New Hacking team samples (OSX)", "date": "2016-02-29", "analysis": 2, "threat_level_id": 1, "timestamp": 1456781102}, "56bf2c35-198c-40be-adba-6cf602de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - A Look Into Fysbis: Sofacy\u00e2\u20ac\u2122s Linux Backdoor", "date": "2016-02-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1455369626}, "5667e3ea-cec4-4a67-b7c0-f7a9950d210b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Packrat\"", "relationship_type": ""}], "info": "OSINT - Packrat: Seven Years of a South American Threat Actor", "date": "2015-12-09", "analysis": 2, "threat_level_id": 2, "timestamp": 1483098905}, "565d5025-a6bc-4a5f-b19b-a175950d210b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - PlugX-\u00d1\u201a \u00d3\u00a9\u00d1\u20ac\u00d1\u201a\u00d1\u0081\u00d3\u00a9\u00d0\u00bd \u00d1\u0081\u00d0\u00b8\u00d1\u0081\u00d1\u201a\u00d0\u00b5\u00d0\u00bc\u00d0\u00b8\u00d0\u00b9\u00d0\u00b3 \u00d1\u2020\u00d1\u008d\u00d0\u00b2\u00d1\u008d\u00d1\u20ac\u00d0\u00bb\u00d1\u008d\u00d1\u2026 \u00d0\u00bd\u00d1\u0152", "date": "2015-12-01", "analysis": 2, "threat_level_id": 2, "timestamp": 1448956368}, "56d68f5a-adc8-4d6b-a688-5e5d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam collection (2016-03-02) - Locky, TeslaCrypt", "date": "2016-03-02", "analysis": 0, "threat_level_id": 3, "timestamp": 1456928111}, "56dd5f62-b5c8-4310-8c6f-4c03950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - LOCKY DGA THREAT ACTOR(S)", "date": "2016-03-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1457535902}, "56dd9e2c-7090-483d-91a8-4516950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Dridex (2016-03-07)", "date": "2016-03-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1457368504}, "56de9384-a9ac-42fe-9b69-49d1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "TeslaCrypt (2016-03-08)", "date": "2016-03-08", "analysis": 0, "threat_level_id": 3, "timestamp": 1457428298}, "56df115b-5030-4328-a9ee-4484950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "BadMirror: New Android Malware Family Spotted by SherlockDroid", "date": "2016-03-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1457459739}, "54aea268-ffc4-47e8-b09a-9c33950d210b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT - The Connections Between MiniDuke, CosmicDuke and OnionDuke", "date": "2015-01-08", "analysis": 2, "threat_level_id": 2, "timestamp": 1457396925}, "55fa6843-4594-454d-bc79-4b0c950d210b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - THE DUKES 7 years of Russian cyberespionage", "date": "2015-09-17", "analysis": 2, "threat_level_id": 1, "timestamp": 1457396806}, "56dc93a4-5a6c-470d-9c9b-4e9902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer", "date": "2016-03-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1457339730}, "56d61087-d19c-4552-9802-48fe02de0b81": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT APT Bestia used in APT attacks on Polish Government", "date": "2014-03-19", "analysis": 2, "threat_level_id": 2, "timestamp": 1456870733}, "568ee522-23ac-4002-b82d-4d1402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#086200", "local": false, "name": "admiralty-scale:source-reliability=\"c\"", "relationship_type": ""}, {"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}], "info": "OSINT -  Clickjacking Campaign Plays on European Cookie Law", "date": "2016-01-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1452526911}, "56e029d7-6afc-4654-a6a7-40bb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Dridex (2016-03-09) - botnet 220", "date": "2016-03-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1457531754}, "56e050e6-ac24-43d3-9c24-4f71950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam (2016-03-09) - Locky, TeslaCrypt", "date": "2016-03-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1457594040}, "56e123a7-dc1c-4c74-af4a-4d8b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - The Cerber Ransomware not only Encrypts Your Data But Also Speaks to You", "date": "2016-03-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1457596013}, "56e12e66-f01c-41be-afea-4d9a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Cerber Ransomware", "date": "2016-03-10", "analysis": 0, "threat_level_id": 3, "timestamp": 1457605235}, "56e177ef-38cc-441b-a398-4f66950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans", "date": "2016-03-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1457618310}, "56e17b23-c61c-42e8-9f33-463e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam (2016-03-10) - Locky, TeslaCrypt", "date": "2016-03-10", "analysis": 0, "threat_level_id": 3, "timestamp": 1457619436}, "56e27748-1864-476a-9c1c-4d10950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - Android banking trojan masquerades as Flash Player and bypasses 2FA", "date": "2016-03-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1457682951}, "56e2a7d9-097c-4fae-9f76-4cac950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam (2016-03-11) - Locky", "date": "2016-03-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1457711130}, "56e2c37c-b6d8-459d-b70b-428a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT -  Death Comes Calling: Thanatos/Alphabot Trojan Hits the Market", "date": "2016-03-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1457702055}, "56e2d5fc-4238-4b3a-9d7b-4539950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "'Surprise' Ransomware (2016-03-11)", "date": "2016-03-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1457708105}, "56e33b31-a500-454f-8256-435a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - PowerSniff Malware Used in Macro-based Attacks", "date": "2016-03-11", "analysis": 2, "threat_level_id": 2, "timestamp": 1457732556}, "55c2797f-1cd0-4d5f-92b9-4f93950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Technical Analysis Tracks the Sakula Malware Family by SecureWorks", "date": "2015-07-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1440510078}, "56e6910e-9cdc-4c9a-8ece-4531950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#6edc00", "local": false, "name": "circl:topic=\"ict\"", "relationship_type": ""}], "info": "OSINT - SteamStealer IPs", "date": "2016-03-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1458077236}, "56e6c7d5-4240-4640-a214-4bef950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Malspam (2016-03-14) - Locky, TeslaCrypt", "date": "2016-03-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1457969621}, "56e7c415-a5e4-4c07-88a1-420f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Locky Ransomware Arrives via Email Attachment", "date": "2016-03-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1458031034}, "56e7fbe0-55e4-4d2d-ac65-4b19950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#1f3f00", "local": false, "name": "circl:incident-classification=\"system-compromise\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Potential SpamBots (2016-03-15)", "date": "2016-03-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1458044736}, "56e6db41-00d0-4734-b3a9-4bde950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#1f3f00", "local": false, "name": "circl:incident-classification=\"system-compromise\"", "relationship_type": ""}], "info": "Potential SpamBots (2016-03-14)", "date": "2016-03-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1458044044}, "56e87ebe-7b6c-4008-bcfd-42a302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "Dridex botnet 222 (20160315)", "date": "2016-03-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1458077708}, "56e90a1a-fc94-4cfc-95c1-4435950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#1f3f00", "local": false, "name": "circl:incident-classification=\"system-compromise\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Potential SpamBots (2016-03-16)", "date": "2016-03-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1458143081}, "56e92123-fd6c-44cc-a842-42c0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam (2016-03-16) - Locky", "date": "2016-03-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1458139558}, "56e95df6-ed08-469a-9a5d-4fc6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Operation Transparent Tribe", "date": "2016-03-16", "analysis": 2, "threat_level_id": 2, "timestamp": 1458136827}, "56e962e9-ed10-48d8-b885-4bcd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Dridex of the day (2016-03-16) - botnet 120", "date": "2016-03-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1458139531}, "56e96cfd-a958-4012-b575-4fe7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Malicious iBanking application with new uninstall countermeasures", "date": "2016-03-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1458138550}, "56e986fb-08c0-442c-a3f3-5390950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Locky (2016-03-16)", "date": "2016-03-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1458146101}, "56e9b21a-98fc-4d0e-ae29-4e53950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - AceDeceiver: First iOS Trojan Exploiting Apple DRM Design Flaws to Infect Any iOS Device", "date": "2016-03-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1458156513}, "56ea88b3-03a8-4a60-8b73-4b59950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#1f3f00", "local": false, "name": "circl:incident-classification=\"system-compromise\"", "relationship_type": ""}], "info": "Potential SpamBots (2016-03-17)", "date": "2016-03-17", "analysis": 0, "threat_level_id": 3, "timestamp": 1458229911}, "56eac220-9900-4d35-bb22-461b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam (2016-03-17) - Dridex (122), Locky", "date": "2016-03-17", "analysis": 0, "threat_level_id": 3, "timestamp": 1458229641}, "56f0302e-e494-494b-b012-42d7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - STOP SCANNING MY MACRO", "date": "2016-03-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1458581850}, "56f29500-187c-4051-a321-4aba950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Operation C-Major: Information Theft Campaign Targets Military Personnel in India", "date": "2016-03-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1458739046}, "56f4132b-be7c-4d2a-a00c-4a91950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Petya Ransomware", "date": "2016-03-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1458836702}, "56f419c3-e67c-45fc-b3a6-40d5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Malware is being signed with multiple digital certificates to evade detection", "date": "2016-03-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1458838177}, "56f4497b-6134-468e-807e-fc08950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Evolution of SamSa Malware Suggests New Ransomware Tactics In Play", "date": "2016-03-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1458850846}, "56f50e98-5804-4496-84e6-faf3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - PETYA Crypto-ransomware Overwrites MBR to Lock Users Out of Their Computers", "date": "2016-03-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1458900788}, "56f53e06-35d4-47e5-8d94-468e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - New self-protecting USB trojan able to avoid detection", "date": "2016-03-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1458913144}, "56f58bcc-96e4-49d2-bc8b-faf7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - SURGE IN SPAM CAMPAIGN DELIVERING LOCKY RANSOMWARE DOWNLOADERS", "date": "2016-03-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1458932871}, "56f8e284-5b54-46d4-814d-3f2f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - McAfee Labs Threat Advisory Ransomware-Locky", "date": "2016-03-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1459152153}, "56f8e7c3-74b4-4789-9e6a-6f2302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - Malware Employs PowerShell to Infect Systems", "date": "2016-03-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1459153417}, "56f92df0-24f0-4c6e-a297-6f2402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - TREASUREHUNT: A CUSTOM POS MALWARE TOOL", "date": "2016-03-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1459171202}, "56f93f55-e6d0-45c9-8109-74ad02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "Locky of the day (20160328) -  affid=3", "date": "2016-03-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1459175372}, "56fad784-e8ec-4dcf-9384-47bf02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - In the Shadows: Vawtrak Aims to Get Stealthier by adding New Data Cloaking", "date": "2016-03-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1468658470}, "56fb756e-0df4-40e4-9756-438e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Taiwan targeted with new cyberespionage back door Trojan", "date": "2016-03-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1459340280}, "56fba597-d420-45fe-9a73-46f5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - GongDa vs. Korean News", "date": "2016-03-30", "analysis": 0, "threat_level_id": 4, "timestamp": 1459341061}, "570283b7-2800-483e-ba3e-1743950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Meet Remaiten \u00e2\u20ac\u201c a Linux bot on steroids targeting routers and potentially other IoT devices", "date": "2016-04-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1459783333}, "5703b3c1-e6a4-421a-a394-440f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam (2016-04-05) - TeslaCrypt", "date": "2016-04-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1459861652}, "5705186a-a7f0-4309-89be-5094950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Dridex (2016-04-06) - botnet 122", "date": "2016-04-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1459954203}, "570611e3-9f58-493b-8760-3510950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - Most prevalent Android ransomware in the West arrives in Japan", "date": "2016-04-07", "analysis": 2, "threat_level_id": 2, "timestamp": 1460022240}, "570669fe-4138-40e0-ba49-4990950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Kegotip downloader", "date": "2016-04-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1460041633}, "5706756e-958c-4c53-8f77-45f4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "PWS: Win32/Kegotip.C", "date": "2014-10-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1460041291}, "57062927-2a54-4d6a-89c4-37ea950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#3e6e00", "local": false, "name": "malware_classification:malware-category=\"Spyware\"", "relationship_type": ""}], "info": "Information stealer: Fareit", "date": "2016-04-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1460040823}, "5707b73d-02e4-4c52-9eee-4872950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Locky: the encryptor taking the world by storm", "date": "2016-04-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1544622791}, "570982d2-f5bc-47e9-9b25-297702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - ModPOS: A Framework Lurking in Point-of-Sale System Kernels", "date": "2016-04-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1460241377}, "570b4c28-7480-4be0-b858-493e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Locky Ransomware Domains \u00e2\u20ac\u201c Followup Analysis Uncovers 130 New Indicators", "date": "2016-04-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1460358659}, "570b9eee-6f60-41d4-bd1b-40d2950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Mobile Devices Used to Execute DNS Malware Against Home Routers", "date": "2016-04-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1460379519}, "570c9451-ec50-4ecc-b031-47b4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - New Locky Variant Implements Evasion Techniques", "date": "2016-04-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1460444521}, "570c9b9a-dc20-448a-8f24-443f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "Rokku Ransomware shows possible link with Chimera", "date": "2016-04-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1460444381}, "570cf5b5-18d4-474e-b41e-41f1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Dridex (2016-04-12)", "date": "2016-04-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1460470661}, "570d57de-f49c-421d-a28d-4d5f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - MS Office exploit analysis \u00e2\u20ac\u201c CVE-2015-1641", "date": "2016-04-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1460492719}, "570f47a0-ee58-4aa8-ac55-96e4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#1f3f00", "local": false, "name": "circl:incident-classification=\"system-compromise\"", "relationship_type": ""}], "info": "Malspam via Spambots (2016-04-14)", "date": "2016-04-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1460624436}, "5714a8d1-52a4-48fa-8696-4066950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Retefe is back in town", "date": "2016-04-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1460972471}, "5715fcdc-d2ec-42c6-8be3-493c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Python-Based PWOBot Targets European Organizations", "date": "2016-04-19", "analysis": 2, "threat_level_id": 2, "timestamp": 1461098588}, "57153590-f73c-49fa-be4b-4737950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - ASERT Threat Intelligence Report 2016-03 The Four-Element Sword Engagement", "date": "2016-04-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1467971098}, "57174526-23d8-4895-8c08-4ed1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "New ransomware", "date": "2016-04-20", "analysis": 0, "threat_level_id": 3, "timestamp": 1461153134}, "5717777b-a8b4-4876-b060-4339950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - New Crypto-Ransomware JIGSAW Plays Nasty Games", "date": "2016-04-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1461159444}, "57189d1b-e90c-4d93-8383-41d8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - Your Package Has Been Successfully Encrypted: TeslaCrypt 4.1A and the Malware Attack Chain", "date": "2016-04-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1461251927}, "5718c835-f58c-4f8e-8da4-452a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "CryptXXX: New Ransomware From the Actors Behind Reveton, Dropping Via Angler", "date": "2016-04-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1461251080}, "5718d275-88d4-492e-9f07-43ee950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - \u00e2\u20ac\u0153Operation C-Major\u00e2\u20ac\u009d Actors Also Used Android, BlackBerry Mobile Spyware Against Targets", "date": "2016-04-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1461251249}, "571a302c-e5c4-4014-8131-4e9c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Teaching an old RAT new tricks", "date": "2016-04-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1461334427}, "571a7cdc-c078-482d-98dc-4e42950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - powershell used for spreading trojan.laziok through google docs", "date": "2016-04-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1461354043}, "571a87f2-13e0-4396-83e5-4780950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists", "date": "2016-04-22", "analysis": 2, "threat_level_id": 2, "timestamp": 1461356749}, "571bd702-031c-400b-a851-43ce02de0b81": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT The Ghost Dragon by Cylance", "date": "2016-04-22", "analysis": 2, "threat_level_id": 2, "timestamp": 1466374930}, "571de51c-4f04-491f-b34a-4567950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - TWO BYTES TO $951M (SWIFT payment system abuse)", "date": "2016-04-25", "analysis": 2, "threat_level_id": 2, "timestamp": 1463501820}, "571de8da-be78-4d1d-851f-448d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - New FAREIT Strain Abuses PowerShell", "date": "2016-04-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1461589772}, "571f489a-26e4-403c-948f-4aff950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam (2016-04-26) - Dridex botnet 122", "date": "2016-04-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1461669829}, "571fd18a-efc4-4099-93f5-447502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Macro Malware Employs Advanced Obfuscation to Avoid Detection", "date": "2016-04-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1461705011}, "57205b50-c19c-4411-ae0e-4414950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Malware Campaign Using Google Docs Intercepted, Thousands of Users Affected", "date": "2016-04-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1461738768}, "5720669e-55ac-42ef-bc40-4b78950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - New Poison Ivy Activity Targeting Myanmar, Asian Countries", "date": "2016-04-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1461741921}, "5720accd-dd28-45f8-80e5-4605950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Malspam 2016-04-27 - Locky", "date": "2016-04-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1461764231}, "5720a8c0-9064-4e32-b7ad-4f7e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - RuMMS: The Latest Family of Android Malware Attacking Users in Russia Via SMS Phishing", "date": "2016-04-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1461763137}, "5720bf21-9d4c-40b2-9088-45e6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - New Downloader for Locky", "date": "2016-04-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1461829032}, "5721bfc3-7090-4109-b492-453b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Malspam (2016-04-28) - Locky", "date": "2016-04-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1461834516}, "5721c2e4-05ec-4af3-9264-411b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Malspam (2016-04-28) - Locky (#2)", "date": "2016-04-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1461831498}, "5721cf79-61d8-4af9-8314-4756950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam (2016-04-28) - #3 (unknown payload, not accessible)", "date": "2016-04-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1461833922}, "57221ede-4084-4c2b-9463-4e1e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - PLATINUM Targeted attacks in South and Southeast Asia", "date": "2016-04-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1464773185}, "57232f8f-c210-454d-ad75-4d11950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  Over 100,000 South Korean Users Affected by BlackMoon Campaign", "date": "2016-04-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1461934375}, "5718d5d3-25d4-415c-a97b-4920950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#7af300", "local": false, "name": "circl:topic=\"services\"", "relationship_type": ""}, {"colour": "#00abd1", "local": false, "name": "veris:action:malware:variety=\"Ram scraper\"", "relationship_type": ""}], "info": "OSINT - MULTIGRAIN \u00e2\u20ac\u201c Point of Sale Attackers Make an Unhealthy Addition to the Pantry", "date": "2016-04-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1462175966}, "572754de-6fb8-4e96-887f-45ec950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Prince of Persia: Infy Malware Active In Decade of Targeted Attacks", "date": "2016-05-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1462197104}, "572a1a62-2510-4a7e-b983-4793950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Turbo Twist: Two 64-bit Derusbi Strains Converge", "date": "2016-05-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1464350376}, "572efbbc-ba08-4a82-b879-400d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Fake scan campaings (20160505 - 20160507) using docm - Dridex", "date": "2016-05-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1462697324}, "572f0929-9b8c-42de-adc6-450202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - New Infostealer Trojan uses Fiddler Proxy & Json.NET", "date": "2016-05-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1462709494}, "5730965a-fa18-43d4-8692-4296950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Exploring CVE-2015-2545 and its users", "date": "2016-05-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1463502585}, "57317fb9-814c-466d-9151-4594950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "A Detailed Examination of the Siesta Campaign", "date": "2014-05-12", "analysis": 2, "threat_level_id": 2, "timestamp": 1462862685}, "5734dc40-a4f0-45a6-a9e2-4494950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - Chinese-language Ransomware Makes An Appearance", "date": "2016-05-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1463082164}, "5735c472-124c-495e-bebd-4bc5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - Cyber Heist Attribution", "date": "2016-05-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1463141853}, "5739b34f-01ac-4e80-a403-4a1502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT -  Hancitor and Ruckguv Reappear, Updated and With Vawtrak On Deck", "date": "2016-05-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1463399905}, "573cbe55-a890-42e3-8ce9-436802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT -  Operation Groundbait: Espionage in Ukrainian war zones", "date": "2016-05-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1463599592}, "573efd23-b3a4-4374-9f11-3514950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Bolek: Leaked Carberp KBot Source Code Complicit in New Phishing Campaigns", "date": "2016-05-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1463746106}, "5742a093-4190-414a-8a36-4c8d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "Locky of the day (20160520)", "date": "2016-05-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1463984507}, "5742bb17-ec60-4c81-8b62-45f3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#065000", "local": false, "name": "misp-galaxy:tool=\"Wipbot\"", "relationship_type": ""}], "info": "OSINT - APT Case RUAG Technical Report", "date": "2016-05-23", "analysis": 2, "threat_level_id": 1, "timestamp": 1484923617}, "5742ea44-5ff4-4634-99c9-4b32950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Operation Ke3chang Resurfaces With New TidePool Malware", "date": "2016-05-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1515812422}, "5743f37c-c11c-426d-843b-4d83950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Targeted Attacks against Banks in the Middle East", "date": "2016-05-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1464071359}, "5744128d-ede0-41a8-8497-41f0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Malspam - Locky - 2016-05-24 (.zip with .js, downloading (partially reversed) XOR'ed data)", "date": "2016-05-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1464103873}, "57447e7c-91fc-48e4-80b0-67a0950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT - Looking Into a Cyber-Attack Facilitator in the Netherlands by Trend Micro", "date": "2016-04-21", "analysis": 2, "threat_level_id": 1, "timestamp": 1464109474}, "574549b7-23c0-4bf3-9183-466b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - Dogspectus Ransomware Analysis", "date": "2016-05-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1464159454}, "57454ee0-3294-407a-8468-493c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - New Wekby Attacks Use DNS Requests As Command and Control Mechanism", "date": "2016-05-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1464161691}, "5745b0f7-3af4-4b0f-aa89-456f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "MalSpam - Locky - 2016-05-25 (.js in .zip)", "date": "2016-05-25", "analysis": 0, "threat_level_id": 3, "timestamp": 1464202650}, "57460863-76dc-4272-8116-4ea302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}], "info": "OSINT - CVE-2015-2545: overview of current threats", "date": "2016-05-25", "analysis": 2, "threat_level_id": 2, "timestamp": 1469608718}, "57469dce-e55c-4edc-8e0b-43a6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Malspam 2016-05-26 - Locky - samples reversed, xored (0x73 or 0x1c); samples reversed + long xor key", "date": "2016-05-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1464339121}, "5746bc01-151c-4f41-a957-4b5b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Malspam - Locky - 2016-05-26 (.docm)", "date": "2016-05-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1464256483}, "57480ad9-8584-45c5-9a20-45d5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "Malspam 2016-05-27 - Locky (.js in .zip)", "date": "2016-05-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1464464571}, "57482a58-58b0-42f8-bf2b-46b0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam - 2016-05-27 - Locky - .docm", "date": "2016-05-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1464597609}, "574c3d9c-41dc-4af6-b99d-1d31950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Keep Calm and (Don\u00e2\u20ac\u2122t) Enable Macros: A New Threat Actor Targets UAE Dissidents", "date": "2016-05-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1464615557}, "574e8687-8af0-40c5-b4dd-baa9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "A Universal Windows Bootkit An analysis of the MBR bootkit referred to as \u00e2\u20ac\u0153HDRoot\u00e2\u20ac\u009d", "date": "2016-06-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1464764332}, "574ed4d9-83c0-4422-a492-423e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - DRIDEX\u00e2\u20ac\u2122s New Tricks Lead to Global Spam Outbreak", "date": "2016-06-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1464784644}, "574efbb3-e924-4d54-a701-43a1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - \u00d0\u2018\u00d0\u00b0\u00d0\u00bd\u00d0\u00ba\u00d0\u00be\u00d0\u00b2\u00d1\u0081\u00d0\u00ba\u00d0\u00b8\u00d0\u00b9 \u00d1\u201a\u00d1\u20ac\u00d0\u00be\u00d1\u008f\u00d0\u00bd\u00d0\u00b5\u00d1\u2020 Lurk: \u00d1\u0081\u00d0\u00bf\u00d0\u00b5\u00d1\u2020\u00d0\u00b8\u00d0\u00b0\u00d0\u00bb\u00d1\u0152\u00d0\u00bd\u00d0\u00be \u00d0\u00b4\u00d0\u00bb\u00d1\u008f \u00d0\u00a0\u00d0\u00be\u00d1\u0081\u00d1\u0081\u00d0\u00b8\u00d0\u00b8 (Banking Trojan Lurk: specially for Russia)", "date": "2016-06-01", "analysis": 2, "threat_level_id": 2, "timestamp": 1464809232}, "57504442-9454-4159-a7e9-4ad8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - IRONGATE ICS Malware: Nothing to See Here...Masking Malicious Activity on SCADA Systems", "date": "2016-06-02", "analysis": 2, "threat_level_id": 2, "timestamp": 1464878972}, "5755628d-ebd4-4150-abb0-4bfd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - CryptXXX Ransomware Learns the Samba, Other New Tricks With Version 3.100", "date": "2016-06-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1465214413}, "57557d45-1590-4513-925d-4516950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Lame proxychanger, apparently related to a clickfraud botnet.", "date": "2016-06-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1465220677}, "57595892-e5f4-4419-b6dc-48df950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - LinkedIn information used to spread banking malware in the Netherlands", "date": "2016-06-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1465477825}, "575d6784-4218-4756-84f8-49e0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT -  Communications of the Bolek Trojan", "date": "2016-06-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1465739647}, "575d798e-2398-4121-b5e6-4a0e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Reverse-engineering DUBNIUM", "date": "2016-06-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1465743891}, "57608399-aa20-4d2c-b03d-4a69950d210f": {"Orgc": {"name": "FOXIT-CERT", "uuid": "55f6ea5f-03c4-42c7-83bb-4984950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006262", "local": false, "name": "ecsirt:malicious-code=\"malware\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Mofang: A politically motivated information stealing adversary", "date": "2016-06-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1468918774}, "57613790-f6b4-4895-943f-4467950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT New Sofacy Attacks Against US Government Agency by Palo Alto Unit 42", "date": "2016-06-15", "analysis": 2, "threat_level_id": 1, "timestamp": 1466000907}, "5764778a-fdfc-43c0-9fcc-4166950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Setting Sights On Retail: AbaddonPOS Now Targeting Specific POS Software", "date": "2016-06-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1466237887}, "551427fe-47ac-4247-93f0-c906950d210b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - PlugX goes to the registry (and India)", "date": "2015-03-26", "analysis": 2, "threat_level_id": 2, "timestamp": 1439989596}, "576a3d71-3fec-423a-86cd-3470950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam (2016-06-22) - .js in .zip - Locky is back", "date": "2016-06-22", "analysis": 0, "threat_level_id": 3, "timestamp": 1466596621}, "576afc2a-6fd8-4b0d-949b-347902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - The Curious Case of an Unknown Trojan Targeting German-Speaking Users", "date": "2016-06-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1466629362}, "576cee20-2a04-4683-aae1-441c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "Malspam 2016-06-23 (Locky)", "date": "2016-06-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1466756747}, "576d3a39-fe90-4921-85cc-4e3c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-06-24 (Locky)", "date": "2016-06-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1466781260}, "5770f374-7cc4-40d6-9d1f-46f8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - Doh! New \"Bart\" Ransomware from Threat Actors Spreading Dridex and Locky", "date": "2016-06-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1467020458}, "57713b14-8448-4859-a6ab-44a6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-06-27", "date": "2016-06-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1467042073}, "57721299-5610-4220-97b0-4329950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-06-28 (Locky campaign subject: 'Updated')", "date": "2016-06-28", "analysis": 0, "threat_level_id": 3, "timestamp": 1467093772}, "57721a0d-8c48-47a5-86d4-458c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Retefe banking Trojan targets UK banking customers", "date": "2016-06-28", "analysis": 0, "threat_level_id": 3, "timestamp": 1467095664}, "57722fef-c208-4297-a3bc-40be950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#6edc00", "local": false, "name": "circl:topic=\"ict\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Linux/GafGyt - DVR devices compromised/infected", "date": "2016-06-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1467101559}, "577265af-55ac-4489-98e9-041d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam 2016-06-28 (Locky campaign subject: 'report')", "date": "2016-06-28", "analysis": 0, "threat_level_id": 3, "timestamp": 1467115428}, "577375a9-9ab8-4163-84ab-a395950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#006262", "local": false, "name": "ecsirt:malicious-code=\"malware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - The Latest Android Overlay Malware Spreading via SMS Phishing in Europe", "date": "2016-06-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1467185792}, "5773639a-f104-49a0-b26c-4228950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-06-29 (campaign subject: 'new invoice')", "date": "2016-06-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1467180129}, "57738bb1-bcc4-443e-a002-4590950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Prince of Persia \u00e2\u20ac\u201c Game Over", "date": "2016-06-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1467190467}, "5773b18a-9710-4337-ae4c-4014950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-06-29 (campaign subject: 'Financial report')", "date": "2016-06-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1467214481}, "5774c987-1c30-4e78-a85d-c821950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-06-30 (campaign subject: 'Documents copies')", "date": "2016-06-30", "analysis": 0, "threat_level_id": 3, "timestamp": 1467271656}, "57750408-3784-4dfd-a7c7-c82a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Satana ransomware \u00e2\u20ac\u201c threat coming soon?", "date": "2016-06-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1467286805}, "57750a68-58c8-4323-8c93-c828950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Apocalypse: Ransomware which targets companies through insecure RDP", "date": "2016-06-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1467288974}, "57761f00-7058-4077-aa9a-4ab3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Pacifier APT", "date": "2016-07-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1467359855}, "577a5b2f-5a3c-4565-b847-40e6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-04 (testrun, subject 'Scanned image'), .docm", "date": "2016-07-04", "analysis": 0, "threat_level_id": 3, "timestamp": 1467638241}, "577bcda2-5e64-43a9-9b1c-4609950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-05 (subject 'Scanned image'), .docm", "date": "2016-07-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1467806811}, "577c1528-e5dc-49ef-92c0-404d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - From Humming Bad to Worse", "date": "2016-07-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1467751444}, "57821cf6-9750-4857-9803-29fd02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - The Dropping Elephant \u00e2\u20ac\u201c aggressive cyber-espionage in the Asian region", "date": "2016-07-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1468145561}, "5784f9df-02ac-4e17-92bc-7e4502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - NetTraveler APT Targets Russian, European Interests", "date": "2016-07-12", "analysis": 2, "threat_level_id": 2, "timestamp": 1468332991}, "57860f63-fe44-4b95-b8b2-4839950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-13 (Locky campaign 'Profile')", "date": "2016-07-13", "analysis": 0, "threat_level_id": 3, "timestamp": 1493731615}, "578601ff-dbd8-49c2-b148-4870950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-12 (Locky campaign 'Fw:')", "date": "2016-07-13", "analysis": 0, "threat_level_id": 3, "timestamp": 1468400250}, "5786466b-896c-41f4-a39d-46d1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-13 .wsf campaign", "date": "2016-07-13", "analysis": 0, "threat_level_id": 3, "timestamp": 1468417678}, "57874883-feb8-4538-9f4c-472c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-14 .wsf campaign", "date": "2016-07-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1468489592}, "5788c19e-ee40-43b8-9160-47da950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-15 .zip/.jse", "date": "2016-07-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1468580293}, "578cca12-1490-4cee-85de-4c29950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-18 .wsf (campaign: \"bank account report\")", "date": "2016-07-18", "analysis": 0, "threat_level_id": 3, "timestamp": 1468844704}, "578cd192-e448-45a8-abca-497a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-18 .wsf->.gif (campaign: \"RE: firstname.lastname\")", "date": "2016-07-18", "analysis": 0, "threat_level_id": 3, "timestamp": 1468848886}, "578cde89-5064-4b29-96c5-45e6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-18 .wsf (campaign: \"company database\")", "date": "2016-07-18", "analysis": 0, "threat_level_id": 3, "timestamp": 1468852850}, "578e2285-12cc-4a15-b078-4b74950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-07-19 .wsf (campaign: \"new invoice\")", "date": "2016-07-19", "analysis": 0, "threat_level_id": 3, "timestamp": 1468935034}, "578e31c3-c0a4-4113-9df2-4449950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam 2016-07-19 .docm (campaign: \"Documents from work\")", "date": "2016-07-19", "analysis": 0, "threat_level_id": 3, "timestamp": 1468937188}, "5790e667-46bc-453e-bb78-44d0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam 2016-07-21 .wsf (campaign: \"fixed invoice\")", "date": "2016-07-21", "analysis": 0, "threat_level_id": 3, "timestamp": 1469114614}, "5791cf23-9e10-4537-9f59-4c55950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}], "info": "Malspam 2016-07-22 .js in .zip with embedded Locky (campaign: \"Financial statement\")", "date": "2016-07-22", "analysis": 0, "threat_level_id": 3, "timestamp": 1469176338}, "57931fd5-3c78-4dab-b1e9-4cc302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Kovter becomes almost file-less, creates a new file type, and gets some new certificates", "date": "2016-07-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1469260042}, "5797537b-6d80-4d28-ab2a-4d8a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Patchwork cyberespionage group expands targets from governments to wide range of industries", "date": "2016-07-26", "analysis": 2, "threat_level_id": 2, "timestamp": 1469536140}, "5797c2d2-5784-4ab9-b5c7-4e98950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "Guccifer 2.0: All Roads Lead to Russia - Threatconnect report", "date": "2016-07-26", "analysis": 1, "threat_level_id": 1, "timestamp": 1469564504}, "5799af90-d8b4-416a-b5fb-49dc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - The Mad Max DGA", "date": "2016-07-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1469690114}, "57a05786-71b8-49a2-892e-32ec950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#006262", "local": false, "name": "ecsirt:malicious-code=\"malware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - LuminosityLink RAT", "date": "2016-08-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1470126169}, "57a33020-bc70-4f69-96f9-118b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - NANHAISHU RATing the South China Sea", "date": "2016-08-04", "analysis": 2, "threat_level_id": 2, "timestamp": 1470319332}, "57a88345-5254-4c97-954d-4ff8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Strider: Cyberespionage group turns eye of Sauron on targets", "date": "2016-08-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1470751030}, "57a8a2e8-6054-46ef-bab9-418e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms", "date": "2016-08-08", "analysis": 2, "threat_level_id": 1, "timestamp": 1493403729}, "57a89edc-e184-41da-8e51-4f98950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Group5: Syria and the Iranian Connection by Citizen Lab", "date": "2016-08-08", "analysis": 2, "threat_level_id": 2, "timestamp": 1470670614}, "57a8a426-c8f0-4893-8a2a-475d950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Orcus \u00e2\u20ac\u201c Birth of an unusual plugin builder RAT by Palo Alto Unit 42", "date": "2016-08-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1470669905}, "57a89cb0-1a80-4f24-a85b-43d4950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Massive AdGholas Malvertising Campaigns Use Steganography and File Whitelisting to Hide in Plain Sight by ProofPoint", "date": "2016-07-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1493403458}, "546e08ce-3134-4892-997b-73ff950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Import of CitizenLab public DB of malware indicators", "date": "2014-11-20", "analysis": 2, "threat_level_id": 4, "timestamp": 1517817238}, "57a8931f-6818-42e8-81a2-44ec950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Lost your iPhone? Be on guard for a perfectly-timed Apple ID phishing attack by Hot For Security", "date": "2016-08-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1470665545}, "57a8944a-ac6c-43ac-8cf4-4ebe950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Expansion on OSINT Lost your iPhone? Be on guard for a perfectly-timed Apple ID phishing attack by Hot For Security", "date": "2016-08-08", "analysis": 0, "threat_level_id": 3, "timestamp": 1470667582}, "5783a00e-27d8-4e5a-ac92-aec6950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#f1ee1d", "local": false, "name": "Threat:Sofacy/APT28", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}], "info": "Pivot on What's in a server name (on APT28/Sofacy) by ThreatConnect", "date": "2016-07-11", "analysis": 2, "threat_level_id": 2, "timestamp": 1468244421}, "578399b0-5b4c-4ddd-b1ad-4a2d950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#f1ee1d", "local": false, "name": "Threat:Sofacy/APT28", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}], "info": "What's in a server name (on APT28/Sofacy) by ThreatConnect", "date": "2016-07-11", "analysis": 2, "threat_level_id": 2, "timestamp": 1498162327}, "5778026d-9670-44e0-9c25-4751950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#0fbf00", "local": false, "name": "misp-galaxy:threat-actor=\"darkhotel\"", "relationship_type": ""}], "info": "OSINT DarkHotel samples at WooYun", "date": "2016-05-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1498162340}, "57780118-b304-434e-b78f-478d950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT H-Worm IOCs from WooYun", "date": "2016-07-01", "analysis": 2, "threat_level_id": 2, "timestamp": 1467483572}, "57724297-147c-41e3-86f6-4586950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Threat Group-4127 Targets Google Accounts by Secureworks", "date": "2016-06-26", "analysis": 2, "threat_level_id": 1, "timestamp": 1467106117}, "563b3ea6-b26c-401f-a68b-4d84950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#14ff00", "local": false, "name": "admiralty-scale:information-credibility=\"6\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Expansion on Systematic cyber attacks against Israeli and Palestinian targets going on for a year by Norman", "date": "2015-11-05", "analysis": 2, "threat_level_id": 4, "timestamp": 1596436859}, "5761398f-31d0-46b0-808f-41de950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Microsoft Office Zero-Day CVE-2015-2424 Leveraged By Tsar Team report by iSight", "date": "2015-07-15", "analysis": 2, "threat_level_id": 1, "timestamp": 1466000979}, "5759bcc0-15c0-4906-8c93-46f1950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#316200", "local": false, "name": "circl:incident-classification=\"phishing\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Rotten Apples: Apple-Like Malicious Phishing Domains by FireEye", "date": "2016-06-07", "analysis": 2, "threat_level_id": 2, "timestamp": 1465685399}, "57447a73-8244-40d0-9c3d-57fe950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT - FBI MSIL/Samas.A Ransomware Flash Alerts (FBI Flash Alert MC-000068-MW, February 18, 2016  & FBI Flash Alert MC-000070-MW, March 25, 2016)", "date": "2016-05-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1464157832}, "55c902ef-1910-4904-8cee-41cc950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Fidelis Threat Advisory #1018 Looking at the Sky for a DarkComet from the Fidelis Cybersecurity", "date": "2015-08-04", "analysis": 2, "threat_level_id": 2, "timestamp": 1443603530}, "5614b57d-0f58-4c26-ad03-6aac950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Cisco Talos Thwarts Access to Massive International Exploit Kit Generating $60M Annually From Ransomware Alone by Cisco Talos", "date": "2015-10-06", "analysis": 2, "threat_level_id": 4, "timestamp": 1444212082}, "54f8688d-9444-4033-82fb-3c19950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Threat Spotlight: Angler Lurking in the Domain Shadows by Cisco Talos group", "date": "2015-03-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1425566606}, "5526addb-a21c-4024-b3d6-5bf3950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Angler Exploit Kit Utilizing 302 Cushioning and Domain Shadowing by Zscaler", "date": "2015-04-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1428599128}, "54dc65bf-37a4-45b5-abd2-a7c3950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT SSH Scanning activity by Andrew Morris", "date": "2014-12-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1423746182}, "563a0656-bfa0-4e80-90df-a033950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Fidelis Threat Advisory #1019 Ratcheting Down on JSocket: A PC and Android Threat by Fidelis Cybersecurity", "date": "2015-11-03", "analysis": 2, "threat_level_id": 2, "timestamp": 1450792880}, "543b8fa7-c478-418f-9cc8-4b00950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT  Watching Attackers Through Virustotal blog post by Brandon Dixon (9bplus)", "date": "2014-09-01", "analysis": 2, "threat_level_id": 2, "timestamp": 1422024820}, "560ad646-3e08-4331-87b2-cfb8950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Recorded Future using shodan to find RAT controllers", "date": "2015-09-28", "analysis": 2, "threat_level_id": 4, "timestamp": 1443593987}, "542e4c9c-cadc-4f8f-bb11-6d13950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT ShellShock scanning IPs from OpenDNS", "date": "2014-10-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1517817037}, "56095160-7848-4ce6-b0d4-4d2b950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Microsoft Word Intruder gets down to business: Operation Pony Express by Sophos", "date": "2015-09-25", "analysis": 2, "threat_level_id": 2, "timestamp": 1443510380}, "54c60f43-b084-453a-a162-4e08950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT I Know You Want Me - Unplugging PlugX from Takahiro Haruyama & Hiroshi Suzuki Black Hat Asia 2014 presentation", "date": "2015-01-26", "analysis": 2, "threat_level_id": 2, "timestamp": 1517578118}, "56b06b70-4aa8-4b49-87c6-4ef6950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0c9100", "local": false, "name": "admiralty-scale:source-reliability=\"f\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}], "info": "OSINT phishing sites and php kits - January 2016 - Part 1  by TechHelpList", "date": "2016-01-01", "analysis": 2, "threat_level_id": 4, "timestamp": 1454934765}, "55d421e6-59ac-49fa-bb33-44cc950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT New Hacking Team IOC\u00e2\u20ac\u2122s Released by Rook security", "date": "2015-07-21", "analysis": 2, "threat_level_id": 2, "timestamp": 1439969167}, "56b06c17-0b4c-4a9d-b71b-43f3950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0c9100", "local": false, "name": "admiralty-scale:source-reliability=\"f\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}], "info": "OSINT phishing sites and php kits - January 2016 - Part 2 by TechHelpList", "date": "2016-01-17", "analysis": 2, "threat_level_id": 4, "timestamp": 1454402804}, "566f49f8-1d78-4245-b80c-45b6950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Passive DNS ponmocup malware - 109.74.195.149 in VirusTotal", "date": "2015-12-03", "analysis": 2, "threat_level_id": 4, "timestamp": 1450164727}, "55bb38dc-bda8-4839-8b37-4fe1950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Milano Hacking Team malware detection tool & IOCs by Rook Security", "date": "2015-07-21", "analysis": 2, "threat_level_id": 2, "timestamp": 1438335004}, "55d341da-f5d4-47a4-9095-467a950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Pony Up: Tracing Pony\u00e2\u20ac\u2122s Threat Cycle and Multi-Stage Infection Chain by Damballa", "date": "2015-06-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1440503570}, "552bf030-0334-4134-af4a-4e9a950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT 30\"", "relationship_type": ""}], "info": "OSINT APT 30 and the Mechanics of a Long-Running Cyber Espionage Operation by FireEye", "date": "2015-04-12", "analysis": 2, "threat_level_id": 2, "timestamp": 1498163197}, "56313c70-0d5c-43d9-9e27-47c6950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Chinese Taomike Monetization Library Steals SMS Messages by AlienVault and Palo Alto networks", "date": "2015-10-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1446102957}, "56056045-6158-4b49-8a23-cfaf950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT An Update on Nuclear (Reverse) Engineering by Zscaler", "date": "2015-09-23", "analysis": 2, "threat_level_id": 4, "timestamp": 1443193071}, "546bc3e8-d498-4e0c-b169-f2ea950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Expansion on Additional indicators relating to Sofacy (APT28) phishing blog post by PWC", "date": "2014-11-18", "analysis": 2, "threat_level_id": 4, "timestamp": 1596436455}, "54e1a7eb-4190-424f-bb4a-4d65950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Arid Viper: Gaza vs Israel Cyber Conflict by Trend Micro", "date": "2015-02-15", "analysis": 0, "threat_level_id": 4, "timestamp": 1424078242}, "55eecc81-b630-4157-b757-e538950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Carbanak gang is back and packing new guns by Eset", "date": "2015-09-08", "analysis": 2, "threat_level_id": 2, "timestamp": 1441714541}, "560994d3-73e8-4ae1-80e7-4c0c950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Gaza cybergang, where\u00e2\u20ac\u2122s your IR team? by Kaspersky", "date": "2015-09-28", "analysis": 2, "threat_level_id": 4, "timestamp": 1446737297}, "55c279fc-e814-4915-96dd-4f19950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Revealing the Cyber-Kraken (Threat Group 3390 / Emissary Panda) by SecureWorks", "date": "2015-08-05", "analysis": 2, "threat_level_id": 2, "timestamp": 1460748735}, "54379a78-dc30-4030-8481-43fe950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Evolution of the Nuclear Exploit Kit by Cisco Talos group", "date": "2014-10-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1412932562}, "55f2c05f-fdb4-4ae6-ab17-47f9950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT  Musical Chairs: Multi-Year Campaign Involving New Variant of Gh0st Malware by Palo Alto Networks Unit 42", "date": "2015-09-08", "analysis": 2, "threat_level_id": 2, "timestamp": 1441975180}, "546bbf42-8e2c-412c-8f8d-4b22950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Additional indicators relating to Sofacy (APT28) phishing blog post by PWC", "date": "2014-10-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1416348742}, "55cc400a-ee68-4aaa-b144-4d73950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Potato Ransomware\"", "relationship_type": ""}], "info": "OSINT Potao Express samples from contagiodump", "date": "2015-08-12", "analysis": 2, "threat_level_id": 2, "timestamp": 1498162722}, "563b1547-7c84-43ad-8e3a-8257950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Systematic cyber attacks against Israeli and Palestinian targets going on for a year by Norman", "date": "2012-10-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1446714074}, "55fc725a-6828-4ffe-a197-4e6f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT In Pursuit of Optical Fibers and Troop Intel: Targeted Attack Distributes PlugX in Russia by ProofPoint", "date": "2015-09-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1442836055}, "5476c461-5930-4ddb-8d40-d4ad950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#086700", "local": false, "name": "misp-galaxy:tool=\"Regin\"", "relationship_type": ""}], "info": "OSINT Regin samples shared by VirusShare", "date": "2014-11-26", "analysis": 1, "threat_level_id": 1, "timestamp": 1498163593}, "56122e52-72c0-4614-83ff-4d3c950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs by Palo Alto Networks Unit 42", "date": "2015-10-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1444034252}, "54743eaf-e1c0-47a0-b838-49d7950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Secret Malware in European Union Attack Linked to U.S. and British Intelligence article by the Intercept", "date": "2014-11-24", "analysis": 2, "threat_level_id": 1, "timestamp": 1416904507}, "56313b33-93f0-426f-99ea-26bc950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Trojan.Win32.Banker.NWT by AlienVault and Telus", "date": "2015-10-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1446102241}, "5631394c-b9b4-483b-9480-26bc950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Duuzer back door Trojan targets South Korea to take over computers by Symantec", "date": "2015-10-26", "analysis": 2, "threat_level_id": 2, "timestamp": 1446586886}, "546b1b80-904c-4534-abf1-4b36950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Analysis of DHS NCCIC Indicators blog post by Secureworks", "date": "2014-02-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1416315104}, "558401d3-130c-44db-a49a-42fa950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Poseidon And Backoff Pos \u00e2\u20ac\u201c The Links And Similarities by Team Cymru", "date": "2015-06-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1434714898}, "559d537c-f570-4e97-8154-98d9950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"WildNeutron\"", "relationship_type": ""}], "info": "OSINT Morpho: Profiting from high-level corporate attacks by Symantec", "date": "2015-07-08", "analysis": 2, "threat_level_id": 2, "timestamp": 1596436272}, "55c98ff2-f2fc-4284-8a34-f483950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT The Italian Connection: An analysis of exploit supply chains and digital quartermasters by Shadowserver", "date": "2015-08-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1439277902}, "5617efa2-569c-44f0-83d4-4d3d950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Expansion on hacking team VPS IPs using PassiveTotal by Brandon Dixon", "date": "2015-07-06", "analysis": 2, "threat_level_id": 2, "timestamp": 1444410732}, "5637cc54-f260-4394-ba51-25ae950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Case Study of Malicious Actors: Going Postal by CERT.pl", "date": "2015-10-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1450794271}, "546bba61-69d0-4c0e-8066-4942950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT ScanBox framework \u00e2\u20ac\u201c who\u00e2\u20ac\u2122s affected, and who\u00e2\u20ac\u2122s using it?  by PWC", "date": "2014-10-27", "analysis": 2, "threat_level_id": 2, "timestamp": 1416347276}, "5523e803-a6ac-4679-95ee-4382950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Winnti OpSMN new malware RE report by Novetta", "date": "2015-04-07", "analysis": 2, "threat_level_id": 2, "timestamp": 1429714640}, "553ea363-7aa4-426b-8f54-ad70950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Attacks against Israeli & Palestinian interests by PwC", "date": "2015-04-27", "analysis": 2, "threat_level_id": 2, "timestamp": 1517779399}, "555cacaa-4a44-43f0-909e-919a950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Cmstar Downloader: Lurid and Enfal\u00e2\u20ac\u2122s New Cousin by Palo Alto Unit 42", "date": "2015-05-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1432209524}, "566f4900-9da4-4ee7-b237-8a63950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT IOC from ponmocup malware", "date": "2015-12-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1450133882}, "560c0a37-28c4-4654-a507-6221950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Dyreza Campaigners Set Sights on the Fulfillment and Warehousing Industry by ProofPoint", "date": "2015-09-28", "analysis": 2, "threat_level_id": 4, "timestamp": 1443680308}, "544fee45-f108-4fa6-ace9-3989950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}], "info": "OSINT APT28: A Window into Russia\u00e2\u20ac\u2122s Cyber Espionage Operations? blog post by FireEye", "date": "2014-10-27", "analysis": 2, "threat_level_id": 2, "timestamp": 1498163533}, "555dcba2-bdd0-49d6-8c72-4e87950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}], "info": "OSINT Trend Micro Exposes LURID APT", "date": "2011-09-22", "analysis": 2, "threat_level_id": 2, "timestamp": 1432213272}, "5614b358-9c54-4b33-96f6-742d950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT A Fast and Furious Drive-By: Uncovering PTDark Attack Sites by Fortinet", "date": "2015-09-22", "analysis": 2, "threat_level_id": 4, "timestamp": 1444197633}, "54932a3e-7284-4753-b95c-4e08950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Expansion on two IPs listed in OSINT IOCs from various campaigns listed in Detecting Bleeding Edge Malware presentation at hack.lu 2014", "date": "2014-12-18", "analysis": 2, "threat_level_id": 4, "timestamp": 1517578106}, "56b06594-da3c-4126-bf81-4190950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0c9100", "local": false, "name": "admiralty-scale:source-reliability=\"f\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}], "info": "OSINT Phishing sites and exploit kits december 2015 - part 2 by TechHelpList", "date": "2015-12-15", "analysis": 2, "threat_level_id": 4, "timestamp": 1454402336}, "566f47dd-e7d4-4b1f-9f65-764f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT The Casino Malvertising Campaign by MalwareBytes", "date": "2015-11-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1450164397}, "5526b0e5-e2a4-45cd-abee-a5f5950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Analysis of KRIPTOVOR: Infostealer+Ransomware by FireEye", "date": "2015-04-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1428599627}, "54457026-e5e0-4a8f-ac1a-4d16950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT OrcaRAT - A whale of a tale blog post by PWC", "date": "2014-10-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1498161818}, "553ead98-1fb4-4ee6-a8ea-ad6d950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Enterprises Hit by BARTALEX Macro Malware in Recent Spam Outbreak by Trend Micro", "date": "2015-04-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1447449579}, "551e8745-ace0-461c-b9eb-ce36950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT The Dyre Wolf report from IBM", "date": "2015-04-03", "analysis": 2, "threat_level_id": 4, "timestamp": 1428070986}, "552b6de3-9b10-48a1-8226-c05b950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "FBI Flash Message: MC-000055-BT  EC3/IC4 takedown of the AAEH botnet", "date": "2015-04-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1428914519}, "54eecca6-27ac-4a73-b78e-4e4d950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "A deeper look into ScanBox TLP:GREEN report from PWC UK", "date": "2015-02-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1424937235}, "5642582d-78dc-4e92-b42f-6d9d950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Bookworm Trojan: A Model of Modular Architecture by Palo Alto Unit 42", "date": "2015-11-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1447223807}, "548e96bd-d008-44bb-aa77-b792950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Fidelis Threat Advisory #1014 \"Bots, Machines, and the Matrix\"", "date": "2014-12-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1418718520}, "556d5db3-e464-477f-96de-adf2950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT 'Paying-Days' CryptoWall 3.0 Campaign via Magnitude EK report by malwarefor.me", "date": "2015-05-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1433231822}, "55244f19-fc08-42e2-8cd9-42c7950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT  Threat Spotlight: Spam Served With a Side of Dridex from Cisco Talos", "date": "2015-04-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1428443031}, "55a8d7b5-9ab8-476f-982f-1e08950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#12e100", "local": false, "name": "misp-galaxy:threat-actor=\"APT 29\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trojan.Seaduke\"", "relationship_type": ""}], "info": "OSINT Tracking MiniDionis: CozyCar\u00e2\u20ac\u2122s New Ride Is Related to Seaduke by Unit 42 Palo Alto Networks", "date": "2015-07-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1498163009}, "54f8662f-c7f0-4f59-a42a-a9a9950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Analysis of malcious CHM file by OpenDNS", "date": "2015-03-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1425565791}, "55dc3064-fb18-481a-b837-58f2950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT The Curious Case of the Document Exploiting an Unknown Vulnerability \u00e2\u20ac\u201c Part 2: RATs, Hackers and Rihanna by Fortinet", "date": "2015-08-24", "analysis": 2, "threat_level_id": 4, "timestamp": 1440494667}, "55473e1b-e828-4fe9-ba30-dd1b950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Dalexis/CTB-Locker malspam campaign by SANS Internet Storm Center", "date": "2015-04-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1430732768}, "5462a024-eed8-4057-9a85-3030950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT The Rotten Tomato Campaign", "date": "2014-10-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1415888726}, "55473cb9-db8c-416e-8b3c-ce99950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Introducing HATs: Highly Annoying Threats by BlueCoat", "date": "2015-05-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1430732207}, "56266091-a774-467e-b0f8-4d9c950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Pay No Attention to the Server Behind the Proxy: Mapping FinFisher\u00e2\u20ac\u2122s Continuing Proliferation by Citizen Lab", "date": "2015-10-15", "analysis": 2, "threat_level_id": 2, "timestamp": 1450794956}, "56313e11-daf8-474d-9dae-4050950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Digging for Groundhogs: Holes in Your Linux Server by Checkpoint", "date": "2015-10-20", "analysis": 2, "threat_level_id": 4, "timestamp": 1446499605}, "54651e3e-3934-4d34-9396-956a950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Korplug military targeted attacks: Afghanistan & Tajikistan blog post from ESET", "date": "2014-11-12", "analysis": 2, "threat_level_id": 2, "timestamp": 1415914547}, "552e7e46-62f4-4908-9fd6-488f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}], "info": "OSINT The Path to Mass-Producing Cyber Attacks by FireEye", "date": "2014-09-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1511190235}, "5472f4a5-eafc-43c4-91b1-4bfe950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Evil Bunny: Suspect #4", "date": "2014-11-20", "analysis": 2, "threat_level_id": 2, "timestamp": 1416822111}, "561d8626-9214-404c-bc01-4b56950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT New Discovery: Ties Between Corebot and Darknet Crypt Service by Damballa", "date": "2015-10-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1460746480}, "559e36b0-e924-4c3d-b7a0-4a74950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT expansion on OSINT - Ding! Your RAT has been delivered by Cisco Talos", "date": "2015-07-09", "analysis": 2, "threat_level_id": 4, "timestamp": 1436432248}, "543b7c14-ec70-446e-b2f7-4620950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Democracy in Hong Kong Under Attack blog post from Volexity (Steven Adair)", "date": "2014-10-09", "analysis": 2, "threat_level_id": 2, "timestamp": 1413188258}, "553eb3d4-f9d8-4e67-8327-af9d950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Without a Trace: Fileless Malware Spotted in the Wild by Trend Micro", "date": "2015-04-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1430172678}, "55c9108c-43b4-4b9e-8cfb-4837950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0fbf00", "local": false, "name": "misp-galaxy:threat-actor=\"darkhotel\"", "relationship_type": ""}], "info": "OSINT Darkhotel\u00e2\u20ac\u2122s attacks in 2015 by Kaspersky", "date": "2015-08-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1498162829}, "555de343-19c0-42e9-b793-ab11950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Cylance SPEAR Team: A Threat Actor Resurfaces from Cylance", "date": "2015-05-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1432800092}, "55dc126c-1580-44c0-a6bd-44ba950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Tinted CVE decoy spearphising attempt on Central Bank of Armenia employees by BlueCoat", "date": "2015-08-21", "analysis": 2, "threat_level_id": 4, "timestamp": 1440491173}, "56425772-8500-45c6-9575-6056950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Macro documents with XOR Encoded Payloads by PhishMe", "date": "2015-11-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1447223941}, "56129bd3-3538-4b5a-b6b4-4a06950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT 30\"", "relationship_type": ""}], "info": "OSINT APT30 detection rules Loki Scanner Yara rules by Florian Roth", "date": "2015-04-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1521406650}, "54bf5a6f-ac50-4f71-9cd3-7080950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}], "info": "OSINT  Analysis of Project Cobra Another extensible framework used by the Uroburos\u00e2\u20ac\u2122 actors from Gdata", "date": "2015-01-20", "analysis": 2, "threat_level_id": 1, "timestamp": 1498163317}, "561d86b1-3fdc-4229-84dd-1048950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Dyre Malware Campaigners Innovate with Distribution Techniques by ProofPoint", "date": "2015-10-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1446568457}, "551e7bc4-ed74-4ff2-aef7-1888950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Additional yara rules for Equation Drug by Florian Roth", "date": "2015-04-03", "analysis": 2, "threat_level_id": 1, "timestamp": 1428090970}, "5464c1d9-3d78-434d-a936-51e4950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}], "info": "OSINT Expansion on Snake", "date": "2014-11-13", "analysis": 2, "threat_level_id": 1, "timestamp": 1498162614}, "5566caa6-0590-4956-81bf-4179950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Beware of what you download. Recent purported CEIEC document dump booby-trapped by Shadow Server", "date": "2012-04-16", "analysis": 2, "threat_level_id": 4, "timestamp": 1433229110}, "55db9387-6a70-4fdd-8fee-6e76950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Blue Termite\"", "relationship_type": ""}], "info": "OSINT New activity of the Blue Termite APT by AlienVault", "date": "2015-08-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1498162710}, "54f9a0ef-0ebc-414d-88ab-f094950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Who's Really Spreading through the Bright Star? by Securelist / Kaspersky", "date": "2015-03-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1425646275}, "54931e3e-01d8-46fb-b801-2601950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT 20141029B: Possible RedOctober APT Resurgence from ThreatConnect", "date": "2014-12-18", "analysis": 2, "threat_level_id": 1, "timestamp": 1418929754}, "560c1c35-fd9c-4fb4-9a93-801b950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT When ELF.BillGates met Windows by Arkoon+Netasq", "date": "2015-09-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1443681822}, "55c7524c-e510-453a-93dc-c2c9950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Operation Molerats: Middle East Cyber Attacks Using Poison Ivy by Fire Eye", "date": "2013-08-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1498161545}, "55ed7c41-5a68-4307-8184-43bc950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Threat Research Team Goes \u00e2\u20ac\u0153Beyond the Exploit\u00e2\u20ac\u009d in Search of Payloads from MS15-093 by bit9", "date": "2015-09-04", "analysis": 2, "threat_level_id": 4, "timestamp": 1441627379}, "54ec3439-7154-48e4-ae1e-4c1c950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT A deeper look into ScanBox TLP:WHITE report from PWC UK", "date": "2015-02-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1434353282}, "55f93f51-b288-4da8-b9eb-4416950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT The Shade Encryptor: a Double Threat by Kaspersky", "date": "2015-09-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1442405974}, "56b06135-452c-4b99-bd16-4981950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Puttering into the Future...by Cylance", "date": "2016-01-12", "analysis": 2, "threat_level_id": 1, "timestamp": 1454401048}, "55e6bb38-180c-4497-afd6-601a950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT KeyRaider: iOS Malware Steals Over 225,000 Apple Accounts to Create Free App Utopia by Palo Alto Networks Unit 42", "date": "2015-08-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1444718728}, "564264fe-1794-4894-878f-68b5950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT CryptoWall v4 Emerges Days After Cyber Threat Alliance Report by Palo Alto Networks Unit 42", "date": "2015-11-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1447223857}, "54d39595-f1e4-4823-8ad4-4ef2950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT  In-Depth Look: APT Attack Tools of the Trade blog post by Trend Micro", "date": "2013-03-04", "analysis": 2, "threat_level_id": 4, "timestamp": 1423152758}, "55014406-fd90-4fc1-a814-4638950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Tibetan Uprising Day Malware Attacks by Citizen Labs", "date": "2015-03-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1426147474}, "547311c0-3fdc-4968-85fa-058d950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Roaming tiger by Anton Cherepanov from ESET", "date": "2014-11-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1416828155}, "54932814-7834-4667-8b08-4c2f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT 20141107B: Operation Poisoned Handover by ThreatConnect", "date": "2014-11-03", "analysis": 2, "threat_level_id": 4, "timestamp": 1418930421}, "55749a9b-1880-4351-803c-47fc950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Angler EK: More Obfuscation, Fake Extensions, and Other Nonsense by Talos", "date": "2015-06-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1433705472}, "54b4edfc-7f48-4b02-b488-4f83950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT DTL-12012015-01: Hong Kong SWC attack from Dragon Threat Labs", "date": "2015-01-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1487758001}, "54e1a3f3-be8c-4840-88ce-f2d9950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT MSRT February update from Microsoft", "date": "2015-02-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1424074675}, "55fff330-003c-4c9b-96ed-44b7950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Password Hygiene: Hiding Your Identity is Difficult for Attackers and Adulterers by Threat Geek", "date": "2015-09-18", "analysis": 2, "threat_level_id": 4, "timestamp": 1442838102}, "546481a0-fc90-4aa4-8508-4a68950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Adobe Zero-day Used in LadyBoyle Attack blog post by Symantec", "date": "2013-02-08", "analysis": 2, "threat_level_id": 2, "timestamp": 1415874584}, "557fddba-87c0-4ac1-a79a-a56f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Targeted Attacks against Tibetan and Hong Kong Groups Exploiting CVE-2014-4114 by Citizen Lab", "date": "2015-06-15", "analysis": 2, "threat_level_id": 2, "timestamp": 1441971856}, "55bb31a3-dcf4-4731-acdd-4851950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Exploring .XYZ (Another Shady TLD Report) by Blue Coat", "date": "2015-07-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1438331478}, "54e590ba-cccc-46a6-87a3-3d1f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Babar: espionage software finally found and put under the microscope by gdata", "date": "2015-02-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1424336012}, "56b06dc5-2cac-46c1-9827-40f7950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#0eb100", "local": false, "name": "admiralty-scale:information-credibility=\"1\"", "relationship_type": ""}], "info": "OSINT Neutrino Exploit Kit \u00e2\u20ac\u201c One Flash File to Rule Them All by SpiderLabs", "date": "2015-12-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1454408491}, "56240d98-a524-4386-8e43-8371950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites by Citizen Labs", "date": "2015-10-16", "analysis": 2, "threat_level_id": 2, "timestamp": 1450794987}, "56c18ccb-4c10-49ee-bf65-4b54950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}], "info": "Additional IPs for Turla/Uroburos from CIRCL Passive SSL", "date": "2016-02-13", "analysis": 2, "threat_level_id": 1, "timestamp": 1498162425}, "55355951-0354-4d8a-8148-1bf9950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}], "info": "OSINT The Sofacy plot thickens by PwC", "date": "2015-04-20", "analysis": 2, "threat_level_id": 2, "timestamp": 1498163079}, "5566bfdf-e550-4b40-8178-4b27950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT The Teenage Mutant Malvertiser Network by FireEye", "date": "2015-05-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1432797888}, "55a76999-52e4-45c0-ac44-2ce2950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT An In-Depth Look at How Pawn Storm\u00e2\u20ac\u2122s Java Zero-Day Was Used by Trend Micro", "date": "2015-07-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1454273686}, "55bb3422-c610-4b66-aa54-4533950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Angler's best friends by SANS ISC Diary", "date": "2015-07-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1438332041}, "548033ca-5854-45f3-bf00-797e950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#086700", "local": false, "name": "misp-galaxy:tool=\"Regin\"", "relationship_type": ""}], "info": "Regin Scanner", "date": "2014-12-04", "analysis": 2, "threat_level_id": 1, "timestamp": 1521409802}, "54b8caf4-0830-44b3-b460-4662950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Backdoor.Win32.Shiz from Lavasoft", "date": "2012-08-14", "analysis": 2, "threat_level_id": 4, "timestamp": 1421401757}, "545b456e-b8a4-45e0-a895-41c7950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Banking Trojan DRIDEX Uses Macros for Infection blog post from Trend Micro", "date": "2014-11-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1415269308}, "555ddeca-3ecc-40e3-9ebd-177c950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Trojanized PuTTY Software by Cisco CSIRT", "date": "2015-05-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1432215514}, "56af46bd-e4d0-4bf8-aa4a-4228950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Threat Actors Use Sketchy Dating Website to Launch New Home Router Attacks by Damballa", "date": "2016-01-20", "analysis": 2, "threat_level_id": 1, "timestamp": 1454339053}, "55e55686-ec88-4cba-a1bb-4b06950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Defending the White Elephant by Arbor Networks", "date": "2015-08-31", "analysis": 2, "threat_level_id": 2, "timestamp": 1441634032}, "56af2d05-bff0-4753-b2ed-4074950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Introducing Hi-Zor RAT by Fidelis", "date": "2016-01-27", "analysis": 2, "threat_level_id": 1, "timestamp": 1464346759}, "5464bf96-1f14-43f1-af86-08ce950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Expansion on Rotten Tomato campaign", "date": "2014-11-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1415889173}, "54cb3580-cde4-4b39-bf8c-443f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT New 'f0xy' malware is intelligent - employs cunning stealth & trickery from Websense", "date": "2015-01-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1422603841}, "552e76b6-3b44-410e-a0a9-4fec950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}], "info": "OSINT Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets by Palo Alto Unit42", "date": "2015-04-14", "analysis": 2, "threat_level_id": 4, "timestamp": 1429110761}, "559f66e6-6e10-468f-9025-81c0950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT OSX/Pintsized Backdoor Additional Details by Zataz / Eric Romang", "date": "2013-03-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1439887174}, "55f5e10a-e830-4732-9b4f-30d0950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT A Peek Inside an Affiliate\u00e2\u20ac\u2122s Malspam Operation: Kovter and Miuref/Boaxxe Infections by PhishMe", "date": "2015-09-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1442177366}, "543cf0a2-e1d8-4c20-bb05-9177950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Shellshock exploitation from Red Sky Weekly blog post", "date": "2014-10-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1413280400}, "55014970-d82c-4b60-ba8e-0958950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Hacking Team Reloaded? US-Based Ethiopian Journalists Again Targeted with Spyware by Citizen Lab", "date": "2015-03-09", "analysis": 2, "threat_level_id": 4, "timestamp": 1426151431}, "5474459d-1c60-456a-b057-4bdc950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Operation Double Tap from FireEye", "date": "2014-11-21", "analysis": 2, "threat_level_id": 2, "timestamp": 1422269529}, "5485615b-86f4-4385-a7a3-f894950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Assorted IOCs associated to Andromeda restlesz.su domain", "date": "2014-12-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1418028082}, "551e7a4b-3774-4565-b850-7455950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT APT Volatile Cedar APT yara rules by Florian Roth", "date": "2015-04-03", "analysis": 2, "threat_level_id": 2, "timestamp": 1487757919}, "555dd7c9-2234-44d6-8604-a479950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Attacks on East Asia using Google Code for Command and Control by Palo Alto Unit 42", "date": "2014-08-15", "analysis": 0, "threat_level_id": 1, "timestamp": 1432213916}, "557e78b6-91ec-4123-87df-424f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT  Evilgrab Delivered by Watering Hole Attack on President of Myanmar\u00e2\u20ac\u2122s Website by Palo Alto Unit 42", "date": "2015-06-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1434353143}, "54323f2c-e50c-4268-896c-4867950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks", "date": "2014-10-03", "analysis": 2, "threat_level_id": 2, "timestamp": 1412579577}, "54652711-e734-48c2-bf1f-956a950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "Expansion on OSINT Korplug military targeted attacks: Afghanistan & Tajikistan blog post from ESET by using whois registrant", "date": "2014-11-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1460748479}, "544937d7-6a24-4911-a6cd-473e950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Expansion on OSINT Operation Pawn Storm: The Red in SEDNIT from Trend Micro", "date": "2014-10-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1414194068}, "56095579-6aa0-403c-8ac3-409b950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Expansion on MWI by security researcher", "date": "2015-09-25", "analysis": 2, "threat_level_id": 2, "timestamp": 1443452772}, "5534af90-2ce8-4f20-a767-286d950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "20150415D: Fareit Malware Targeting Steam Users from ThreatConnect", "date": "2015-04-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1429516452}, "57726912-97ac-432c-8651-acb0950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}], "info": "Pivot on other email addresses found by using the same physical address as support-apple-id.com - potential sofacy", "date": "2016-06-28", "analysis": 2, "threat_level_id": 1, "timestamp": 1467116221}, "57725e7b-e9b0-4e60-9c7d-041d950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}], "info": "Pivot around IP 193.109.68.87 (from ns1.carbon2u.com) - potential Sofacy", "date": "2016-06-28", "analysis": 2, "threat_level_id": 4, "timestamp": 1467481137}, "546daad5-425c-4ac4-82c7-e07f950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}], "info": "Turla digging using TotalHash", "date": "2014-11-20", "analysis": 2, "threat_level_id": 2, "timestamp": 1498163604}, "54eee0da-d1c8-441e-a760-3839950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Fessleak before It Was Cool by OpenDNS", "date": "2015-02-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1424959168}, "55d58a12-3644-4378-8ca9-44a6950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT  Cheshire Cat", "date": "2015-08-20", "analysis": 0, "threat_level_id": 1, "timestamp": 1440060835}, "5534e822-0e78-4eea-aea8-4ac3950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}], "info": "Expansion based on shared nameserver with a lot of Sofacy domains", "date": "2015-04-20", "analysis": 2, "threat_level_id": 2, "timestamp": 1532518171}, "54731605-821c-48c2-b74b-5701950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Expansion based on pDNS + whois from OSINT Roaming tiger by Anton Cherepanov from ESET", "date": "2014-11-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1417163011}, "57113e3b-2424-44de-9686-4bc8950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#1eed40", "local": false, "name": "expansion:whois-registrant-email", "relationship_type": ""}, {"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}], "info": "Expansion on 596552@qq.com", "date": "2016-04-15", "analysis": 2, "threat_level_id": 2, "timestamp": 1460747945}, "560a3ca1-e110-476e-b730-4765950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Infected Korean Website Installs Banking Malware by Cyphort", "date": "2015-09-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1443511856}, "5500579e-e1b4-43fe-b7c5-73da950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#096b00", "local": false, "name": "misp-galaxy:tool=\"EquationDrug\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Equation Group\"", "relationship_type": ""}], "info": "OSINT Backdoor.Win32.Equationdrug.A report by Telus", "date": "2015-02-19", "analysis": 0, "threat_level_id": 1, "timestamp": 1498163215}, "564e4138-6e64-4a52-8388-4531950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Enrichment on OSINT - STRONTIUM: A profile of a persistent and motivated adversary", "date": "2015-11-19", "analysis": 0, "threat_level_id": 1, "timestamp": 1448030130}, "54b62236-69d4-4154-854a-4862950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Cridex, Feodo, Geodo, Dridex, whats next? by abuse.ch", "date": "2014-09-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1421222846}, "5464a711-55dc-4416-aad2-4aba950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Black Energy 2 malware analysis blog post by Joseph Mlodzianowski", "date": "2014-10-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1444059767}, "566067e0-5c54-45b4-8dff-4fae950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Yara rules for GlassRAT in Loki IOC Scanner by Florian Roth", "date": "2015-11-23", "analysis": 2, "threat_level_id": 4, "timestamp": 1449158765}, "56af4bee-eeb4-4145-b10f-4c7e950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Android.Bankosy: All ears on voice call-based 2FA by Symantec", "date": "2016-01-16", "analysis": 2, "threat_level_id": 1, "timestamp": 1454339028}, "55dc2f59-7238-468a-8956-575e950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT RTF Exploit Installs Italian RAT: uWarrior by Palo Alto", "date": "2015-08-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1440494650}, "56580480-2738-4888-98be-b742950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT Expansion on APT-28 - Evolving Threats: dissection of a Cyber-Espionage attack", "date": "2015-11-27", "analysis": 0, "threat_level_id": 1, "timestamp": 1448612175}, "56b06cf0-ac30-4472-93dd-44ce950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0c9100", "local": false, "name": "admiralty-scale:source-reliability=\"f\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}], "info": "OSINT phishing sites and php kits - February 2016 - Part 1 by TechHelpList", "date": "2016-02-02", "analysis": 2, "threat_level_id": 4, "timestamp": 1454402927}, "54504af8-1394-43b4-a97d-a3ab950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "OSINT Emerging Threat Alert - CVE-2014-4114 blog post by Cylance", "date": "2014-10-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1414548362}, "560460c7-a840-4949-a92e-3c09950d210b": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Meet GreenDispenser: A New Breed of ATM Malware by ProofPoint", "date": "2015-09-24", "analysis": 2, "threat_level_id": 4, "timestamp": 1443162075}, "57aaeefd-0bd4-4a41-87ad-4e17950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}], "info": "OSINT - Cracking Orcus RAT", "date": "2016-08-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1470822036}, "57ab2b08-fcd8-48b2-ba43-4cf3950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT EFF Report Operation Manul", "date": "2016-08-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1471440537}, "57adad28-ac28-49f0-b8d5-7495950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT New C2 \u00e2\u20ac\u201c Neutrino Exploit Kit via pseudoDarkleech HOPTO.ORG gate delivers CrypMic Ransomware by Broad Analysis", "date": "2016-08-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1471000487}, "57b320b4-4e08-44aa-89b9-428a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-16 (.wsf in .zip) - campaign: 'Blank 2'", "date": "2016-08-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1471357948}, "57b3273b-7588-4042-9276-4eb4950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Rule to detect KirBi ticket for Mimikatz by Benjamin Delpy with Contribution of Didier Stevens", "date": "2016-08-13", "analysis": 2, "threat_level_id": 4, "timestamp": 1471358862}, "57b327b9-18c8-40f9-b5b8-4bf8950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Additional yara rules for detection Project Sauron by Florian Roth", "date": "2016-08-10", "analysis": 2, "threat_level_id": 1, "timestamp": 1471359151}, "57b47152-b938-42f7-aa36-4bf1950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT Generic Yara rule to detect PlugX by Jay DiMartino", "date": "2016-08-17", "analysis": 2, "threat_level_id": 2, "timestamp": 1471443370}, "57b472bd-2dc0-4304-90a6-4ad4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-17 (.docm) - campaign: \"Order Confirmation-\"", "date": "2016-08-17", "analysis": 0, "threat_level_id": 3, "timestamp": 1471443742}, "57b4b374-aa14-40c1-9518-4dde02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Operation Ghoul: targeted attacks on industrial and engineering organizations", "date": "2016-08-17", "analysis": 2, "threat_level_id": 2, "timestamp": 1471617534}, "57b57c2f-9218-4138-bd36-48e4950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT Potential CNC base on CCNE activities described in NSA document leak", "date": "2015-01-17", "analysis": 2, "threat_level_id": 4, "timestamp": 1471511981}, "57b585fe-ae40-42d8-bdd7-49d9950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0eb000", "local": false, "name": "misp-galaxy:tool=\"Vawtrak\"", "relationship_type": ""}], "info": "OSINT Vawtrak C2 \u00e2\u20ac\u201c Pin it by Threat Geek", "date": "2016-08-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1498162279}, "57b586d3-6c68-4343-9d27-46f3950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT SSH bruteforce logs from burberry user on AlienVault OTX", "date": "2016-08-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1471514641}, "57b5892a-bfd8-49f1-8d6b-4a3d950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Rex -Linux P2P Ransom botnet by This Is Security blog", "date": "2016-08-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1471959167}, "57b58ade-2da0-4f50-98b3-4846950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}], "info": "OSINT Snakes in the Satellites: On-going Turla Infrastructure by PassiveTotal", "date": "2016-08-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1498162260}, "57b5a125-6cd0-4060-926d-4bf7950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT TorrentLocker Ransomware Email IoCs 8/16/2016 by neonPrimeTime user on AlienVault OTX", "date": "2016-08-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1471521471}, "57b5a32c-b744-4674-b727-4cb2950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT  Aveo Malware Family Targets Japanese Speaking Users by Palo Alto networks Unit 42", "date": "2016-08-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1471522208}, "57b5a522-573c-48d1-83e4-46bf950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Pivot on whois registrant 844148030@qq.com", "date": "2016-08-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1498162190}, "57b5a6a6-334c-4a50-9e23-45b0950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT Shark Ransomware: Ransomware as a service", "date": "2016-08-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1471522796}, "57b5a864-be78-4eba-af85-4608950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT Shakti Trojan: Document Thief  by Malwarebytes", "date": "2016-08-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1471523562}, "57b5ac3c-6780-4f9c-8734-4e8e950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "Pivot on Shakti domains via PassiveTotal", "date": "2016-08-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1471524404}, "57b5adc4-9f48-4cb4-9a0b-4471950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-18 (.wsf in .zip) - campaign: \"Emailing: Label\"", "date": "2016-08-18", "analysis": 0, "threat_level_id": 3, "timestamp": 1471524564}, "57b5b7eb-208c-4c32-ae59-4ec2950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT Bad News Bears - Panda Banker Starts Looking More Like a Grizzly by ProofPoint", "date": "2016-08-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1471529176}, "57b5bfb6-f0d8-4a7e-b860-4ca6950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT Android Marcher: Continuously Evolving Mobile Malware by Zscaler", "date": "2016-08-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1471529136}, "57b5c11a-d2a0-455f-b409-4851950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT Domains and IPs involved in JS ransomware delivered through email by burberry on AlienVault OTX", "date": "2016-08-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1471529300}, "57bc3c97-4468-4077-b757-8d97950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-23 (.wsf in .zip) - campaign: \"New voice mail message from [RANDOM]\"", "date": "2016-08-23", "analysis": 0, "threat_level_id": 3, "timestamp": 1471962376}, "57bd7251-390c-4ee2-accd-4f69950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-24 (.js in .zip) - campaign: \"Statement\"", "date": "2016-08-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1472041325}, "57bd9b3a-c354-481c-b414-424e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-24 (.hta in .zip) - campaign: \"Emailing{N}.jpg\"", "date": "2016-08-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1472051070}, "57bea9ac-bb00-4243-be64-bbe9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-25 (.js in .zip) - campaign: \"Contract\"", "date": "2016-08-25", "analysis": 0, "threat_level_id": 3, "timestamp": 1472113472}, "57bf5c07-6b40-428e-8f68-4a9a02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "The Million Dollar Dissident - Citizen lab report", "date": "2016-08-25", "analysis": 2, "threat_level_id": 1, "timestamp": 1472160818}, "57c067b5-4cf0-480d-9409-496d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-26 (.wsf in .zip) - campaign: \"Voice Message from Outside Caller\"", "date": "2016-08-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1472227497}, "57c06b68-3140-4c25-9335-4724950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-26 (.js in .zip) - campaign: \"office equipment\"", "date": "2016-08-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1472228334}, "57c405cd-ab54-47b8-9eff-7a52950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0da700", "local": false, "name": "misp-galaxy:tool=\"Dridex\"", "relationship_type": ""}], "info": "OSINT - Dridex Returns To Action For Smaller, More Targeted Attacks", "date": "2016-08-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1497647635}, "57c4240d-f048-4702-9aed-800e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-29 (.js in .zip) - campaign: \"Commission\"", "date": "2016-08-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1472472317}, "57c42744-662c-4f6e-bd21-7d2e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-29 (.wsf in .zip) - campaign: \"Please find attached invoice no\"", "date": "2016-08-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1472481466}, "57c43d9b-61a4-43b7-985b-4558950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-26 (.js in .zip) - campaign: \"monthly report\"", "date": "2016-08-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1472479098}, "57c52bbb-6a08-4121-951c-417c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - German Speakers Targeted by SPAM Leading to Ozone RAT", "date": "2016-08-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1472540179}, "57c4445b-c548-4654-af0b-4be3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Ransomware - Xorist", "date": "2016-08-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1472541011}, "57c4400e-1420-46f0-8837-41d7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Bitcoinminer installed by malware", "date": "2016-08-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1472543614}, "57c6aa95-f274-4fcf-8007-b664950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-31 (.hta in .zip) - campaign: \"FW: [Scan]\"", "date": "2016-08-31", "analysis": 0, "threat_level_id": 3, "timestamp": 1472637755}, "57c6ac4c-c60c-4f79-a38f-b666950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam 2016-08-31 (.wsf in .zip) - campaign: \"Image|Picture|Photos|Photo|Document\"", "date": "2016-08-31", "analysis": 0, "threat_level_id": 3, "timestamp": 1472638251}, "57c6cb1f-5d40-49cc-a24a-4cb2950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-08-31 (.js in .zip) - campaign: \"bank transactions\"", "date": "2016-08-31", "analysis": 0, "threat_level_id": 3, "timestamp": 1472646497}, "57c7d398-3440-41b9-8339-4e1e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-01 (.js in .zip) - campaign: \"flight tickets\"", "date": "2016-09-01", "analysis": 0, "threat_level_id": 3, "timestamp": 1472713799}, "57c7d69f-2d14-4235-ad06-4b13950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-01 (.hta in .zip) - campaign: \"Voice Message from Outside Caller\"", "date": "2016-09-01", "analysis": 0, "threat_level_id": 3, "timestamp": 1472714604}, "57c821ca-f2ac-43e7-a2e4-4470950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-01 (.wsf in .zip) - campaign: \"Please find attached invoice no:\"", "date": "2016-09-01", "analysis": 0, "threat_level_id": 3, "timestamp": 1472734150}, "57c8398d-2238-41df-bbc7-45b7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malware Posing as Human Rights Organizations and Commercial Software Targeting Iranians, Foreign Policy Institutions and Middle Eastern Countries (ExtremeDownloader and Strealer)", "date": "2016-09-01", "analysis": 1, "threat_level_id": 1, "timestamp": 1472740516}, "57c98935-5fdc-4632-8d61-4af1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-02 (.wsf in .zip) - campaign: \"icloud.com\"", "date": "2016-09-02", "analysis": 0, "threat_level_id": 3, "timestamp": 1472825949}, "57cd5a06-59e0-44a8-9200-3306950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-05 (.js in .zip) - campaign: \"Credit card receipt\"", "date": "2016-09-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1473076199}, "57cd8beb-79e4-4497-931f-4249950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-05 (.wsf in .zip)", "date": "2016-09-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1473091137}, "57ceb0ac-a22c-4bdd-835b-4404950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-06 (.js in .zip) - campaign: \"August invoice\"", "date": "2016-09-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1473163484}, "57ceb43f-b180-449b-a0d6-4afe950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-06 (.js in .zip) - campaign: \"copies\"", "date": "2016-09-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1473164373}, "57ceb5e1-bd08-4fbb-9967-4b68950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#770095", "local": false, "name": "ms-caro-malware:malware-platform=\"Win32\"", "relationship_type": ""}, {"colour": "#790097", "local": false, "name": "ms-caro-malware:malware-platform=\"Win64\"", "relationship_type": ""}], "info": "Malspam 2016-09-06 (.wsf in .zip) - campaign: \"Invoice INV[x]\"", "date": "2016-09-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1473164823}, "57ce65d3-6170-47b5-8f3f-47e0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2f5400", "local": false, "name": "malware_classification:malware-category=\"Rootkit\"", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}], "info": "OSINT - Pok\u00c3\u00a9mon-themed Umbreon Linux Rootkit Hits x86, ARM Systems", "date": "2016-09-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1473253790}, "57cec781-097c-4ed2-9dd0-7014950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#1f3f00", "local": false, "name": "circl:incident-classification=\"system-compromise\"", "relationship_type": ""}, {"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}], "info": "SQLi vuln sites - 2015-08-12 - origin: pastebin.com/23fDLE1G", "date": "2016-09-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1753868986}, "57cfb3b1-dc58-4960-8b55-42fc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-06 (.js in .zip) - campaign: \"Suspected Purchases\"", "date": "2016-09-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1473229855}, "57cfbf0c-c790-4257-8b1e-06cc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-06 (.wsf in .zip) - campaign: 'Message from \"CUKPR[x]\"'", "date": "2016-09-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1473232777}, "57cfd99f-ad68-4ebf-802f-06cc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-07 (.js in .zip) - campaign: \"Agreement form\"", "date": "2016-09-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1473239644}, "57d15dca-ccd0-4e18-b2c5-e6b5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-08 (.wsf in .zip) - campaign: \"New voice mail message from\"", "date": "2016-09-08", "analysis": 0, "threat_level_id": 3, "timestamp": 1473338915}, "57d24ef7-1258-4e36-a571-43c9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-08 (.wsf in .zip) - campaign: icloud.com", "date": "2016-09-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1473400683}, "57d283a1-9528-4be3-9553-46e5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-09 (.hta in .dzip) - campaign: \"Order confirmation\"", "date": "2016-09-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1473425232}, "57d2cf18-fa64-4a18-978e-4b6e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-09 (.wsf in .zip) - campaign: \"Documents Requested\"", "date": "2016-09-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1473435763}, "57d3fee7-b838-4ac0-a575-4f45950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - The Dukes R&D Finds a New Anti-Analysis Technique", "date": "2016-09-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1473511326}, "57d6b9d9-5b3c-4d03-b7a7-4ed2950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-12 (.js in .zip) - campaign: \"Budget report\"", "date": "2016-09-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1473690263}, "57d6c85d-01c8-41ba-8ec2-40e7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-12 (.wsf in .zip) - campaign: \"Photo|Image\"", "date": "2016-09-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1473742032}, "57d8036b-cd24-431c-bfbf-4ff4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-13 (.hta in .zip) - campaign: \"Accounts Documentation - Invoices\"", "date": "2016-09-13", "analysis": 0, "threat_level_id": 3, "timestamp": 1473838399}, "57d91b04-fabc-46fe-8d05-441d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-14 (.wsf in .zip) - campaign: \"Account report\"", "date": "2016-09-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1473846038}, "57d91d75-0f30-4939-b8dd-48fd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-14 (.wsf in .zip) - campaign: \"payment copy\"", "date": "2016-09-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1473846773}, "57d9227b-d318-4c5a-9045-4fc3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-14 (.wsf in .zip) - campaign: \"Tax invoice\"", "date": "2016-09-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1473847978}, "57d94b0f-ffd4-4363-945d-45f0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-14 (.js in .zip) - campaign: \"Delivery Confirmation\"", "date": "2016-09-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1473858364}, "57da503b-ae50-4ae2-8f34-1890950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-15 (.wsf in .zip) - campaign: \"Documents Requested\"", "date": "2016-09-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1473925331}, "57dab16c-f32c-4634-b9f1-1b70950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-15 (.wsf in .zip) - campaign: \"SCAN\"", "date": "2016-09-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1473950155}, "57db9b97-4ad8-41d7-8c98-4cbb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-16 (.hta in .zip) - campaign: \"(Attached|Emailing|Copy|File): (Scan|Receipt|Document)(integer)\"", "date": "2016-09-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1474010070}, "57db9e5a-8178-469b-8e29-4e5d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-15 (.js in .zip) - campagin: \"Booking confirmation\"", "date": "2016-09-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1474010755}, "57dba07b-c36c-4d98-88ac-450e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-16 (.js in .zip) - campaign: \"Re: request\"", "date": "2016-09-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1474011291}, "57dbb75c-4ebc-4856-96fc-4095950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}], "info": "OSINT - ELF.Rex", "date": "2016-09-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1474017220}, "57dc1fe4-0d70-4dde-95fe-46e8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-16 (.wsf in .zip) - campaign: \"(SCAN|FAX|DOC|IMG)_{integer}\"", "date": "2016-09-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1474046097}, "57dfad33-41c0-4000-8d94-4149950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-19 (.js in .zip) - campaign: \"Express Parcel service\"", "date": "2016-09-19", "analysis": 0, "threat_level_id": 3, "timestamp": 1474276807}, "57dfe878-f93c-4eaa-baa9-085f0a950b0c": {"Orgc": {"name": "NCSC-NL", "uuid": "5697b0c4-9474-4336-b675-28140a950b0b"}, "Tag": [{"colour": "#ab022a", "local": false, "name": "Dridex", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#770095", "local": false, "name": "ms-caro-malware:malware-platform=\"Win32\"", "relationship_type": ""}, {"colour": "#76d2b6", "local": false, "name": "ncsc-nl-ndn:feed=\"selected\"", "relationship_type": ""}], "info": "Dridex IoC's", "date": "2016-09-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1607523239}, "57dff9a6-b4b0-4e79-9271-4a10950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Malicious Macros Add Sandbox Evasion Techniques to Distribute New Dridex", "date": "2016-09-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1474296530}, "57e0c08d-4330-42c0-9c8f-4c8d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-20 (.hta in .zip) - campaign: \"<no subject>\"", "date": "2016-09-20", "analysis": 0, "threat_level_id": 3, "timestamp": 1474347285}, "57e0ee94-dd30-4dc3-9d60-4758950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#4a005d", "local": false, "name": "ms-caro-malware:malware-type=\"Spammer\"", "relationship_type": ""}], "info": "OSINT - Tofsee \u00e2\u20ac\u201c modular spambot", "date": "2016-09-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1474361163}, "57e634d4-4e48-4a7b-82de-46be950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Hunting Libyan Scorpions", "date": "2016-09-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1526395066}, "57ea2a19-2e44-4f1b-b6f5-46bb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Sofacy\u00e2\u20ac\u2122s \u00e2\u20ac\u02dcKomplex\u00e2\u20ac\u2122 OS X Trojan by Palo Alto networks", "date": "2016-09-26", "analysis": 2, "threat_level_id": 1, "timestamp": 1493024705}, "57ea66db-7dd0-4c43-823f-4d2a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-27 (.wsf in .zip) - campaign: \"{integer}.zip\"", "date": "2016-09-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1474979611}, "57ee144e-ad24-4175-ba0e-4943950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-30 (.wsf in .zip) - campaign: \"Emailing\"", "date": "2016-09-30", "analysis": 0, "threat_level_id": 3, "timestamp": 1475220594}, "57ee18f8-a0c4-433a-b4fa-4e72950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-29 (.xls) - campaign: \"Receipt\"", "date": "2016-09-30", "analysis": 0, "threat_level_id": 3, "timestamp": 1475221787}, "57ee6d8c-0650-4c8a-9dfa-4f31950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-30 (.wsf in .zip) - campaign: \"Parcel details\"", "date": "2016-09-30", "analysis": 0, "threat_level_id": 3, "timestamp": 1475243441}, "57ee6fdf-1e58-4cbe-8de1-4287950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-09-30 (.doc) - campaign: \"Receipt\"", "date": "2016-09-30", "analysis": 0, "threat_level_id": 3, "timestamp": 1475245622}, "57ef6d48-20c8-4e55-9f02-468f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#32003e", "local": false, "name": "ms-caro-malware:malware-type=\"DDoS\"", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Mirai\"", "relationship_type": ""}], "info": "OSINT - Investigation of Linux.Mirai Trojan family", "date": "2016-10-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1475309569}, "57f239a3-9ac0-4261-8678-73f0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-10-03 (.xls) - campaign: \"[Scan]\"", "date": "2016-10-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1475500804}, "57f26f87-fbc8-4b7b-be64-6e88950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-10-03 (.xls) - campaign: \"Invoice-\"", "date": "2016-10-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1475555918}, "57f64039-dec0-4c41-b2eb-42e7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-10-06 (.js in .zip) - campaign: \"Your Order\"", "date": "2016-10-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1475760715}, "57f74bd6-915c-43db-8a24-4d93950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-10-07 (.js in .zip) - campaign: \"wrong paychecks\"", "date": "2016-10-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1475825853}, "57fc8ec7-2c10-4c24-8565-452002de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - How Stampado Ransomware Analysis Led To Yara Improvements", "date": "2016-10-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1476169628}, "57fddaac-da34-43f7-8844-4430950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Odinaff: New Trojan used in high level financial attacks", "date": "2016-10-12", "analysis": 2, "threat_level_id": 2, "timestamp": 1476260248}, "57fdfd37-72a8-4308-a5e2-4b98950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Spam 2016-10-12 (mule acquisition) - probably related to Locky resources", "date": "2016-10-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1476273211}, "58007f1d-7a4c-4887-ba33-c28b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Spam 2016-10-14 (mule acquisition) - probably related to Locky resources", "date": "2016-10-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1476454699}, "580138b8-23f8-4c51-b788-4f3702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "ELF Linux/NyaDrop", "date": "2016-10-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1476475422}, "58030b52-b52c-41e7-93f6-43ae950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Spam 2016-10-16 (mule acquisition) - probably related to Locky resources", "date": "2016-10-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1476594574}, "58046227-00a0-47fb-a125-c025950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Spam week 43 (mule acquisition) - probably related to Locky resources", "date": "2016-10-17", "analysis": 0, "threat_level_id": 3, "timestamp": 1477059258}, "5809fbe9-c034-41a2-999f-450a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#4bec00", "local": false, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Malspam delivers NanoCore RAT", "date": "2016-10-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1477049683}, "580b201b-3e30-4bb1-ac2e-427202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#000000", "local": false, "name": "dnc:malware-type=\"Ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT -  The new .LNK between spam and Locky infection", "date": "2016-10-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1477124343}, "580dabb4-0938-48b7-abf9-4e37950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - TeamXRat: Brazilian cybercrime meets ransomware", "date": "2016-09-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1477291239}, "580dc270-81d8-49fa-91cd-417d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Malspam week 44 (2016-10-24) - Locky ('Sebek')", "date": "2016-10-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1477297430}, "580f62f3-271c-4ba1-8b07-4c0d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}], "info": "OSINT - Lifting the lid on Sednit: A closer look at the software it uses", "date": "2016-10-25", "analysis": 2, "threat_level_id": 2, "timestamp": 1493024659}, "580fcef3-28fc-42e2-aec1-4978950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Houdini\u00e2\u20ac\u2122s Magic Reappearance", "date": "2016-10-25", "analysis": 2, "threat_level_id": 2, "timestamp": 1477431385}, "5813ad13-c2fc-427d-b284-44cd02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Octopus-Rex. Evolution of a multi task Botnet", "date": "2016-10-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1477684924}, "5813b05e-cd38-401b-8b21-449502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - BLACKGEAR Espionage Campaign Evolves, Adds Japan To Target List", "date": "2016-10-28", "analysis": 2, "threat_level_id": 2, "timestamp": 1477685836}, "58179275-f030-4dce-a626-4c9802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#10c500", "local": false, "name": "misp-galaxy:threat-actor=\"Lotus Blossom\"", "relationship_type": ""}], "info": "OSINT - PSA: Conference Invite used as a Lure by Operation Lotus Blossom Actors", "date": "2016-10-31", "analysis": 2, "threat_level_id": 2, "timestamp": 1477941449}, "5819948b-b170-4872-b8f6-5934950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#043400", "local": false, "name": "misp-galaxy:tool=\"PlugX\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Flying Dragon Eye: Uyghur Themed Threat Activity", "date": "2016-11-02", "analysis": 2, "threat_level_id": 2, "timestamp": 1478073601}, "581efd8c-7320-42e1-93b6-430102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#380046", "local": false, "name": "ms-caro-malware:malware-type=\"HackTool\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}], "info": "Yara Rule Set - detection of Empire by Florian Roth (PowerShell and Python post-exploitation agent.)", "date": "2016-11-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1478426853}, "581fadbd-7acc-4907-9133-4380950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Veil-Framework Infects Victims of Targeted OWA Phishing Attack", "date": "2016-11-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1478520976}, "582176fc-def0-44a8-b435-4f66950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#37ab00", "local": false, "name": "enisa:nefarious-activity-abuse=\"mobile-malware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Exaspy \u00e2\u20ac\u201c Commodity Android Spyware Targeting High-level Executives", "date": "2016-11-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1478588454}, "582448cc-8644-4ca1-81df-4b86950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Blueliv Vawtrak v2", "date": "2016-11-10", "analysis": 0, "threat_level_id": 2, "timestamp": 1751529951}, "5824e43f-9370-463b-9681-452b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Floki Bot and the stealthy dropper", "date": "2016-11-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1478812896}, "58259da4-7a10-4077-b31c-40cf950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - The first cryptor to exploit Telegram", "date": "2016-11-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1478861156}, "5825c994-18b0-4900-a73d-4558950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00bdbd", "local": false, "name": "ecsirt:availability=\"ddos\"", "relationship_type": ""}, {"colour": "#000a64", "local": false, "name": "europol-incident:availability=\"dos-ddos\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - BlackNurse Denial of Service Attack", "date": "2016-11-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1483344746}, "582aae88-202c-45ef-b8e9-4e61950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - Hades Locker Ransomware Mimics Locky", "date": "2016-10-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1479192544}, "582ab037-052c-483d-803c-4174950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles", "date": "2016-11-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1479192872}, "582ab1cc-31a4-48f2-a0a1-4966950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#360044", "local": false, "name": "ms-caro-malware:malware-type=\"Exploit\"", "relationship_type": ""}, {"colour": "#3ab400", "local": false, "name": "enisa:nefarious-activity-abuse=\"exploits-exploit-kits\"", "relationship_type": ""}], "info": "OSINT - Microsoft Word Intruder 8 Adds Support for Flash Vulnerability CVE-2016-4117", "date": "2016-11-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1479193333}, "582adfcb-6640-46bf-ba1f-4aca950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  HackingTeam back for your Androids, now extra insecure!", "date": "2016-11-15", "analysis": 2, "threat_level_id": 2, "timestamp": 1479206635}, "582c134f-c358-455c-935e-4598950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#00afd6", "local": false, "name": "veris:action:social:target=\"Finance\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}], "info": "OSINT - New Carbanak / Anunak Attack Methodology", "date": "2016-11-16", "analysis": 2, "threat_level_id": 2, "timestamp": 1479287478}, "582dd48e-66bc-40c1-ae49-6fe8d56c6cd2": {"Orgc": {"name": "CiviCERT", "uuid": "56743359-c860-4361-b1dc-7b65d56c6cd2"}, "Tag": [{"colour": "#316200", "local": false, "name": "circl:incident-classification=\"phishing\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"KeyBoy\"", "relationship_type": ""}], "info": "It\u2019s Parliamentary: KeyBoy and the targeting of the Tibetan Community", "date": "2016-11-17", "analysis": 2, "threat_level_id": 2, "timestamp": 1588068722}, "5832c7f9-9148-4e20-8122-4f19950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Nemucod downloader spreading via Facebook", "date": "2016-11-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1479723737}, "58355b51-ce70-4549-84cf-6ba7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy", "date": "2016-11-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1479892182}, "58369d20-cb08-4d10-9e08-45e802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#0da800", "local": false, "name": "misp-galaxy:tool=\"Fareit\"", "relationship_type": ""}], "info": "OSINT -  Fareit Spam: Rocking Out to a New File Type", "date": "2016-11-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1479974391}, "5836e0bd-461c-4b54-afba-4448950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}], "info": "Cerber 5.0 through Google via onion gateway", "date": "2016-11-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1480503167}, "584003cf-ec58-48c8-933e-4172950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#37ab00", "local": false, "name": "enisa:nefarious-activity-abuse=\"mobile-malware\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}], "info": "OSINT - New SmsSecurity Variant Roots Phones, Abuses Accessibility Features and TeamViewer", "date": "2016-12-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1480590587}, "5841317a-9604-4ffe-9260-46b9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TERBIUM\"", "relationship_type": ""}], "info": "OSINT -  Shamoon 2: Return of the Disttrack Wiper", "date": "2016-11-30", "analysis": 0, "threat_level_id": 3, "timestamp": 1480715024}, "58413594-c004-4860-8e70-46b9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - A PBot (PHP + Perl Backdoor IRC Bot + Network Attack Tool) Infection on hegeman.com", "date": "2013-01-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1480669989}, "5845344a-80bc-4c94-9ea8-4f39950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - MMD-0033-2015 - Linux/XorDDoS infection incident report (CNC: HOSTASA.ORG)", "date": "2015-06-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1515812443}, "5846cc73-5bd0-4a20-9f50-49b0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#730090", "local": false, "name": "ms-caro-malware:malware-platform=\"Unix\"", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}], "info": "OSINT - Another story of Unix Trojan: Tsunami/Kaiten.c (IRC/Bot) w/ Flooder, Backdoor at a hacked xBSD", "date": "2013-05-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1481035028}, "58473b79-10e4-4931-a187-472a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Readers of popular websites targeted by stealthy Stegano exploit kit hiding in pixels of malicious ads", "date": "2016-12-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1481063464}, "5847c9b1-9114-4e0c-afe8-d9c6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-12-07 (.js in .zip) - campaign: \"receipt\"", "date": "2016-12-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1481099831}, "58497a8d-4fb8-4155-a101-4a51950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Astrum Drops", "date": "2016-12-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1481210879}, "584a6066-ea54-4894-8e9f-4d6f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - New Scheme: Spread Popcorn Time Ransomware, get chance of free Decryption Key", "date": "2016-12-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1481539703}, "584bdec1-da2c-495b-9e13-4b3402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Mirai\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}], "info": "OSINT - Now Mirai Has DGA Feature Built in", "date": "2016-12-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1482829103}, "584f1ea5-0d94-4052-9071-465502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#9100ea", "local": false, "name": "adversary:infrastructure-type=\"panel\"", "relationship_type": ""}], "info": "OSINT - diamondfox panels", "date": "2016-12-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1481580849}, "584fabab-b03c-404c-8ff8-4433950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TERBIUM\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Windows 10: protection, detection, and response against recent Depriz malware attacks", "date": "2016-12-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1481616512}, "58503e2f-4c78-442d-833f-8ad202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TeleBots\"", "relationship_type": ""}], "info": "OSINT - The rise of TeleBots: Analyzing disruptive KillDisk attacks", "date": "2016-12-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1481654318}, "5603c00a-e4d0-42e1-a0b7-85ab950d210b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Guaranteed Clicks: Mobile App Company Takes Control of Android Phones", "date": "2015-09-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1443087040}, "585251ea-ab8c-40bc-86e0-436b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2016-12-15 (.js in .zip) - campaign: \"Amount Payable\"", "date": "2016-12-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1481790434}, "58538c11-4694-47ba-a01c-4cfe02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3ab400", "local": false, "name": "enisa:nefarious-activity-abuse=\"exploits-exploit-kits\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - One, if by email, and two, if by EK: The Cerbers are coming!", "date": "2016-12-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1481870845}, "58539031-aa78-4da1-9289-487102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"PROMETHIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"NEODYMIUM\"", "relationship_type": ""}, {"colour": "#006262", "local": false, "name": "ecsirt:malicious-code=\"malware\"", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"PROMETHIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"NEODYMIUM\"", "relationship_type": ""}], "info": "OSINT - PROMETHIUM and NEODYMIUM: Parallel zeroday attacks targeting individuals in Europe", "date": "2016-12-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1481965172}, "5857cf66-aa18-4681-bff7-08720a950b0c": {"Orgc": {"name": "NCSC-NL", "uuid": "5697b0c4-9474-4336-b675-28140a950b0b"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#777c00", "local": false, "name": "ncsc-nl-ndn:feed=\"generic\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#a2009c", "local": false, "name": "retention:1m", "relationship_type": ""}, {"colour": "#460043", "local": false, "name": "retention:expired", "relationship_type": ""}], "info": "Kaspersky Lab: Spearphishing attack hits industrial companies", "date": "2016-12-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1607523242}, "585b9a80-9910-4d24-a695-4ac4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - New Linux/Rakos threat: devices and servers under SSH scan (again)", "date": "2016-12-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1482398934}, "585bd19b-43a4-4b35-9023-4d60950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0c9800", "local": false, "name": "misp-galaxy:tool=\"X-Agent\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units", "date": "2016-12-22", "analysis": 2, "threat_level_id": 2, "timestamp": 1482412759}, "58638245-8b08-4bb0-8bed-fcb802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#44d400", "local": false, "name": "enisa:nefarious-activity-abuse=\"DNS-poisoning-or-DNS-spoofing-or-DNS-Manipulations\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#37ac00", "local": false, "name": "enisa:nefarious-activity-abuse=\"infected-trusted-mobile-apps\"", "relationship_type": ""}], "info": "OSINT - Switcher: Android joins the \u00e2\u20ac\u02dcattack-the-router\u00e2\u20ac\u2122 club", "date": "2016-12-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1484666593}, "5864c43a-b9d0-4182-93c2-4557950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3e6e00", "local": false, "name": "malware_classification:malware-category=\"Spyware\"", "relationship_type": ""}, {"colour": "#37ab00", "local": false, "name": "enisa:nefarious-activity-abuse=\"mobile-malware\"", "relationship_type": ""}, {"colour": "#211c1c", "local": false, "name": "Android Malware", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Android spyware", "date": "2016-12-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1483002615}, "5867a9dc-dde8-4877-b46f-42cc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#006262", "local": false, "name": "ecsirt:malicious-code=\"malware\"", "relationship_type": ""}], "info": "OSINT - GRIZZLY STEPPE \u00e2\u20ac\u201c Additional expansion", "date": "2016-12-31", "analysis": 1, "threat_level_id": 3, "timestamp": 1483371464}, "586cb1ff-6bcc-4029-88b0-4fa9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Chthonic\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"Sundown\"", "relationship_type": ""}], "info": "OSINT -  Updated Sundown Exploit Kit Uses Steganography", "date": "2016-12-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1483646568}, "586ccbb7-3b08-4fdb-a034-4a8b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Chthonic\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}], "info": "OSINT - Threat Actors Using Legitimate PayPal Accounts To Distribute Chthonic Banking Trojan", "date": "2016-07-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1483525555}, "586f5fb9-2678-4fe5-a14e-45e5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#770095", "local": false, "name": "ms-caro-malware:malware-platform=\"Win32\"", "relationship_type": ""}, {"colour": "#006262", "local": false, "name": "ecsirt:malicious-code=\"malware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Exposing an AV-Disabling Driver Just in Time for Lunch", "date": "2017-01-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1483697574}, "5870f2f5-5744-4ded-a6f5-469c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#00afd6", "local": false, "name": "veris:action:social:target=\"Finance\"", "relationship_type": ""}], "info": "OSINT - 2016 Updates to Shifu Banking Trojan", "date": "2017-01-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1483798214}, "5870f5e0-ff9c-414f-ad38-46d4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"Sundown\"", "relationship_type": ""}], "info": "OSINT - The curious case of a Sundown EK variant dropping a Cryptocurrency Miner", "date": "2017-01-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1483798339}, "58720d9e-8b54-40a9-9d80-42e7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"MM Core\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006262", "local": false, "name": "ecsirt:malicious-code=\"malware\"", "relationship_type": ""}], "info": "OSINT - MM Core In-Memory Backdoor Returns as \"BigBoss\" and \"SillyGoose\"", "date": "2017-01-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1483873066}, "58724cbf-5508-4425-ab89-4f61950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0082e1", "local": false, "name": "osint:certainty=\"75\"", "relationship_type": ""}, {"colour": "#00497f", "local": false, "name": "osint:source-type=\"source-code-repository\"", "relationship_type": ""}, {"colour": "#a200ca", "local": false, "name": "ms-caro-malware:malware-platform=\"Python\"", "relationship_type": ""}], "info": "OSINT  - Fancy Bear Source Code", "date": "2017-01-08", "analysis": 0, "threat_level_id": 2, "timestamp": 1483946711}, "5876a2cd-0a90-4f5b-9488-d567950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#770095", "local": false, "name": "ms-caro-malware:malware-platform=\"Win32\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Shamoon\"", "relationship_type": ""}, {"colour": "#065000", "local": false, "name": "misp-galaxy:tool=\"Wipbot\"", "relationship_type": ""}], "info": "OSINT - Second Wave of Shamoon 2 Attacks Identified", "date": "2017-01-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1484171665}, "58773a18-6384-4c59-8264-4400950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - New Variant of Ploutus ATM Malware Observed in the Wild in Latin America", "date": "2017-01-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1484208963}, "58787bf0-bf68-41ce-b679-457a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}, {"colour": "#00497f", "local": false, "name": "osint:source-type=\"source-code-repository\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Equation Group\"", "relationship_type": ""}], "info": "OSINT - shadow-brokers-windows", "date": "2017-01-13", "analysis": 0, "threat_level_id": 3, "timestamp": 1484292745}, "5878acc1-7fdc-4ec3-9e09-47d4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Targeted Threat Leads to Keylogger via Fake Silverlight Update", "date": "2017-01-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1484303923}, "587e787d-c9f8-4132-9673-4d8402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#007c97", "local": false, "name": "veris:actor:motive=\"Financial\"", "relationship_type": ""}], "info": "OSINT - CARBANAK GROUP USES GOOGLE FOR MALWARE COMMAND-AND-CONTROL", "date": "2017-01-17", "analysis": 0, "threat_level_id": 3, "timestamp": 1484683974}, "587fc1b5-fd10-42e7-8184-637702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6a0084", "local": false, "name": "ms-caro-malware:malware-platform=\"MacOS_X\"", "relationship_type": ""}], "info": "OSINT  - New Mac backdoor using antiquated code", "date": "2017-01-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1484768039}, "58806a6c-14a4-49a9-8d6c-49e6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\" EyePyramid Malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  Uncovering the Inner Workings of EyePyramid", "date": "2017-01-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1484812427}, "5880bb50-2330-42a3-a253-4c08950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"LuminosityLink\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}], "info": "OSINT - FINDING THE RAT\u00e2\u20ac\u2122S NEST", "date": "2017-01-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1484833091}, "5881bff7-0bd0-4c84-a206-4eb4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Backup and Restore Process\"", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - Spora - the Shortcut Worm that is also a Ransomware", "date": "2017-01-20", "analysis": 0, "threat_level_id": 3, "timestamp": 1484898903}, "58867f60-ca5c-4658-a1d5-472f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#37ab00", "local": false, "name": "enisa:nefarious-activity-abuse=\"mobile-malware\"", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#13f300", "local": false, "name": "misp-galaxy:threat-actor=\"HummingBad\"", "relationship_type": ""}], "info": "OSINT - A Whale of a Tale: HummingBad Returns", "date": "2017-01-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1485210006}, "588867a4-c470-4914-b854-d3f6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0b8c00", "local": false, "name": "misp-galaxy:tool=\"Snifula\"", "relationship_type": ""}], "info": "OSINT - Malicious SVG Files in the Wild", "date": "2017-01-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1485354940}, "5888f612-8e50-43d8-9603-4d14950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"LEAD\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"BARIUM\"", "relationship_type": ""}, {"colour": "#064800", "local": false, "name": "misp-galaxy:tool=\"Winnti\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}], "info": "OSINT - Detecting threat actors in recent German industrial attacks with Windows Defender ATP", "date": "2017-01-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1485373965}, "588a1640-bcac-4dc1-b9da-435802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malware 2017-01-26 (.js in .zip) - Cerber", "date": "2017-01-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1485448229}, "588a6de9-e2f4-4fbc-b09d-427f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}], "info": "OSINT - EITest Nabbing Chrome Users with a \u00e2\u20ac\u0153Chrome Font\u00e2\u20ac\u009d Social Engineering Scheme", "date": "2017-01-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1485467665}, "588a7bc4-7a38-45c7-bc6f-215902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0da700", "local": false, "name": "misp-galaxy:tool=\"Dridex\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - Dridex Banking Trojan Returns, Leverages New UAC Bypass Method", "date": "2017-01-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1485470881}, "588b3db6-d5d4-4e46-86d6-42b9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam targeting github users", "date": "2017-01-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1485530168}, "588dc8e3-8530-4b69-b71c-45ab02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Shamoon\"", "relationship_type": ""}], "info": "OSINT - Spotlight on Shamoon", "date": "2017-01-29", "analysis": 2, "threat_level_id": 2, "timestamp": 1485688589}, "588df693-0480-41bd-b8fd-4e9302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0c9200", "local": false, "name": "misp-galaxy:tool=\"Hancitor\"", "relationship_type": ""}], "info": "OSINT - #OCJP-133: Hancitor\u00e3\u0192\u017e\u00e3\u0192\u00ab\u00e3\u201a\u00a6\u00e3\u201a\u00a7\u00e3\u201a\u00a2\u00e6\u201e\u0178\u00e6\u0178\u201c \u00e3\u0081\u00a8 \u00e3\u0192\u008f\u00e3\u0192\u0192\u00e3\u201a\u00ad\u00e3\u0192\u00b3\u00e3\u201a\u00b0\u00e3\u0081\u2022\u00e3\u201a\u0152\u00e3\u0081\u0178Wordpress", "date": "2017-01-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1485700355}, "588f9099-bcc8-4730-b744-4eed02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Saga 2.0 (Sage 2.0) comes with IP Generation Algorithm (IPGA)", "date": "2017-01-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1485803987}, "589046d9-01ac-40d2-b47d-e592950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Flokibot\"", "relationship_type": ""}, {"colour": "#00809c", "local": false, "name": "veris:asset:variety=\"U - POS terminal\"", "relationship_type": ""}], "info": "OSINT - Flokibot Invades PoS: Trouble in Brazil", "date": "2017-01-31", "analysis": 0, "threat_level_id": 3, "timestamp": 1485852189}, "58904f8a-8a40-4894-8487-4a58950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments", "date": "2017-01-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1485855876}, "589327e5-227c-4236-a9b8-fafc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#316200", "local": false, "name": "circl:incident-classification=\"phishing\"", "relationship_type": ""}], "info": "OSINT - Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Civil Society", "date": "2017-02-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1486041224}, "5894bd56-d458-489f-a692-41d102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#1f9900", "local": false, "name": "Threat Type:RAT", "relationship_type": ""}], "info": "OSINT: Malicious software targeting financial sector internals", "date": "2017-02-03", "analysis": 1, "threat_level_id": 1, "timestamp": 1486155965}, "5894f12f-709c-4502-a896-7dbf02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Windows SMBv3 Denial of Service Proof of Concept (0 Day Exploit)", "date": "2017-02-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1486156219}, "5894f679-33c8-4642-8e51-8cd902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#043400", "local": false, "name": "misp-galaxy:tool=\"PlugX\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ZeroT\"", "relationship_type": ""}], "info": "OSINT  - Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX", "date": "2017-02-03", "analysis": 2, "threat_level_id": 2, "timestamp": 1486158124}, "589718fa-353c-411d-bbee-4c1902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}], "info": "OSINT - Doctor Web detects several thousand infected Linux devices  Linux.Proxy.10", "date": "2017-02-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1486297617}, "58975d16-ec0c-4d21-88bd-41eb02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - From RTF to Cobalt Strike passing via Flash", "date": "2017-02-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1486315427}, "5898af07-fb0c-4135-b908-491b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - ikittens: iranian actor resurfaces with malware for mac (macdownloader)", "date": "2017-02-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1486403490}, "58996c01-5948-4776-bc9f-4216950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  When A Pony Walks Out Of A Pub", "date": "2017-02-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1487927797}, "589a2465-af44-4854-8eea-468d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - The Curious Case of a Reconnaissance Campaign Targeting Ministry and Embassy Sites", "date": "2017-02-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1486497239}, "589b97f0-1e74-420b-bb3e-f4f302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Mirai\"", "relationship_type": ""}], "info": "OSINT - Trojan.Mirai.1 for Microsoft Windows", "date": "2017-02-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1486592381}, "589b1a8a-1e10-4e76-860a-4cba950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "dnc:malware-type=\"Ransomware\"", "relationship_type": ""}], "info": "Erebus Ransomware Utilizes a UAC Bypass and Request a $90 Ransom Payment", "date": "2017-02-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1486712914}, "589d81ee-0348-49fe-9b88-4c48950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#10c300", "local": false, "name": "misp-galaxy:threat-actor=\"Shell Crew\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"StreamEx\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Shell Crew Variants Continue to Fly Under Big AV\u00e2\u20ac\u2122s Radar", "date": "2017-02-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1486721672}, "58a0ae18-4554-4af8-a66b-459802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#00afd6", "local": false, "name": "veris:action:social:target=\"Finance\"", "relationship_type": ""}], "info": "OSINT - Attackers target dozens of global banks with new malware", "date": "2017-02-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1486925790}, "58a1dcbc-4d5c-4267-995a-498b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - Fileless attacks against enterprise networks", "date": "2017-02-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1487003097}, "58a4aa5c-29c4-4034-9ad4-426002de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#086200", "local": false, "name": "admiralty-scale:source-reliability=\"c\"", "relationship_type": ""}, {"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}, {"colour": "#4b9600", "local": false, "name": "circl:incident-classification=\"information-leak\"", "relationship_type": ""}, {"colour": "#0082e1", "local": false, "name": "osint:certainty=\"75\"", "relationship_type": ""}], "info": "OSINT - Who Ran Leakedsource.com?", "date": "2017-02-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1487188408}, "58a60ba3-3418-4578-99b2-75a202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#10c800", "local": false, "name": "misp-galaxy:threat-actor=\"Stone Panda\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0082e1", "local": false, "name": "osint:certainty=\"75\"", "relationship_type": ""}], "info": "OSINT - menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations", "date": "2017-02-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1487277633}, "58a883f4-a2f8-4901-9d5f-a16602de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}], "info": "OSINT - Demystifying targeted malware used against Polish banks", "date": "2017-02-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1487439192}, "58aafac5-c984-43f3-a1b9-493e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - LAZARUS\u00e2\u20ac\u2122 FALSE FLAG MALWARE", "date": "2017-02-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1487600957}, "58ab3fb6-6c3c-49e3-8294-b3f202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}, {"colour": "#0da700", "local": false, "name": "misp-galaxy:tool=\"Dridex\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - The Rise of Dridex and the Role of ESPs", "date": "2017-02-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1487618299}, "58ad3fed-cc40-4087-a6f8-3ca5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Shamoon\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Additional Insights on Shamoon2", "date": "2017-02-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1487749505}, "58ad5d57-3058-48b8-8c08-553602de0b81": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Sinkholes servers with http header Server: malware-sinkhole", "date": "2017-02-22", "analysis": 2, "threat_level_id": 4, "timestamp": 1487756912}, "58b532d4-db1c-4cdd-8615-4bb502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"", "relationship_type": ""}], "info": "OSINT - The Gamaredon Group Toolset Evolution", "date": "2017-02-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1488273197}, "58b59c8c-faa8-4919-97cf-4af602de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Android malware on the rise", "date": "2017-02-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1488298316}, "58b6ef0d-5ec0-40b3-8ddd-4dfc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Malware Leveraging PowerSploit", "date": "2017-03-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1488384118}, "58b7da09-466c-4c5e-bb8d-4dd2950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Google Play Apps Infected with Malicious IFrames", "date": "2017-03-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1488444322}, "58b87da8-48a4-4d5a-aac4-6a4902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Covert Channels and Poor Decisions: The Tale of DNSMessenger", "date": "2017-03-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1488486293}, "58b96522-b5d0-41f7-a781-4b9002de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Update on the Fancy Bear Android malware (poprd30.apk)", "date": "2017-03-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1488545347}, "58c06aeb-ea6c-48ee-a973-489502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"TorrentLocker\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - Crypt0l0cker (TorrentLocker): Old Dog, New Tricks", "date": "2017-03-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1489005961}, "58c2fcf1-283c-45fa-b289-45ae02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Wikileaks Vault7 JQJSNICKER code leak", "date": "2017-03-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1489174168}, "58c302f0-3068-4b0a-91c2-463f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Pulling Back the Curtains on EncodedCommand PowerShell Attacks", "date": "2017-03-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1587967841}, "58c64efa-2860-4f3d-a604-4007950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  Preinstalled Malware Targeting Mobile Users", "date": "2017-03-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1489397664}, "58c6915b-50e8-431f-a9ed-420b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}], "info": "OSINT - New Linux Malware Exploits CGI Vulnerability", "date": "2017-03-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1489408795}, "58ca5f56-3da4-4ed9-a13f-0804950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"CryptoMix\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "Revenge Ransomware, a CryptoMix Variant, Being Distributed by RIG Exploit Kit", "date": "2017-03-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1489759859}, "58cbac05-b7d0-4f38-84fb-0928950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#4e9c00", "local": false, "name": "circl:incident-classification=\"scam\"", "relationship_type": ""}], "info": "Tech Support Scam Synchs Alerts with App Crashes in Windows Event Logs", "date": "2017-03-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1489759787}, "58cbbdc9-9974-4da4-b10d-2e9c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}], "info": "Star Trek Themed Kirk Ransomware Brings us Monero and a Spock Decryptor!", "date": "2017-03-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1489759737}, "58ceba55-4618-4c0d-8dc7-61b102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#00809c", "local": false, "name": "veris:asset:variety=\"U - POS terminal\"", "relationship_type": ""}], "info": "OSINT - RawPOS Malware Rides Again", "date": "2017-03-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1489943379}, "58d013c1-6abc-472a-bbeb-41ba950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}], "info": "OSINT - PetrWrap: the new Petya-based ransomware used in targeted attacks", "date": "2017-03-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1490031717}, "58d38baa-a47c-40c5-8c8f-45b4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#064800", "local": false, "name": "misp-galaxy:tool=\"Winnti\"", "relationship_type": ""}], "info": "OSINT -  Winnti Abuses GitHub for C&C Communications", "date": "2017-03-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1490261359}, "58d39c29-8244-4fcf-a48b-40db950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT -  Hunt Case Study: Hunting Campaign Indicators on Privacy Protected Attack Infrastructure", "date": "2017-03-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1490263277}, "58d3f093-d6f4-44d1-93ac-3449950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - How Malformed RTF Defeats Security Engines", "date": "2017-03-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1490285621}, "58d4c745-a110-4623-a9e6-497d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - New targeted attack against Saudi Arabia Government", "date": "2017-03-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1490339998}, "58d8b418-d034-493a-aed5-40bd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Nasty adware hiding in apps on Google Play Store", "date": "2017-03-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1490597143}, "58d8fea3-e924-4905-9a11-4ea6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Shamoon\"", "relationship_type": ""}], "info": "OSINT - Shamoon 2: Delivering Disttrack", "date": "2017-03-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1490616352}, "58d90481-e090-4900-96f4-600b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e100", "local": false, "name": "misp-galaxy:threat-actor=\"APT 29\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - APT29 Domain Fronting With TOR", "date": "2017-03-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1490617717}, "58db5ea0-8440-4687-b86f-4dd4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Dimnie: Hiding in Plain Sight", "date": "2017-03-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1490779410}, "58dbc5ad-10a4-4da9-9e7e-4b97950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"KHRAT\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Trojanized Adobe Installer used to Install DragonOK\u00e2\u20ac\u2122s New Custom Backdoor", "date": "2017-03-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1490818721}, "58dcfe62-ed84-4e5e-b293-4991950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Carbon Paper: Peering into Turla\u00e2\u20ac\u2122s second stage backdoor", "date": "2017-03-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1493403824}, "58dd02b3-cfa8-4044-b533-4935950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trochilus\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"MoonWind\"", "relationship_type": ""}], "info": "OSINT - Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations", "date": "2017-03-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1490879821}, "58dcbfd0-91a4-4bc6-9aa9-4af7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"RIG\"", "relationship_type": ""}], "info": "OSINT - Websites compromised in \u00e2\u20ac\u02dcDecimal IP\u00e2\u20ac\u2122 campaign", "date": "2017-03-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1490880407}, "58ddf7c2-7200-4f46-aa84-489b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}], "info": "OSINT - Part I. Russian APT - APT28 collection of samples including OSX XAgent", "date": "2017-03-31", "analysis": 2, "threat_level_id": 2, "timestamp": 1490942984}, "58e3e7e5-90d8-43f1-a070-4520950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Chrysaor\"", "relationship_type": ""}], "info": "OSINT - An Investigation of Chrysaor Malware on Android", "date": "2017-04-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1491332046}, "58e60bd5-6874-4210-9419-533c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - LMAOxUS Ransomware: Another Case of Weaponized Open Source Ransomware", "date": "2017-04-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1491501555}, "58e73aab-3530-44d8-94b7-4cbf950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0da700", "local": false, "name": "misp-galaxy:tool=\"Dridex\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - High-Volume Dridex Campaigns Return, First to Hit Millions Since June 2016", "date": "2017-04-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1491560019}, "58e743e1-3008-4198-a310-4c82950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Off-the-shelf Ransomware Used to Target the Healthcare Sector", "date": "2017-04-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1491560428}, "58e7464f-8a5c-44bf-b478-4448950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA", "date": "2017-04-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1491567678}, "58e8a3b2-b0fc-41a9-b89a-4a8b02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}], "info": "OSINT - The Blockbuster Sequel", "date": "2017-04-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1491641860}, "58e902cd-dae8-49b9-882b-186c02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#14ff00", "local": false, "name": "admiralty-scale:information-credibility=\"6\"", "relationship_type": ""}], "info": "OSINT - Analysis of Malware in Brazilian Bank Attack Reveals Prolonged Campaign", "date": "2017-04-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1491665928}, "58eb4dde-5254-4163-add1-4d47950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Matrix\"", "relationship_type": ""}], "info": "OSINT - Matrix Ransomware Spreads to Other PCs Using Malicious Shortcuts", "date": "2017-04-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1538401642}, "58ecc214-a3a0-4d43-adff-95c6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Longhorn\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Unraveling the Lamberts Toolkit An Overview of a Color-coded Multi-Stage Arsenal", "date": "2017-04-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1491911421}, "58ecc62a-e5bc-406f-adc6-4b65950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}], "info": "OSINT - Ewind \u00e2\u20ac\u201c Adware in Applications\u00e2\u20ac\u2122 Clothing", "date": "2017-04-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1491913100}, "58ed2c42-04f0-44b7-baa4-9f1f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - CVE-2017-0199: In the Wild Attacks Leveraging HTA Handler", "date": "2017-04-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1491939061}, "58f0bb56-ce80-4f18-88b6-4577950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}], "info": "OSINT - Callisto Group", "date": "2017-04-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1492583294}, "58fce117-452c-42ed-a2dc-b64a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - FlexSpy Application Analysis", "date": "2017-04-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1492981249}, "58fdc3f2-69b4-4aba-a5ec-4a2f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#4bec00", "local": false, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Cardinal RAT Active for Over Two Years", "date": "2017-04-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1493029059}, "58fefb2d-e400-463e-b0ae-4a6a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - Threat Spotlight: Mighty Morphin Malware Purveyors: Locky Returns Via Necurs", "date": "2017-04-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1493213500}, "5900a0d3-4c08-4f82-a9ae-2c2f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0da700", "local": false, "name": "misp-galaxy:tool=\"Dridex\"", "relationship_type": ""}], "info": "Dridex 2017-04-11 : botnet 7200/7500 campaigns", "date": "2017-04-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1493287075}, "5902dd26-4a34-4d46-be1f-45f8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#007c97", "local": false, "name": "veris:actor:motive=\"Financial\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}], "info": "OSINT - Similarities Between Carbanak and FIN7 Malware Suggest Actors Are Closely Related", "date": "2017-04-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1493360090}, "5902e33b-5f04-44d9-8260-427e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#043400", "local": false, "name": "misp-galaxy:tool=\"PlugX\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"REDLEAVES\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#0eb100", "local": false, "name": "admiralty-scale:information-credibility=\"1\"", "relationship_type": ""}], "info": "OSINT - Alert (TA17-117A) Intrusions Affecting Multiple Victims Across Multiple Sectors", "date": "2017-04-28", "analysis": 0, "threat_level_id": 3, "timestamp": 1493364465}, "5902f92f-c7f4-4bac-97b5-4fa6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#6a0084", "local": false, "name": "ms-caro-malware:malware-platform=\"MacOS_X\"", "relationship_type": ""}], "info": "OSINT - OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic", "date": "2017-04-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1493647580}, "590348da-977c-436f-ad6f-4ecb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#5fa900", "local": false, "name": "malware_classification:obfuscation-technique=\"tunneling\"", "relationship_type": ""}], "info": "OSINT - Use of DNS Tunneling for C&C Communications", "date": "2017-04-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1493388237}, "590b172d-c8f4-4cdd-88cf-4443950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#12e100", "local": false, "name": "misp-galaxy:threat-actor=\"APT 29\"", "relationship_type": ""}], "info": "OSINT - A Mole exposing itself to sunlight Snake: Coming soon in Mac OS X flavour", "date": "2017-05-04", "analysis": 2, "threat_level_id": 2, "timestamp": 1493900587}, "59100c44-ea98-4024-ab76-485e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#007c97", "local": false, "name": "veris:actor:motive=\"Financial\"", "relationship_type": ""}], "info": "OSINT - Windows Defender ATP thwarts Operation WilySupply software supply chain cyberattack", "date": "2017-05-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1494224492}, "59120865-27e0-4e6d-9b74-4a9f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"GAMEFISH\"", "relationship_type": ""}], "info": "OSINT - EPS Processing Zero-Days Exploited by Multiple Threat Actors", "date": "2017-05-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1494354378}, "591334cc-3b68-47fc-acc9-4763950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0b8c00", "local": false, "name": "misp-galaxy:tool=\"Snifula\"", "relationship_type": ""}], "info": "Password-protected docs 2017-05-10 : Ursnif 2002 - \"payment confirmation.ab1_c23def4lg56hi#78j.docx\"", "date": "2017-05-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1495107593}, "5914d3ff-4afc-46e0-88cf-bd5202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Nemucod\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Practice Makes Perfect: Nemucod Evolves Delivery and Obfuscation Techniques to Harvest Credentials", "date": "2017-05-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1494537941}, "5915b22e-c3e8-4f13-9449-7f3fc0a80a8e": {"Orgc": {"name": "INCIBE", "uuid": "56fa4fe4-f528-4480-8332-1ba3c0a80a8c"}, "Tag": [{"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3f7f00", "local": false, "name": "circl:incident-classification=\"vulnerability\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"WannaCry\"", "relationship_type": ""}, {"colour": "#00fff3", "local": false, "name": "Trj=Doublepulsar", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ETERNALBLUE\"", "relationship_type": ""}, {"colour": "#ef1515", "local": false, "name": "Symantec", "relationship_type": ""}], "info": "Ransomware spreading through SMB attacking multiple companies", "date": "2017-05-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1588338617}, "5916342f-3134-435f-9ce2-48e802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"WannaCry\"", "relationship_type": ""}], "info": "OSINT - Massive outbreak of ransomware variant infects large amounts of computers around the world", "date": "2017-05-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1494772913}, "5916cc1f-cb18-4db1-b4f4-a535950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"WannaCry\"", "relationship_type": ""}], "info": "OSINT -  Player 3 Has Entered the Game: Say Hello to 'WannaCry'", "date": "2017-05-13", "analysis": 2, "threat_level_id": 2, "timestamp": 1494772885}, "59186a46-6d0c-4359-a644-c061950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"WannaCry\"", "relationship_type": ""}], "info": "OSINT - Alert (TA17-132A) Indicators Associated With WannaCry Ransomware", "date": "2017-05-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1494773442}, "59188096-18dc-47dc-9a67-beaf950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"WannaCry\"", "relationship_type": ""}], "info": "OSINT - Neo23x0 Yara Rule Set and Sigma Rule Set - WannaCry", "date": "2017-05-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1494778309}, "59189548-f120-4050-be33-46b9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT -  Jaff Ransomware: Player 2 Has Entered The Game", "date": "2017-05-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1494830023}, "591bfbca-a168-4ca0-b1d8-4c14950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "2017-05-15 Malspam  00_Invoice_###.PDF", "date": "2017-05-17", "analysis": 1, "threat_level_id": 3, "timestamp": 1495010518}, "591bfe00-bb40-4958-9c33-4b87950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "2017-05-16 Malspam Emailing:#####.pdf.pdf", "date": "2017-05-17", "analysis": 1, "threat_level_id": 3, "timestamp": 1751529720}, "591d566d-3ec0-4195-adb2-9f28950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "Invoice ###### 05/17/2017 from dontreply@random", "date": "2017-05-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1495107040}, "591d952f-ff4c-4fae-92dd-4a9e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Uiwix Ransomware\"", "relationship_type": ""}], "info": "OSINT - Uiwix Ransomware Using EternalBlue SMB Exploit To Infect Victims", "date": "2017-05-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1495133304}, "591df2b7-0408-43b6-90bd-4e3c02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Flokibot\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}], "info": "OSINT - New Loki Variant Being Spread via PDF File", "date": "2017-05-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1495135260}, "591df523-1b50-4547-ae34-4dca02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"Astrum\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001d3f", "local": false, "name": "riskiq:threat-type=\"exploit-kit\"", "relationship_type": ""}, {"colour": "#3ab400", "local": false, "name": "enisa:nefarious-activity-abuse=\"exploits-exploit-kits\"", "relationship_type": ""}, {"colour": "#ff0000", "local": false, "name": "dnc:infrastructure-type=\"exploit-kit\"", "relationship_type": ""}], "info": "OSINT - Will Astrum Fill the Vacuum in the Exploit Kit Landscape?", "date": "2017-05-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1495135834}, "592144d2-9100-4405-b018-4fd902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#790097", "local": false, "name": "ms-caro-malware:malware-platform=\"Win64\"", "relationship_type": ""}], "info": "OSINT - New SMB Worm Uses Seven NSA Hacking Tools. WannaCry Used Just Two", "date": "2017-05-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1495353225}, "5922e0ac-0314-43d5-b36e-4ac4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "Jaff 2017-05-22 : \"Copy of Invoice 12345678\" / \"12345678.PDF\"", "date": "2017-05-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1495803436}, "5926c399-62fc-4fa6-9d16-432802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Tainted Leaks: Disinformation and Phishing With a Russian Nexus", "date": "2017-05-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1495712831}, "59281443-312c-4b77-aef7-447d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "Jaff 2017-05-25 : \"Payment Receipt 1234\" - \"1234.pdf\"", "date": "2017-05-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1495806395}, "59282239-845c-495d-b3db-4ebb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#500064", "local": false, "name": "ms-caro-malware:malware-type=\"Trojan\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}], "info": "OSINT - Analysis of Emotet v4", "date": "2017-05-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1495804476}, "59282a08-aec8-49e7-932a-45d3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "Jaff 2017-05-26 : \"Scanned Image from a Xerox WorkCentre\" - \"Scan_0012_123456789.zip\"", "date": "2017-05-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1495806520}, "593133d6-46f4-49e7-b1f6-422f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Malspam --> 62909008.pdf", "date": "2017-06-02", "analysis": 1, "threat_level_id": 3, "timestamp": 1496416559}, "59318aac-4e04-4616-9682-43ff950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "M2M -  Jaff 2017-06-02 : \"Invoice INV-1234\" - \"Invoice INV-1234.pdf\"", "date": "2017-06-02", "analysis": 1, "threat_level_id": 3, "timestamp": 1496419111}, "5935004a-eb44-4393-8e7b-4a86950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ETERNALBLUE\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"gh0st\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0055d5", "local": false, "name": "ms-caro-malware-full:malware-family=\"Nitol\"", "relationship_type": ""}], "info": "OSINT - Threat actors leverage EternalBlue exploit to deliver non-WannaCry payloads", "date": "2017-06-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1496646131}, "5936a055-a640-42e1-9b7c-4676950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Tinba\"", "relationship_type": ""}], "info": "OSINT - \u00e2\u20ac\u0153Zusy\u00e2\u20ac\u009d PowerPoint Malware Spreads Without Needing Macros", "date": "2017-06-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1496752474}, "5937f449-62bc-460c-a4c6-4bb9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"RIG\"", "relationship_type": ""}], "info": "OSINT - Shadowfall", "date": "2017-06-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1496851791}, "5939bc28-0960-4108-a244-9b8302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}], "info": "OSINT -  The Recorded Future Blog Malicious Android Applications Raise Concerns for Enterprises", "date": "2017-06-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1496956600}, "593a4041-f17c-4fdc-bc58-46b3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Trickbot 2017-06-07 : \"mac1\" : \"12_Invoice_3456\" - \"001_4321.pdf\"", "date": "2017-06-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1496990762}, "593a418e-68ac-4876-b1e6-48be950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Password-protected docs 2017-06-07 : \"John C Doe\" - \"ab1_c23def4lg56hi#78j.docx\"", "date": "2017-06-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1496991252}, "593a41df-b920-4f52-bbc3-4abd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "M2M -  Jaff 2017-06-06 : \"Order\" - \"MX-2310U_20170606_123456.pdf\"", "date": "2017-06-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1496991290}, "593a42a0-7298-4e35-9443-4ed0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0da700", "local": false, "name": "misp-galaxy:tool=\"Dridex\"", "relationship_type": ""}], "info": "M2M -  Dridex 2017-06-05 : botnet 7200 - \"Invoice\" - \"A4 Inv_Crd 12345.pdf\"", "date": "2017-06-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1496991846}, "593a6d56-c9d4-44a5-af47-4b68950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "M2M -  Jaff 2017-06-09 : missing subject - \"IMG_1234.ZIP\" / \"DOC_1234.docm\"", "date": "2017-06-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1497022884}, "593a7cae-4748-4556-b20e-4644950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Trickbot 2017-06-09 : mac1 : \"Facture AA-123-RR\" / \"Copy Credit Note\" - \"1234567.zip\"", "date": "2017-06-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1497005773}, "593a99c5-79cc-411c-ac6d-3089950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - FIREBALL \u00e2\u20ac\u201c The Chinese Malware of 250 Million Computers Infected", "date": "2017-06-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1497013712}, "593e542e-e080-464e-af5a-4c2a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Dvmap: the first Android malware with code injection", "date": "2017-06-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1497257362}, "593e5a1d-0a18-40ac-9051-4188950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6a0084", "local": false, "name": "ms-caro-malware:malware-platform=\"MacOS_X\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}], "info": "OSINT - MacRansom: Offered as Ransomware as a Service", "date": "2017-06-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1497258805}, "593e830b-a7e0-481c-b1a1-4390950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Trickbot 2017-06-12 : mac1 : Facture N 1234 du 12/06/2017 - \"FACTURE_1234.zip\"", "date": "2017-06-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1497272829}, "593fe37d-e2e4-49e7-9f18-5726950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "M2M -  Jaff 2017-06-13 : \"Invoice PIS1234567.zip\"", "date": "2017-06-13", "analysis": 1, "threat_level_id": 3, "timestamp": 1497516241}, "5942404e-7c54-4842-8599-4037950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Trickbot 2017-06-14 : mac1 : \"Emailing: 123456789\" - \"123456789.PDF\"", "date": "2017-06-15", "analysis": 1, "threat_level_id": 3, "timestamp": 1497616898}, "594252f6-6d34-496a-9746-413f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jaff\"", "relationship_type": ""}], "info": "M2M -  Jaff 2017-06-14 : \"Emailing: 123456789\" - \"123456789.ZIP\"", "date": "2017-06-15", "analysis": 1, "threat_level_id": 3, "timestamp": 1497616658}, "5943a31f-8a90-4206-b02e-4b5b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Flokibot\"", "relationship_type": ""}], "info": "M2M -  #LokiBot goes  with SWIFT theme", "date": "2017-06-16", "analysis": 1, "threat_level_id": 3, "timestamp": 1497616719}, "5948c00e-8440-4137-9952-a922950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0ead00", "local": false, "name": "misp-galaxy:tool=\"Akbot\"", "relationship_type": ""}], "info": "OSINT -  McAfee Discovers Pinkslipbot Exploiting Infected Machines as Control Servers; Releases Free Tool to Detect, Disable Trojan", "date": "2017-06-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1497941046}, "594a23b3-e954-44cd-98d7-4e2a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#700cf0", "local": false, "name": "MalSpam", "relationship_type": ""}], "info": "Malspam 2017-06-21 'Job Application'", "date": "2017-06-21", "analysis": 0, "threat_level_id": 3, "timestamp": 1498035038}, "594a5e89-05fc-40b3-bf5a-4c9b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "M2M -  #trickbot Facture ### via .zip/.WSF", "date": "2017-06-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1498049166}, "594a858a-7bc0-48be-b2b3-2352950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-06-21 : Affid=3 : \"Copy of Invoice 87654321\" - \"87654321.zip\"", "date": "2017-06-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1498056111}, "594b8afd-daac-4cf6-8784-4a9b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  phishing URLs", "date": "2017-06-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1498123201}, "594d1a36-8ca8-451c-83a6-6266950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#009922", "local": false, "name": "Threat Source:OSINT", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}], "info": "OSINT Following the Trail of BlackTech\u00e2\u20ac\u2122s Cyber Espionage Campaigns by TrendMicro", "date": "2017-06-23", "analysis": 2, "threat_level_id": 1, "timestamp": 1498480569}, "594e5f0a-da78-4d3c-b9d4-4f8502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"El Machete\"", "relationship_type": ""}], "info": "OSINT - El Machete's Malware Attacks Cut Through LATAM", "date": "2017-06-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1498470794}, "5950fd6b-2b68-42c6-9855-47cc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Emailing: ########.jpg zip|wsf", "date": "2017-06-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1499175624}, "5950fd85-deb8-4a7d-92c9-4ba8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-06-26 : Affid=3 : \"12_Invoice_3456\" - \"001_4321.zip\"", "date": "2017-06-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1499175787}, "59525a0f-4584-40a8-82c7-420f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "M2M -  Trickbot 2017-06-27 : mac1 : \"facture 654321\" - \"abonneau_654321.docm\"", "date": "2017-06-27", "analysis": 1, "threat_level_id": 3, "timestamp": 1499245860}, "5952b89d-104c-436d-a8bd-476202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Petya\"", "relationship_type": ""}], "info": "OSINT - D\u00c3\u00a9j\u00c3\u00a0 vu: Petya ransomware appears with SMB propagation capabilities", "date": "2017-06-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1498593781}, "5952d18c-b4f4-4a20-8373-443802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Petya\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - New Variant of Petya Ransomware Spreading Like Wildfire", "date": "2017-06-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1498600020}, "595d508c-dc3c-49e8-8288-4a6002de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - The MeDoc Connection", "date": "2017-07-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1499287883}, "595c89fd-d638-433e-b586-4a60950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Analysis of TeleBots\u00e2\u20ac\u2122 cunning backdoor", "date": "2017-07-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1499327306}, "595dfe70-4ba8-4f83-8089-4a65950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - New KONNI Campaign References North Korean Missile Capabilities", "date": "2017-07-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1499332500}, "59637327-79cc-430b-af94-0701950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#37ab00", "local": false, "name": "enisa:nefarious-activity-abuse=\"mobile-malware\"", "relationship_type": ""}], "info": "OSINT - SpyDealer: Android Trojan Spying on More Than 40 Apps", "date": "2017-07-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1499693801}, "59663a31-f174-44a6-adb7-4339950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Adwind RAT\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Spam Campaign Delivers Cross-platform Remote Access Trojan Adwind", "date": "2017-07-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1499872080}, "596724b6-83dc-417f-962a-4cc8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - LockPoS Joins the Flock", "date": "2017-07-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1499933851}, "5968d8bc-9874-4fc2-ab64-4d7c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Encrypted Docx Campaign", "date": "2017-07-14", "analysis": 1, "threat_level_id": 3, "timestamp": 1500058493}, "5968d903-8e18-438e-8d33-4792950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "M2M -  #trickbot Lloyds Bank", "date": "2017-07-14", "analysis": 1, "threat_level_id": 3, "timestamp": 1500058820}, "596c6ae1-d4f0-4d84-8718-4a50950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#316200", "local": false, "name": "circl:incident-classification=\"phishing\"", "relationship_type": ""}, {"colour": "#856c13", "local": false, "name": "Phishing", "relationship_type": ""}, {"colour": "#00e7e7", "local": false, "name": "ecsirt:fraud=\"phishing\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "HackShit phishing as a service", "date": "2017-07-12", "analysis": 2, "threat_level_id": 4, "timestamp": 1500277889}, "596f75c0-9118-4b4c-958b-1921950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#064800", "local": false, "name": "misp-galaxy:tool=\"Winnti\"", "relationship_type": ""}], "info": "OSINT - Recent Winnti Infrastructure and Samples", "date": "2017-07-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1500477123}, "596f7d10-18f4-44d9-ae66-48d3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Unravelling .NET with the Help of WinDBG", "date": "2017-07-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1500478885}, "59387629-3d68-430c-ae55-15f50a016219": {"Orgc": {"name": "ESET", "uuid": "55f6ea5e-51ac-4344-bc8c-4170950d210f"}, "Tag": [{"colour": "#a9b7b8", "local": false, "name": "Stantinko", "relationship_type": ""}], "info": "Stantinko investigation", "date": "2017-06-07", "analysis": 2, "threat_level_id": 1, "timestamp": 1500641829}, "59720fc0-19c8-47f0-92e2-4dff950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Rurktar - Spyware under Construction", "date": "2017-07-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1500647714}, "59722019-3260-4062-bec5-4eea950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Linux.Bew: un backdoor para el minado de Bitcoin", "date": "2017-07-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1500651755}, "597e0ba4-29e0-4ae1-a8a3-ae4f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"CowerSnail\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - CowerSnail, from the creators of SambaCry", "date": "2017-07-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1501433663}, "5980127d-ada0-479d-b976-c51d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#37ab00", "local": false, "name": "enisa:nefarious-activity-abuse=\"mobile-malware\"", "relationship_type": ""}], "info": "OSINT - A new era in mobile banking Trojans", "date": "2017-08-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1501574673}, "5981907c-ee6c-4ed5-bc87-40af02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6a0084", "local": false, "name": "ms-caro-malware:malware-platform=\"MacOS_X\"", "relationship_type": ""}], "info": "OSINT - Real News, Fake Flash: Mac OS X Users Targeted", "date": "2017-08-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1501663696}, "5981a635-1198-404e-99e3-4fad02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}], "info": "OSINT - FIN7/Carbanak threat actor unleashes Bateleur JScript backdoor", "date": "2017-08-02", "analysis": 0, "threat_level_id": 3, "timestamp": 1501669132}, "5982cc0a-db3c-40f9-9873-e54e02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - A Look at JS_POWMET, a Completely Fileless Malware", "date": "2017-08-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1501744539}, "59861ab3-3ef8-4683-ad19-9533950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - TwoFace Webshell: Persistent Access Point for Lateral Movement", "date": "2017-07-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1501961841}, "598626ea-83e0-4b11-a9a5-485b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#000a64", "local": false, "name": "europol-incident:availability=\"dos-ddos\"", "relationship_type": ""}], "info": "OSINT - Tale of the Two Payloads \u00e2\u20ac\u201c TrickBot and Nitol", "date": "2017-08-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1501965244}, "598db7fd-47a8-45f8-9414-408b02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#001899", "local": false, "name": "estimative-language:likelihood-probability=\"likely\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ETERNALBLUE\"", "relationship_type": ""}], "info": "OSINT - APT28 Targets Hospitality Sector, Presents Threat to Travelers", "date": "2017-08-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1502460096}, "598dc10d-2e10-4de5-8745-433202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}], "info": "OSINT - Fake Snapchat in Google Play Store", "date": "2017-08-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1502462398}, "5991e185-1808-4a0a-8df5-c44402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - The Blockbuster Saga Continues", "date": "2017-08-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1502733016}, "59934414-7a54-4169-9f19-4ebd02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001585", "local": false, "name": "estimative-language:likelihood-probability=\"roughly-even-chance\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Chthonic\"", "relationship_type": ""}], "info": "OSINT - The Curious Case of Notepad and Chthonic: Exposing a Malicious Infrastructure", "date": "2017-08-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1502825354}, "59934c13-6410-44a8-9ebe-47fe02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - ShadowPad in corporate networks", "date": "2017-08-15", "analysis": 2, "threat_level_id": 2, "timestamp": 1502825996}, "5997e84c-58b8-4652-a5cc-7d9602de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#007c97", "local": false, "name": "veris:actor:motive=\"Financial\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - EngineBox Malware Supports 10+ Brazilian Banks", "date": "2017-08-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1503128009}, "599aa9ab-dd20-4ae1-a3fa-41b5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Turla\"", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}, {"colour": "#065000", "local": false, "name": "misp-galaxy:tool=\"Wipbot\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Turla APT actor refreshes KopiLuwak JavaScript backdoor for use in G20-themed attack", "date": "2017-08-17", "analysis": 2, "threat_level_id": 2, "timestamp": 1503394295}, "599bfa79-e7e0-44a9-a0fb-5bfb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#1c3900", "local": false, "name": "circl:incident-classification=\"spam\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}], "info": "OSINT - Emotet, New high-volume spam campaign has links pointing to malicious documents that download banking Trojan", "date": "2017-08-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1503396657}, "599e72c8-3f48-461a-addb-b71b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Malware uncovered by ESET researchers aimed at gamers", "date": "2017-08-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1503557640}, "599e9eb0-ddc0-4349-ad1c-4f26950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Meet Ovidiy Stealer: Bringing credential theft to the masses", "date": "2017-07-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1503646727}, "599eb71f-2620-4dfe-9f6a-4cf8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - Threat Spotlight: Is Fireball Adware or Malware?", "date": "2017-07-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1503583295}, "599fc448-9ed0-46eb-89ae-93c2950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "Malspam 2017-08-25 'Your Sage subscription invoice is ready'", "date": "2017-08-25", "analysis": 0, "threat_level_id": 3, "timestamp": 1503643332}, "599fc9cd-7108-4567-9b01-4426950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malspam 2017-08-24 'Bill-'", "date": "2017-08-25", "analysis": 0, "threat_level_id": 3, "timestamp": 1503644210}, "599fface-7180-4d35-ad21-4808950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#991515", "local": false, "name": "trickbot", "relationship_type": ""}], "info": "OSINT - New Version of \u00e2\u20ac\u0153Trickbot\u00e2\u20ac\u009d Adds Worm Propagation Module", "date": "2017-07-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1503660606}, "59a00e7b-5bac-4e57-ab87-48d8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#37ab00", "local": false, "name": "enisa:nefarious-activity-abuse=\"mobile-malware\"", "relationship_type": ""}], "info": "OSINT - WAP-billing Trojan-Clickers on rise", "date": "2017-08-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1503661852}, "59a01f7a-9914-4a66-99b9-db8f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2017-08-25 'New voice message'", "date": "2017-08-25", "analysis": 0, "threat_level_id": 3, "timestamp": 1503666345}, "59a1a900-0714-4bcc-be9f-447c02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Operation RAT Cook: Chinese APT actors use fake Game of Thrones leaks as lures", "date": "2017-08-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1503776379}, "59a25cc4-e870-4bef-a7d1-48a802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - Ukrainian Financial Institutions Targeted by Wave of Malicious EPS File Attacks", "date": "2017-08-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1503813100}, "59a3bc82-f214-4bef-ab11-461b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0b8c00", "local": false, "name": "misp-galaxy:tool=\"Snifula\"", "relationship_type": ""}], "info": "OSINT - Ursnif variant found using mouse movement for decryption and evasion", "date": "2017-07-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1503930235}, "59a3c0d9-6e00-4f61-b768-47d6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"CryptoMix\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - The ZAYKA and NOOB CryptoMix Ransomware Variants Released in Quick Succession", "date": "2017-07-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1503930194}, "59a3c405-c348-4f7f-be23-4689950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Reyptson Ransomware Spams Your Friends by Stealing Thunderbird Contacts", "date": "2017-07-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1503930256}, "59a3d08d-5dc8-4153-bc7c-456d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Dharma Ransomware\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - New Arena Crysis Ransomware Variant Released", "date": "2017-08-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1774942903}, "59a4fb50-e07c-48d8-b0c8-483c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2017-08-28 'IMG-'", "date": "2017-08-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1503985584}, "59a516e2-a578-44e4-9689-4fe1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - New Nuclear BTCWare Ransomware Released", "date": "2017-08-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1504013598}, "59a7f10d-f0ec-431b-b99d-4fe4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}], "info": "OSINT - Gazing at Gazer", "date": "2017-08-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1504295666}, "59a97b21-a924-4836-a5d8-4a86950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2017-09-01 - 'New voice message'", "date": "2017-09-01", "analysis": 0, "threat_level_id": 3, "timestamp": 1504280451}, "59ac43b3-d8a8-4fcf-9543-4a8f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}], "info": "OSINT - Javascript malware hosted on US government site which launches powershell to connect to C2.", "date": "2017-09-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1513594323}, "59ad5d34-5dc0-46fb-8ecf-47a9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}], "info": "OSINT - Emotet Trojan Acts as Loader, Spreads Automatically", "date": "2017-09-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1504535266}, "59aea569-4598-47c4-827d-4d35950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ShadowPad\"", "relationship_type": ""}], "info": "OSINT - ShadowPad :  popular server management software hit in supply chain attack", "date": "2017-08-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1504707501}, "59aeaab2-3ea4-4b1a-b521-460a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Threat actor goes on a Chrome extension hijacking spree", "date": "2017-08-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1504620657}, "59aefa78-008c-4e61-a035-4bfb02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"Neutrino\"", "relationship_type": ""}], "info": "OSINT - Jimmy Nukebot: from Neutrino with love", "date": "2017-09-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1504639796}, "59afe22a-a734-4729-ab8c-4489950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"SynAck\"", "relationship_type": ""}], "info": "OSINT - SynAck Ransomware Sees Huge Spike in Activity", "date": "2017-09-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1504707451}, "59afedbe-12f4-4585-9048-4b8b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Dragonfly\"", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Energetic Bear\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ff8e41", "local": false, "name": "certsi:critical-sector=\"energy\"", "relationship_type": ""}], "info": "OSINT - Dragonfly: Western energy sector targeted by sophisticated attack group", "date": "2017-09-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1504707359}, "59b23683-c180-4b81-87c5-4610950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT -  New multi platform malware/adware spreading via Facebook Messenger", "date": "2017-08-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1504870925}, "59b23be2-f440-4083-85d5-4e35950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Votiro Labs exposed a new hacking campaign targeting Vietnamese organisations using weaponized Word documents", "date": "2017-08-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1504870956}, "59b2544f-ada4-4fc3-9d6a-4165950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ETERNALBLUE\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Cryptocurrency Miner Uses WMI and EternalBlue To Spread Filelessly", "date": "2017-08-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1504871124}, "59b286e5-9604-4c1c-a51b-423b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#32003e", "local": false, "name": "ms-caro-malware:malware-type=\"DDoS\"", "relationship_type": ""}], "info": "OSINT -  Booters with Chinese Characteristics: The Rise of Chinese Online DDoS Platforms", "date": "2017-08-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1504872684}, "59b2ada6-f428-4476-b218-7c5a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2017-09-08 - 'Emailed Invoice -' - .html attachment", "date": "2017-09-08", "analysis": 0, "threat_level_id": 3, "timestamp": 1504882325}, "59b2af44-f68c-41ab-869e-7f0b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2017-09-08 - 'Microsoft Store E-invoice for your order #'", "date": "2017-09-08", "analysis": 0, "threat_level_id": 3, "timestamp": 1504883454}, "59b2b3c1-f0e0-4c07-9577-7f0b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-06 : Affid=3 : \"Voice Message from 011234567890 - name unavailable\" - /message.html links", "date": "2017-09-08", "analysis": 1, "threat_level_id": 3, "timestamp": 1504883895}, "59b2b505-0c68-4319-8278-7f0b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M - new locky", "date": "2017-09-08", "analysis": 1, "threat_level_id": 3, "timestamp": 1504884086}, "59b63beb-1a3c-4144-83e6-167c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Malware Group Uses Facebook CDN to Bypass Security Solutions", "date": "2017-09-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1505131342}, "59b657a9-22b4-4223-a908-fc5a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  malspam Subject FreeFax From:\\d{10}", "date": "2017-09-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1505122392}, "59b6a0c8-ed80-4d1a-8693-4551950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Malspam 2017-09-11 \"Email Invoice Requested\"", "date": "2017-09-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1505141131}, "59b7cbde-92e8-4e1d-bd1d-4049950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#000e87", "local": false, "name": "europol-event:hosting-phishing-sites", "relationship_type": ""}], "info": "Malspam 2017-09-12 - 'Your Amazon.co.uk order' phishing", "date": "2017-09-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1505217771}, "59b7cd9e-57e4-42c6-b1ce-440d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-11/11 : Affid=3, \".lukitus\" : \"Bankwest - You have a new eStatement\" - /statement.html links", "date": "2017-09-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1505225722}, "59b7f2a6-e0bc-431c-af2f-4b18950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-12 : Affid=3, \".lukitus\" : \"Your Amazon.co.uk order...\" / AmazonSignIn.html links", "date": "2017-09-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1505227514}, "59ba805d-d674-4156-bcc6-473b950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving by Intezer", "date": "2017-09-13", "analysis": 2, "threat_level_id": 1, "timestamp": 1505395005}, "59ba873e-5c9c-4b00-9c3b-422d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-14 : Affid=3, \".lukitus\" : \"Copy of Invoice 12345\" - /invoice.html links", "date": "2017-09-14", "analysis": 1, "threat_level_id": 3, "timestamp": 1505401026}, "59bbf441-82a4-4a59-ab03-4482950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Hangul Word Processor and PostScript Abused Via Malicious Attachments", "date": "2017-09-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1505490443}, "59c28f3a-fb10-480b-92df-4d79950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-20 : Affid=3, offline, \".ykcol\" : \"Status of invoice A2171234-56\" - \"A2171234-56.rar\"", "date": "2017-09-20", "analysis": 1, "threat_level_id": 3, "timestamp": 1506339985}, "59c28fbc-4cb4-45fd-9323-4f64950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-19 : Affid=3, offline, \".ykcol\" : \"Emailing - 10008001234\" - \"10008001234.7z\"", "date": "2017-09-20", "analysis": 1, "threat_level_id": 3, "timestamp": 1506339857}, "59c28fd3-6c10-44dd-b40d-46f5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-19 : Affid=3, offline, \".ykcol\" : \"HERBALIFE Order Number: 6N01001234\" - \"6N01001234_1.7z\"", "date": "2017-09-20", "analysis": 1, "threat_level_id": 3, "timestamp": 1505998199}, "59c4c9a6-f808-4e56-b64a-4713950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"FINSPY\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - New FinFisher surveillance campaigns: Internet providers involved?", "date": "2017-09-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1506071601}, "59c56149-8ec4-4490-996e-df79950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-20 : Affid=3, offline, \".ykcol\" : \"New voice message...\" - \"msg0321.7z\"", "date": "2017-09-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1506339645}, "59c56158-c3e8-47e0-bc9f-4d02950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-18 : Affid=3, offline, \".ykcol\" : \"Message from KM_C224e\" - \"20171809_12345678901.7z\"", "date": "2017-09-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1506339606}, "59c561be-c660-49d3-8193-e0c7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky: \"Invoice RE-2017-09-21-00xxx\"\tfrom \"Amazon Marketplace\"", "date": "2017-09-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1506344596}, "59c56211-995c-4d44-90e7-4de1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-21/22 : Affid=3, offline, \".ykcol\" : \"PIC_1234\" - \"PIC_1234.7z\"", "date": "2017-09-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1506339540}, "59c56225-d8d0-4c83-bfc5-403e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-22 : Affid=3, offline, \".ykcol\" : \"Your Invoice # 123456\" - \"Invoice_file_654321.7z\"", "date": "2017-09-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1506339496}, "59c8f958-be58-46da-8a21-4c5f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-25 : Affid=3, offline, \".ykcol\" : \"Message from 02087654321\" - \"Voice Message.7z\"", "date": "2017-09-25", "analysis": 1, "threat_level_id": 3, "timestamp": 1506344280}, "59c9fbf8-5908-4837-a5e7-4724950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-25 : Affid=3, offline, \".ykcol\" : \"12_Invoice_3456\" - \"001_1234.7z\"", "date": "2017-09-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1508773093}, "59ca3ba5-b2b0-4473-b296-ff74950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-26 : Affid=3, offline, \".ykcol\":\"INVOICE\" - \"A1234567890.7z\"", "date": "2017-09-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1513180979}, "59cab250-1480-406f-8e7a-4c7e02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"TwoFace\"", "relationship_type": ""}], "info": "OSINT - Striking Oil: A Closer Look at Adversary Infrastructure", "date": "2017-09-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1506456406}, "59cb4da3-c614-4e43-a0aa-4989950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-26 : Affid=3, offline, \".ykcol\" : \"Invoice PIS1234567\" - \"InvoicePIS1234567.7z\"", "date": "2017-09-27", "analysis": 1, "threat_level_id": 3, "timestamp": 1506525446}, "59ccca18-b2fc-4249-8c20-49fd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-27 : Affid=3, offline, \".ykcol\" : \"Scanned image from MX-2600N\" - \"20170927_123456.7z\"", "date": "2017-09-28", "analysis": 1, "threat_level_id": 3, "timestamp": 1506690464}, "59cd3b91-95a4-4efd-9334-4c5b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky / Trickbot: \"Emailing: Scan0xxx\" from \"Sales\"", "date": "2017-09-28", "analysis": 1, "threat_level_id": 3, "timestamp": 1506689058}, "59cd5875-aac8-4787-9757-46fa02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#075600", "local": false, "name": "misp-galaxy:tool=\"CMStar\"", "relationship_type": ""}], "info": "OSINT - Threat Actors Target Government of Belarus Using CMSTAR Trojan", "date": "2017-09-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1506630312}, "59cd5d0e-8280-4acd-a27e-427302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT -  Banking Trojan Attempts To Steal Brazillion$", "date": "2017-09-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1506631148}, "59cdf517-df58-40ed-bb9f-47bb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-28 : Affid=3, offline, \".ykcol\" : \"Scan Data\" - \"Scan_54321.7z\"", "date": "2017-09-29", "analysis": 1, "threat_level_id": 3, "timestamp": 1506689011}, "59ce3d45-fc70-4852-bf6d-46e4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3/Trickbot \"mac1\" 2017-09-29 : \"Voice Message from ...\" - \"/voicemsg.html\" links", "date": "2017-09-29", "analysis": 1, "threat_level_id": 3, "timestamp": 1506690397}, "59ce3d6e-1884-4055-a07a-7894950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-09-29 : Affid=3, offline, \".ykcol\" : \"Invoice\" - \"123456.7z\"", "date": "2017-09-29", "analysis": 1, "threat_level_id": 3, "timestamp": 1506691216}, "59d21cf5-3d14-46f2-9845-4f7d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-02 : Affid=3, offline, \".ykcol\" : \"New Doc 2017-10-02 - Page 3.7z\"", "date": "2017-10-02", "analysis": 1, "threat_level_id": 3, "timestamp": 1506958103}, "59d25f8b-1a64-43b0-ab71-4ba1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-02 : Affid=3, offline, \".ykcol\" : \"Emailed Invoice - 123456\" - \"I_123456.7z\"", "date": "2017-10-02", "analysis": 1, "threat_level_id": 3, "timestamp": 1507107348}, "59d341f4-3ef0-4520-84dc-499c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Malspam 2017-10-03", "date": "2017-10-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1507020253}, "59d34428-803c-4eab-bac7-49c0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0fc100", "local": false, "name": "misp-galaxy:threat-actor=\"Aurora Panda\"", "relationship_type": ""}], "info": "OSINT - Evidence Aurora Operation Still Active Part 2: More Ties Uncovered Between CCleaner Hack & Chinese Hackers", "date": "2017-10-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1507107078}, "59d3797c-e740-4fba-9d1b-4164950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-03 : Affid=3, offline, \".ykcol\" : \"INVOICE\" - \"A_1234567890.7z\"", "date": "2017-10-03", "analysis": 1, "threat_level_id": 3, "timestamp": 1507106969}, "59d4b6f8-75b0-4cc8-9872-43de950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-04 : Affid=3, offline, \".ykcol\" : \"Copy of invoice A1234567890...\" - \"InvoiceA1234567890.7z\"", "date": "2017-10-04", "analysis": 1, "threat_level_id": 3, "timestamp": 1508084675}, "59d4e235-c71c-4d0e-8ba3-920c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Malicious Chrome Extensions Stealing Roblox In-Game Currency, Sending Cookies via Discord", "date": "2017-08-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1507138112}, "59d5e1fe-30f4-48ee-8b75-dabd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-04 : Affid=3, offline, \".ykcol\" : \"Message from 02087654321\" - \"Voice Message.7z\"", "date": "2017-10-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1507233773}, "59d5fdbb-df78-497f-8037-4f11950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-05 : Affid=3, offline, \".ykcol\" : \"Invoice\" - \"1234567.7z\"", "date": "2017-10-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1507233733}, "59d68cfe-723c-4b5e-b737-fbfd02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - FreeMilk: A Highly Targeted Spear Phishing Campaign", "date": "2017-10-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1507283579}, "59d771e1-db74-4d94-97d4-d899950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-06 : Affid=3, offline, \".ykcol\" : \"Your Remittance Advice\" - \"12345 Remittance.7z\"", "date": "2017-10-06", "analysis": 1, "threat_level_id": 3, "timestamp": 1508084202}, "59d7d6ca-34f4-4bec-b700-4afa02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea", "date": "2017-10-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1507317807}, "59d8f433-4934-4b7e-a2e3-43ea950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-05 : Affid=3, offline, \".ykcol\" : \"Invoice INV000123\" - \"Invoice INV000123.7z\"", "date": "2017-10-07", "analysis": 1, "threat_level_id": 3, "timestamp": 1507548721}, "59db5cbe-a944-425b-b60a-473b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"", "date": "2017-10-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1507837504}, "59db9d5b-e49c-455a-8a95-409c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"", "date": "2017-10-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1507832207}, "59dc90da-d970-4168-901d-45c3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-10 : Affid=3, offline, \".asasin\" : \"Document ... is complete\" - \"invoice_1234_sign_and_return.7z\"", "date": "2017-10-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1507830375}, "59dce1ec-b998-42ad-ba4f-48a4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3, \"asasin\" / Trickbot \"mac1\" 2017-10-10 : \"Status of invoice A2171234-56\" - \"A2171234-56.html\"", "date": "2017-10-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1507830166}, "59ddbaf9-3874-405c-b2e7-4770950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-10 : Affid=3, offline, \".asasin\" : \"Voicemail From 845-551-1234\" - \"VMSG12345678_20171010.7z\"", "date": "2017-10-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1507829816}, "59ddbb11-bf70-497d-8f9f-096f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3, \".asasin\"/Trickbot \"mac1\" 2017-10-05 : \"Invoice INV0000123\" - \"Invoice INV0000123.7z\"", "date": "2017-10-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1507829482}, "59de12ce-625c-4b9a-95fb-fc5b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3, \".asasin\"/Trickbot \"mac1\" 2017-10-11 : \"Supplement payment 1234567890\" - \"F1234567890_11102017.7z\"", "date": "2017-10-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1507830146}, "59df77e7-2420-4c6c-bc2c-44ce950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3, \".asasin\"/Trickbot \"mac1\" 2017-10-11 : \"Emailing: 12345678\" - \"12345678.7z\"", "date": "2017-10-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1507829006}, "59e4c923-a6e0-4894-a6a8-994d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"FINSPY\"", "relationship_type": ""}], "info": "OSINT - BlackOasis APT and new targeted attacks leveraging zero-day exploit", "date": "2017-10-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1508166251}, "59e72f27-d8a8-4d67-988f-4a72950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3, \".asasin\"/Trickbot \"mac1\" 2017-10-18 : \"Invoice 123456789 10.18.2017.7z\"", "date": "2017-10-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1510820541}, "59e87459-58e8-486d-98ab-432c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-10-18 : Affid=3, offline, \".asasin\" : \"Message from 02087654321\" - \"Voice Message.7z\"", "date": "2017-10-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1508428020}, "59e8c165-4460-4066-baa8-35d6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "M2M -  Malspam 2017-10-19 \"Emailed Invoice - ******\"", "date": "2017-10-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1508427930}, "59e9ec59-a888-48e4-afb4-441602de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}], "info": "OSINT - IoT_reaper: A Rappid Spreading New IoT Botnet", "date": "2017-10-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1508585697}, "59eb345d-34f0-4fc6-b785-2ace02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"JadeRAT\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#4bec00", "local": false, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"", "relationship_type": ""}], "info": "OSINT - JadeRAT mobile surveillanceware spikes in espionage activity", "date": "2017-10-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1508587610}, "59ec91ee-ae0c-4d5a-b149-4c0d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Dragonfly\"", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Energetic Bear\"", "relationship_type": ""}], "info": "OSINT -  US CERT TA17-293A report - renamed PsExec execution (sigma/SIEM ruleset)", "date": "2017-10-22", "analysis": 2, "threat_level_id": 2, "timestamp": 1508677312}, "59f02f94-544c-4db8-b156-46ce950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Bad Rabbit\"", "relationship_type": ""}], "info": "Bad Rabbit (via Pastebin)", "date": "2017-10-25", "analysis": 0, "threat_level_id": 3, "timestamp": 1508919605}, "59f0462f-41d4-47b4-9e1b-4a07950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Bad Rabbit\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Backup and Restore Process\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Restrict Workstation Communication\"", "relationship_type": ""}], "info": "OSINT - Bad Rabbit ransomware", "date": "2017-10-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1508922261}, "59f04ba5-e890-4534-8fa9-47dd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Bad Rabbit\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Restrict Workstation Communication\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Backup and Restore Process\"", "relationship_type": ""}], "info": "OSINT - BadRabbit Ransomware Compiled by ThaiCERT, a member of the Electronic Transactions Development Agency", "date": "2017-10-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1508929710}, "59f049c0-aae0-47d2-a888-4021950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Bad Rabbit\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Backup and Restore Process\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Restrict Workstation Communication\"", "relationship_type": ""}], "info": "OSINT - Bad Rabbit: Not-Petya is back with improved ransomware", "date": "2017-10-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1511385587}, "59f04995-3b8c-4cf0-b555-4b26950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Bad Rabbit\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Backup and Restore Process\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Restrict Workstation Communication\"", "relationship_type": ""}], "info": "OSINT - Return of Not Petya as Bad Rabbit Diskcoder, yes those two are the same!", "date": "2017-10-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1511385575}, "59f4a30d-fdf8-4617-b6ab-45df02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Bahamut Revisited, More Cyber Espionage in the Middle East and South Asia", "date": "2017-10-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1511385618}, "59f87123-2624-486b-92c9-4f14950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3, \".asasin\"/Trickbot \"mac1\" 2017-10-31 : \"Invoice INV0000123\" - \"INV0000123.doc\"", "date": "2017-10-31", "analysis": 1, "threat_level_id": 3, "timestamp": 1510241637}, "59f889d2-b1a4-44f9-a31e-256c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#4e9c00", "local": false, "name": "circl:incident-classification=\"scam\"", "relationship_type": ""}], "info": "Suspicious domains extrapolated from fake Microsoft scammer domain", "date": "2017-10-31", "analysis": 0, "threat_level_id": 3, "timestamp": 1509466187}, "59fc621f-6728-41c4-9cf3-4561950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#0d9e00", "local": false, "name": "misp-galaxy:tool=\"NanHaiShu\"", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT Leviathan: Espionage actor spearphishes maritime and defense targets", "date": "2017-10-16", "analysis": 2, "threat_level_id": 1, "timestamp": 1509717276}, "59f6f4a5-0e10-4c36-9c71-5690c25ed030": {"Orgc": {"name": "CERT-RLP", "uuid": "593798b3-3924-4c43-9742-0d9fc25ed030"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Sage 2.2\"", "relationship_type": ""}, {"colour": "#777c00", "local": false, "name": "ncsc-nl-ndn:feed=\"generic\"", "relationship_type": ""}, {"colour": "#a2009c", "local": false, "name": "retention:1m", "relationship_type": ""}], "info": "Evasive Sage 2.2 Ransomware", "date": "2017-10-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1571052699}, "5a0066bf-f9bc-478a-afee-4410950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-11-03 : Affid=3, offline, \".asasin\" : \"12345678.doc\"", "date": "2017-11-06", "analysis": 1, "threat_level_id": 3, "timestamp": 1510233192}, "5a015fbc-3218-4ec8-a4e5-4622950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT32\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society", "date": "2017-11-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1511385841}, "5a044f31-7dec-4bf7-b031-cc6f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3, \".asasin\" 2017-11-02 : \"Scan\" - \"Scan00123.doc\"", "date": "2017-11-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1510258864}, "5a044fae-c0b0-45d4-8f7e-75a9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky Affid=3, \".asasin\" 2017-11-01 : \"Emailing: AZ123 - 01.11.2017\" - \"AZ123 - 01.11.2017.doc\"", "date": "2017-11-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1510259437}, "5a044feb-cda0-4844-b5f0-2214950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-11-03 : Affid=3, offline, \".asasin\" : \"Scanned image from MX-2600N\" - \"20171103_123456.doc\"", "date": "2017-11-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1510261077}, "5a04510c-b2d0-467b-97a3-75a9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-11-06 : Affid=3, \".asasin\" : \"E3S1234567890123 Payment advice\" - \"advice_123456_20171106.doc\"", "date": "2017-11-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1510261635}, "5a045167-9e00-4562-95ea-4f67950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-11-07 : Affid=3, offline, \".asasin\" : \"Invoice #123456789,\" - \"987654321_11_07_2017_12_34_56.doc\"", "date": "2017-11-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1510262093}, "5a0451b3-211c-45f2-ac24-403d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-11-07 : Affid=3, offline, \".asasin\" : \"Emailing: AZ123 - 07.11.2017\" - \"AZ123 - 07.11.2017.doc\"", "date": "2017-11-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1510261554}, "5a0451dc-4468-4b5a-9175-473a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-11-08 : Affid=3, offline, \".asasin\" : \"Invoice AX1234567\" - \"Invoice-AX1234567.doc\"", "date": "2017-11-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1510258834}, "5a05d1d7-5710-44c0-869f-4a52950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}], "info": "M2M -  Locky 2017-11-09 : Affid=3, offline, \".asasin\" : \"Documents\" - \"ABY001234.doc\"", "date": "2017-11-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1510392278}, "5a0a9aa9-23a4-4607-b6df-41a9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT -  New Malware with Ties to SunOrcal Discovered", "date": "2017-11-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1510922435}, "5a142fcd-cb4c-4b8b-99c5-0efd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"CryptoMix\"", "relationship_type": ""}], "info": "OSINT - 0000 Cryptomix Ransomware Variant Released", "date": "2017-11-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1511360400}, "5a1e6038-a088-46ac-95ef-ad9e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"rokrat\"", "relationship_type": ""}], "info": "OSINT - ROKRAT Reloaded", "date": "2017-11-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1511941670}, "5a1e6e1d-4cc0-4ce6-aeba-7e44950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - UBoatRAT Navigates East Asia", "date": "2017-11-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1512010840}, "5a214d9a-ed50-4a33-8812-491a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Fake Windows Troubleshooting Support Scam Uploads Screenshots & Uses Paypal", "date": "2017-11-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1512356424}, "5a216518-dd10-4191-9ac8-4919950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#211c1c", "local": false, "name": "Android Malware", "relationship_type": ""}, {"colour": "#3e6e00", "local": false, "name": "malware_classification:malware-category=\"Spyware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:android=\"Tizi\"", "relationship_type": ""}], "info": "OSINT - Google Discovers New Tizi Android Spyware", "date": "2017-11-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1512283042}, "5a23a972-e6a0-4a05-b505-4e8f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:android=\"Tizi\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}], "info": "OSINT - Tizi: Detecting and blocking socially engineered spyware on Android", "date": "2017-11-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1512356440}, "5a24041c-d7c8-4dc1-b0ed-45f702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}], "info": "OSINT - Android Malware Appears Linked to Lazarus Cybercrime Group", "date": "2017-12-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1512310223}, "5a25117c-6260-44a1-91b4-489d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Cobalt\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - Gaffe Reveals Full List of Targets in Spear Phishing Attack Using Cobalt Strike Against Financial Institutions", "date": "2017-12-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1512442830}, "5a252fea-cbdc-425d-ba82-436a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"CryptoMix\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Test Cryptomix Ransomware Variant Released", "date": "2017-12-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1512388614}, "5a265a9e-9e54-4d44-a04e-42af950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Halloware Ransomware on Sale on the Dark Web for Only $40", "date": "2017-12-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1512554589}, "5a26b608-7e48-48c1-bf61-43a3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Fake Globe Ransomware\"", "relationship_type": ""}], "info": "M2M - \"..doc\" 2017-11-30 : \"FL-123456 11.30.2017.7z\"", "date": "2017-12-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1512554615}, "5a26b77f-6250-4b25-bd53-4496950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Fake Globe Ransomware\"", "relationship_type": ""}], "info": "M2M - \"..doc\" 2017-12-01 : \"12_Invoice_3456\" - \"I_4321.7z\"", "date": "2017-12-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1516291548}, "5a26b88f-ba04-46a5-9f52-48ed950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Fake Globe Ransomware\"", "relationship_type": ""}], "info": "M2M - \"..doc\" 2017-12-04 : \"Emailing: 1234567\" - \"1234567.7z\"", "date": "2017-12-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1512553562}, "5a26b911-af14-4c92-86a9-446c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Fake Globe Ransomware\"", "relationship_type": ""}], "info": "M2M - \"..doc\" 2017-12-05 : 'Message from \"G10PR0123456.MYCOMPANY.COM\"' - \"20171205123.zip\"", "date": "2017-12-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1512554476}, "5a290dd3-ac58-46b1-9334-fe72950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"HC7\"", "relationship_type": ""}], "info": "OSINT - HC7 GOTYA Ransomware Installed via Remote Desktop Services. Spread with PsExec", "date": "2017-12-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1512914163}, "5a2cec1b-7f7c-4e23-bd7f-40be02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"PROMETHIUM\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"StrongPity2\"", "relationship_type": ""}], "info": "OSINT - StrongPity2 spyware replaces FinFisher in MitM campaign \u00e2\u20ac\u201c ISP involved?", "date": "2017-12-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1512895188}, "5a26b513-1ffc-497b-8cac-c53a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Multi-stage malware sneaks into Google Play", "date": "2017-11-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1540544859}, "5a329d19-03e0-4eaa-8b4d-4310950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#74e800", "local": false, "name": "circl:topic=\"industry\"", "relationship_type": ""}, {"colour": "#00839f", "local": false, "name": "veris:asset:variety=\"S - SCADA\"", "relationship_type": ""}], "info": "OSINT - Attackers Deploy New ICS Attack Framework \u00e2\u20ac\u0153TRITON\u00e2\u20ac\u009d and Cause Operational Disruption to Critical Infrastructure", "date": "2017-12-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1515812452}, "5a338667-b794-44c5-80e8-4892950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"CryptoMix\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT -  WORK Cryptomix Ransomware Variant Released", "date": "2017-12-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1518231654}, "5a339ef9-a768-4af7-88b3-7f21950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - File Spider Ransomware Targeting the Balkans With Malspam", "date": "2017-12-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1513393222}, "5a37887b-efe0-43ba-8542-435c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - Active ransomware attack uses impersonation and embedded advanced threats", "date": "2017-08-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1513738826}, "5a3797c2-e770-4722-9435-4350950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Princess Locker\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - RIG exploit kit distributes Princess ransomware", "date": "2017-08-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1513738831}, "5a38299e-326c-45d6-9279-481102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Dragonfly\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Operation Dragonfly Analysis Suggests Links to Earlier Attacks", "date": "2017-12-18", "analysis": 0, "threat_level_id": 3, "timestamp": 1513738844}, "5a38ca48-6680-437d-9e0f-483c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#211c1c", "local": false, "name": "Android Malware", "relationship_type": ""}, {"colour": "#001a40", "local": false, "name": "ms-caro-malware-full:malware-platform=\"AndroidOS\"", "relationship_type": ""}], "info": "OSINT - Still stealing", "date": "2017-12-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1513738857}, "5a38dd78-f12c-4c15-8b98-c4d6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#002149", "local": false, "name": "riskiq:threat-type=\"credit-card-stealer\"", "relationship_type": ""}], "info": "OSINT - GratefulPOS credit card stealing malware - just in time for the shopping season", "date": "2017-12-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1518231662}, "5a390de6-4a58-4a19-89fb-4620950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Panda Banker\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}], "info": "OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers", "date": "2017-12-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1513825239}, "5a391a35-45c8-4e0b-b580-4cdc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Geodo\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}], "info": "OSINT - The Emotet Banking Trojan: Analysis of Dropped Malware Morphing at Scale", "date": "2017-12-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1513825248}, "5a37cd2b-208c-44c1-a08c-41d0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Malspam pushing Locky ransomware tries HoeflerText notifications for Chrome and FireFox", "date": "2017-09-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1513825223}, "5a39216d-e93c-4046-8ff5-bfd8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#f24722", "local": false, "name": "Banker", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}], "info": "OSINT - Banking malware on Google Play targets Polish banks", "date": "2017-12-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1513825257}, "5a3a297f-95a8-418e-a949-484f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#f24722", "local": false, "name": "Banker", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#211c1c", "local": false, "name": "Android Malware", "relationship_type": ""}, {"colour": "#001a40", "local": false, "name": "ms-caro-malware-full:malware-platform=\"AndroidOS\"", "relationship_type": ""}], "info": "OSINT - How Mobile Bankbots Disguise as Perfectly Trustworthy Apps", "date": "2017-11-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1513825272}, "5a3a3aca-a210-497a-9715-452c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Satori\"", "relationship_type": ""}], "info": "OSINT - Rise of One More Mirai Worm Variant", "date": "2017-12-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1513911633}, "5a3b6be0-1924-4671-8829-d895950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Gh0st RAT\"", "relationship_type": ""}, {"colour": "#075800", "local": false, "name": "misp-galaxy:tool=\"Gh0st Rat\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"gh0st\"", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"PowerRatankba\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"PowerSpritz\"", "relationship_type": ""}], "info": "OSINT - North Korea Bitten by Bitcoin Bug: Financially motivated campaigns reveal new dimension of the Lazarus Group", "date": "2017-12-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1513911661}, "5a3bcbe0-3d70-427d-8744-4bdb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}], "info": "OSINT - DownAndExec: Banking malware utilizes CDNs in Brazil", "date": "2017-09-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1518231673}, "5a3bd35f-7140-48d0-8b88-4555950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Locky\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Fake Globe Ransomware\"", "relationship_type": ""}, {"colour": "#e6007c", "local": false, "name": "workflow:state=\"complete\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Locky Ransomware Pushed Alongside FakeGlobe in Upgraded Spam Campaigns", "date": "2017-09-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1540562142}, "5a3cc84d-2434-4ae6-8d76-c328950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"Sednit EK\"", "relationship_type": ""}, {"colour": "#007d98", "local": false, "name": "veris:actor:motive=\"Espionage\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Sednit espionage group now using custom exploit kit", "date": "2014-10-08", "analysis": 0, "threat_level_id": 3, "timestamp": 1516071622}, "5a3faeda-9524-4a8c-a329-b4d302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"TRISIS\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00839f", "local": false, "name": "veris:asset:variety=\"S - SCADA\"", "relationship_type": ""}, {"colour": "#74e800", "local": false, "name": "circl:topic=\"industry\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}], "info": "OSINT -  Repository containting orignal and decompiled files of TRISIS/TRITON/HATMAN malware", "date": "2017-12-24", "analysis": 0, "threat_level_id": 2, "timestamp": 1621849558}, "5a462890-bb44-47c7-ba3b-21bda5fe7088": {"Orgc": {"name": "Crimeware", "uuid": "569f692d-b290-40cc-ae1a-2c48ff32448e"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "Threat Analysis: Malicious Microsoft Word Documents Being Used in Targeted Attack Campaigns", "date": "2017-12-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1571052771}, "5a54778c-3dac-4d36-b7c3-4d6e02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - A North Korean Monero Cryptocurrency Miner", "date": "2018-01-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1515553226}, "5a54ad87-3328-4dde-aa9f-4a7e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Microcin\"", "relationship_type": ""}], "info": "OSINT - MICROCIN MALWARE", "date": "2017-09-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1515726024}, "5a57af9d-a0ec-4e54-a44d-483302de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#37ab00", "local": false, "name": "enisa:nefarious-activity-abuse=\"mobile-malware\"", "relationship_type": ""}], "info": "OSINT - First Kotlin-Developed Malicious App Signs Users Up for Premium SMS Services", "date": "2018-01-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1515726034}, "5a587e74-2218-498e-ba91-4165950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}], "info": "OSINT - Suspicious binary delivered as fake jpeg", "date": "2018-01-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1515812467}, "5a5724c6-5e20-4d61-9ccb-4191950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"FruitFly\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"MacDownloader\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"MacRansom\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"MacSpy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Empyre\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Proton\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Mughthesec\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Pwnet\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"CpuMeaner\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"FileCoder\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Dok\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"XAgentOSX\"", "relationship_type": ""}, {"colour": "#0c9800", "local": false, "name": "misp-galaxy:tool=\"X-Agent\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}], "info": "OSINT - Mac Malware of 2017", "date": "2018-01-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1518231708}, "5a54ca42-e9a0-4d71-a9e6-4f9b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Experts analyzed an Advanced \"all in memory\" CryptoWorm", "date": "2017-09-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1516071630}, "5a5de39e-cb60-4839-af53-c1be950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}, {"colour": "#086200", "local": false, "name": "admiralty-scale:source-reliability=\"c\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}, {"colour": "#f1ee1d", "local": false, "name": "Threat:Sofacy/APT28", "relationship_type": ""}], "info": "Finding Nemo(hosts) from Sofacy by ThreatConnect", "date": "2017-07-21", "analysis": 2, "threat_level_id": 1, "timestamp": 1516105507}, "5a5c7013-8bac-403e-859b-4101950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#f1ee1d", "local": false, "name": "Threat:Sofacy/APT28", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#0f4d00", "local": false, "name": "Threat Type:APT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}], "info": "OSINT Duping Doping Domains - Possible Fancy Bear Domains Spoofing Anti-Doping and Olympic Organizations by ThreatConnect", "date": "2018-01-11", "analysis": 2, "threat_level_id": 1, "timestamp": 1516105388}, "5a5deec2-afe0-4036-a218-49c3950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}, {"colour": "#f1ee1d", "local": false, "name": "Threat:Sofacy/APT28", "relationship_type": ""}], "info": "OSINT Fancy Bear Pens the Worst Blog Posts Ever by ThreatConnect", "date": "2017-11-02", "analysis": 2, "threat_level_id": 1, "timestamp": 1516106946}, "5a5df567-ad8c-4649-ad06-480f950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#f1ee1d", "local": false, "name": "Threat:Sofacy/APT28", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}], "info": "OSINT Track to the future - How to use historical intelligence to get back to the future and defend your organization (example using APT28) by ThreatConnect", "date": "2017-09-21", "analysis": 2, "threat_level_id": 1, "timestamp": 1516107710}, "5a5df98f-3ea4-4cd5-b1d5-47d5950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Phantom of the Opaera: New KASPERAGENT Malware Campaign by ThreatConnect", "date": "2017-06-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1516110409}, "5a607314-de88-4309-ba06-c4a9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Fake Globe Ransomware\"", "relationship_type": ""}, {"colour": "#39001f", "local": false, "name": "workflow:todo=\"expansion\"", "relationship_type": ""}], "info": "M2M -  GlobeImposter \"..doc\" 2018-01-12 : \"Unpaid invoice \" - \"1234567.7z\"", "date": "2018-01-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1518231724}, "5a63182c-6bc4-4774-99d4-04070a00020f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#500064", "local": false, "name": "ms-caro-malware:malware-type=\"Trojan\"", "relationship_type": ""}, {"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}, {"colour": "#005fa4", "local": false, "name": "osint:source-type=\"manual-analysis\"", "relationship_type": ""}], "info": "Malware collected via pastebin", "date": "2018-01-20", "analysis": 0, "threat_level_id": 4, "timestamp": 1621849582}, "5a67a79f-7884-46c7-ad56-49ba950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - First C&C (IPv6) - Azorult", "date": "2018-01-23", "analysis": 0, "threat_level_id": 3, "timestamp": 1516762822}, "5a698fd0-f3dc-4e06-a580-4d34950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malicious Chrome browser extensions injecting code", "date": "2018-01-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1516884441}, "5a69e332-f944-46f8-b172-637202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Nexus Zeta\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Masuta\"", "relationship_type": ""}], "info": "OSINT - Masuta : Satori Creators\u00e2\u20ac\u2122 Second Botnet Weaponizes A New Router Exploit.", "date": "2018-01-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1516935657}, "5a69fdaf-0350-429a-b961-062f02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0c9200", "local": false, "name": "misp-galaxy:tool=\"Hancitor\"", "relationship_type": ""}], "info": "OSINT - RTF files for Hancitor utilize exploit for CVE-2017-11882", "date": "2018-01-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1516935686}, "5a6869a1-1bbc-4a25-ad96-a8fd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#006262", "local": false, "name": "ecsirt:malicious-code=\"malware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Smoke Loader\"", "relationship_type": ""}], "info": "Fake Job Application incl. Macro", "date": "2018-01-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1516976580}, "5a69ed26-44c8-423c-a8dc-4f7b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Dark Caracal\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#007d98", "local": false, "name": "veris:actor:motive=\"Espionage\"", "relationship_type": ""}], "info": "OSINT - Dark Caracal Cyber-espionage at a Global Scale", "date": "2018-01-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1518231742}, "5a6f379d-3854-4457-949e-41bb950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Quasar RAT\"", "relationship_type": ""}], "info": "OSINT - VERMIN: Quasar RAT and Custom Malware Used In Ukraine", "date": "2018-01-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1517281238}, "5a708104-c8b0-4e69-8ac8-4db3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"RATAttack\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#4bec00", "local": false, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"", "relationship_type": ""}], "info": "OSINT - TelegramRAT evades traditional defenses via the cloud", "date": "2017-12-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1517324476}, "5a719a5d-ba14-4ec4-b4b8-4c94950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#4bec00", "local": false, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"", "relationship_type": ""}, {"colour": "#850048", "local": false, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster-values\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"CrossRat\"", "relationship_type": ""}], "info": "OSINT - Analyzing CrossRAT", "date": "2018-01-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1517454034}, "5a7238f2-7ea4-499a-89f6-450b02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Smominru Monero mining botnet making millions for operators", "date": "2018-01-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1517540435}, "5a8042be-fe8c-4071-a140-414502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Mirai\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Satori\"", "relationship_type": ""}], "info": "OSINT - Dasan Unauthenticated Remote Code Execution - and ongoing abuse", "date": "2018-02-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1518404418}, "5a8ab58a-213c-409a-97af-4eb5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Panda Banker\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}], "info": "OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers", "date": "2017-12-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1519053563}, "5a8aea46-0ad4-4b8a-9cfd-445b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#6b003a", "local": false, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": ""}], "info": "OSINT - GandCrab Ransomware Distributed by Exploit Kits, Appends GDCB Extension", "date": "2018-01-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1519121264}, "5a8d2377-208c-4330-908f-4818950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}, {"colour": "#0f4d00", "local": false, "name": "Threat Type:APT", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "A Slice of 2017 Sofacy Activity by Kaspersky", "date": "2018-02-21", "analysis": 2, "threat_level_id": 1, "timestamp": 1596436741}, "5a96f935-0b24-47b8-b0a7-4fff02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT28\"", "relationship_type": ""}], "info": "OSINT - Sofacy Attacks Multiple Government Entities", "date": "2018-02-28", "analysis": 2, "threat_level_id": 2, "timestamp": 1519844016}, "5a9922cb-9c5c-4979-a78c-4fee950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#086200", "local": false, "name": "admiralty-scale:source-reliability=\"c\"", "relationship_type": ""}], "info": "SMS/iMessage phishes forcing users to install/run scripts and update VPN settings", "date": "2018-03-02", "analysis": 0, "threat_level_id": 3, "timestamp": 1519987573}, "5a9c4472-55e8-4734-b23b-401702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Modify Existing Service\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Code Signing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"File Deletion\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Deobfuscate/Decode Files or Information\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-attack-pattern=\"System Information Discovery\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-attack-pattern=\"Process Discovery\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Service Execution\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Rundll32\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Scripting\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Command-Line Interface\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Data from Local System\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Automated Exfiltration\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Data Encrypted\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-attack-pattern=\"Commonly Used Port\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-attack-pattern=\"Bypass User Account Control\"", "relationship_type": ""}], "info": "OSINT - McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups", "date": "2018-03-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1520191817}, "5a9e8885-2290-43d4-99bb-4cb3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#850048", "local": false, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster-values\"", "relationship_type": ""}], "info": "Malware \u00e2\u20ac\u0153TSCookie\u00e2\u20ac\u009d", "date": "2018-03-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1520517168}, "5aa23875-d0dc-49d6-82a6-d309950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#a0a300", "local": false, "name": "dnc:malware-type=\"CoinMiner\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Apache SOLR: the new target for cryptominers", "date": "2018-03-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1520592413}, "5aa43c06-fbdc-4a8f-b607-406402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#420014", "local": false, "name": "collaborative-intelligence:request=\"sample\"", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}], "info": "OSINT - New traces of Hacking Team in the wild", "date": "2018-03-10", "analysis": 2, "threat_level_id": 2, "timestamp": 1520714084}, "5aa63cdc-2e9c-4621-8499-4c47950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0c9100", "local": false, "name": "admiralty-scale:source-reliability=\"f\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-entreprise-attack-intrusion-set=\"Turla\"", "relationship_type": ""}, {"colour": "#065000", "local": false, "name": "misp-galaxy:tool=\"Wipbot\"", "relationship_type": ""}], "info": "OSINT - Turla Nautilus Implant", "date": "2018-03-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1520844403}, "5aa64b62-8f2c-4081-a6f9-4480950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#10cb00", "local": false, "name": "misp-galaxy:threat-actor=\"Mirage\"", "relationship_type": ""}], "info": "OSINT -  Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research", "date": "2018-03-12", "analysis": 2, "threat_level_id": 2, "timestamp": 1520848045}, "5aa670db-6ef0-4d81-8e90-9476950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#10cb00", "local": false, "name": "misp-galaxy:threat-actor=\"Mirage\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS", "date": "2018-03-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1520857725}, "5aaa3126-0b38-4bd7-960a-4e48950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Qwerty Ransomware\"", "relationship_type": ""}], "info": "OSINT - Qwerty Ransomware Utilizes GnuPG to Encrypt a Victims Files", "date": "2018-03-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1521636826}, "5aac24b9-0404-4877-8b3f-425e02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}], "info": "OSINT - Sofacy Uses DealersChoice to Target European Government Agency", "date": "2018-03-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1521231369}, "5aaa8a97-0cac-48bd-877a-41b5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}], "info": "OSINT - Alert (TA18-074A) Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors", "date": "2018-03-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1521576479}, "5abc9cfc-4f24-40a6-b7e1-4870950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"SHARPKNOT\"", "relationship_type": ""}], "info": "OSINT - March 28, 2018: Malware Analysis Report (MAR-10135536.11) \u00e2\u20ac\u201c North Korean Trojan: SHARPKNOT", "date": "2018-03-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1522335157}, "5abf6421-c1b8-477b-a9d2-9c0902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"jRAT\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"qrat\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Quaverse\"", "relationship_type": ""}], "info": "OSINT - Crypter-as-a-Service Helps jRAT Fly Under The Radar", "date": "2018-03-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1522493184}, "5ac5d6b1-3848-4918-9e42-4206950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"CryptoMix\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Zeta\"", "relationship_type": ""}, {"colour": "#e6007c", "local": false, "name": "workflow:state=\"complete\"", "relationship_type": ""}], "info": "OSINT - Mole66 Cryptomix Ransomware Variant Released", "date": "2018-03-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1523200179}, "5ac6140f-5964-4eb8-81bd-4095950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"UselessDisk\"", "relationship_type": ""}], "info": "OSINT - The DiskWriter or UselessDisk BootLocker May Be A Wiper", "date": "2018-03-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1523201507}, "5ac763c9-0ba0-413e-ae2a-4de3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#a0a300", "local": false, "name": "dnc:malware-type=\"CoinMiner\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Black Ruby\"", "relationship_type": ""}, {"colour": "#51a200", "local": false, "name": "circl:incident-classification=\"cryptojacking\"", "relationship_type": ""}], "info": "OSINT - Black Ruby Ransomware Skips Victims in Iran and Adds a Miner for Good Measure", "date": "2018-02-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1523201602}, "5ac7752d-a430-4606-8d2b-06b4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"WhiteRose\"", "relationship_type": ""}], "info": "OSINT - The WhiteRose Ransomware Is Decryptable & Tells A Strange Story", "date": "2018-04-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1523201450}, "5ac8cee2-2a78-4237-88a0-d0b802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001585", "local": false, "name": "estimative-language:likelihood-probability=\"roughly-even-chance\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Network Service Scanning\"", "relationship_type": ""}, {"colour": "#00ffb3", "local": false, "name": "cyber-threat-framework:Effect/Consequence=\"destroy-hardware-software-or-data\"", "relationship_type": ""}], "info": "OSINT - Cisco IOS CVE-2018-0171 attack", "date": "2018-04-07", "analysis": 2, "threat_level_id": 2, "timestamp": 1523942190}, "5acb6516-f590-4456-8fd7-4243950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Matrix\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "OSINT - New Matrix Ransomware Variants Installed Via Hacked Remote Desktop Services", "date": "2018-04-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1523391291}, "5acc88e9-265c-4f22-9d2b-b702950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#001637", "local": false, "name": "ms-caro-malware-full:malware-type=\"Joke\"", "relationship_type": ""}, {"colour": "#850048", "local": false, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster-values\"", "relationship_type": ""}], "info": "OSINT - PUBG Ransomware Decrypts Your Files If You Play PlayerUnknown's Battlegrounds", "date": "2018-04-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1523391234}, "5acdb4d0-b534-4713-9612-4a1d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"GoScanSSH\"", "relationship_type": ""}], "info": "OSINT - Forgot About Default Accounts? No Worries, GoScanSSH Didn\u00e2\u20ac\u2122t", "date": "2018-03-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1523865236}, "5ace0663-370c-40d0-b651-44f4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"IcedID\"", "relationship_type": ""}, {"colour": "#6b003a", "local": false, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": ""}, {"colour": "#850048", "local": false, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster-values\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  IcedID Banking Trojan Teams up with Rovnix for Distribution", "date": "2018-04-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1523458621}, "5ad059f5-b418-43bc-a901-7c4a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Magniber Ransomware\"", "relationship_type": ""}], "info": "OSINT - Goodbye Cerber? Hello Magniber Ransomware!", "date": "2017-10-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1523865207}, "5ad09f32-ce58-47f3-b137-4411950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Vurten\"", "relationship_type": ""}], "info": "Vurten Ransomware", "date": "2018-04-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1523865150}, "5ad0ae92-71c4-44bb-a47d-4c17950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Crypren\"", "relationship_type": ""}], "info": "Crypren Ransomware", "date": "2018-04-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1523867322}, "5ad8687b-0e10-4a8b-a157-46a5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"CSGO Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"MC Ransomware\"", "relationship_type": ""}], "info": "OSINT - Minecraft & CS:GO Ransomware Strive For Media Attention", "date": "2018-04-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1524216268}, "5ad5bc00-d988-48bb-9293-2135950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Talos/Cisco  Threat Roundup for April 6 - 13", "date": "2018-04-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1524215517}, "5add984c-c0f0-41b0-8ff0-4f6d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"MaktubLocker\"", "relationship_type": ""}], "info": "OSINT - Maktub ransomware: possibly rebranded as Iron", "date": "2018-04-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1525369091}, "5adf7b6e-eb68-43dc-8a49-47b1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Sednit update: Analysis of Zebrocy", "date": "2018-04-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1524596273}, "5ae2129e-15b4-41e9-9428-4f1e02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Service Execution - T1035\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"System Time Discovery - T1124\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"File Deletion - T1107\"", "relationship_type": ""}, {"colour": "#850048", "local": false, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster-values\"", "relationship_type": ""}], "info": "OSINT - Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide", "date": "2018-04-26", "analysis": 2, "threat_level_id": 2, "timestamp": 1524766410}, "5ae6cb05-26e0-442f-b430-478b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - On the Economic Significance of Ransomware Campaigns: A Bitcoin Transactions Perspective", "date": "2018-04-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1525098135}, "5adeed17-3124-41c1-91b9-4a97950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#001534", "local": false, "name": "ms-caro-malware-full:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Orangeworm\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia", "date": "2018-04-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1525369039}, "5aec0f0f-7fe0-4e42-8f64-44e5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"ZooPark\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Who's who in the zoo. Cyberespionage operation targets android users in the Middle East.", "date": "2018-05-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1525441529}, "5aeffb23-79e0-4d58-acf9-4b28950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"GandCrab\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - GandCrab Version 3 Released With Autorun Feature and Desktop Background", "date": "2018-05-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1525762485}, "5aec6eea-74a4-43f9-8910-498d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Lojack Becomes a Double-Agent", "date": "2018-05-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1525782957}, "5af150f7-bd58-4f06-9228-89a8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}], "info": "OSINT - APT28 malicious NATO document", "date": "2017-02-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1525782502}, "5af14f0e-3778-4a34-8cab-8659950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"GAMEFISH\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"JHUHUGIT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"JHUHUGIT - S0044\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#8a004a", "local": false, "name": "workflow:todo=\"add-tagging\"", "relationship_type": ""}], "info": "OSINT - \u00e2\u20ac\u0153Cyber Conflict\u00e2\u20ac\u009d Decoy Document Used In Real Cyber Conflict", "date": "2017-10-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1525782537}, "5af412ea-4254-4668-b1ea-44bc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Botnet exploiting GPON Vulnerability", "date": "2018-05-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1525948956}, "5af969eb-2068-40ea-a133-40a9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#211c1c", "local": false, "name": "Android Malware", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#001a40", "local": false, "name": "ms-caro-malware-full:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Malicious Apps Get Back on the Play Store Just by Changing Their Name", "date": "2018-05-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1526580976}, "5afafce0-0598-4ca0-b52a-41f4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0082e1", "local": false, "name": "osint:certainty=\"75\"", "relationship_type": ""}], "info": "OSINT - A tale of two zero-days", "date": "2018-05-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1526398950}, "5af9eb11-bba8-46ab-acc0-b75e0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Panda Banker\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}, {"colour": "#777c00", "local": false, "name": "ncsc-nl-ndn:feed=\"generic\"", "relationship_type": ""}, {"colour": "#a2009c", "local": false, "name": "retention:1m", "relationship_type": ""}], "info": "Panda Malware Broadens - F5 Blog", "date": "2018-05-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1571052711}, "5b04369a-e36c-44c1-986f-08ef0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Trickbot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}], "info": "TrickBot pir4 loader config", "date": "2018-05-22", "analysis": 2, "threat_level_id": 2, "timestamp": 1527004990}, "5b043df6-f10c-4de2-a499-2f0d0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00abd0", "local": false, "name": "veris:action:malware:variety=\"Spyware/Keylogger\"", "relationship_type": ""}, {"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}], "info": "Keylogger info via Twitter Feed", "date": "2018-05-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1621849728}, "5b0438ad-6d20-4a53-9a8b-2c1c0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}], "info": "Emotet 5-18-2018", "date": "2018-05-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1621849729}, "5b0598ec-97ac-4456-9246-dcdb0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "Talos Blog: VPNFilter", "date": "2018-05-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1527104159}, "5b072226-9b38-47c4-a948-0a8d0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}], "info": "Wells Fargo Phish", "date": "2018-05-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1527194901}, "5b06a4b4-6e74-40b8-ae95-9fc10acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}, {"colour": "#777c00", "local": false, "name": "ncsc-nl-ndn:feed=\"generic\"", "relationship_type": ""}, {"colour": "#a2009c", "local": false, "name": "retention:1m", "relationship_type": ""}], "info": "Emotet - 5/21/2018", "date": "2018-05-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1571052711}, "5b06a89d-64d4-4643-a41e-c25d0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}], "info": "Emotet - 5/17/2018", "date": "2018-05-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1631045306}, "5b06e5c0-0038-48bf-ae71-c25d0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#0c9200", "local": false, "name": "misp-galaxy:tool=\"Hancitor\"", "relationship_type": ""}], "info": "Hancitor", "date": "2018-05-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1527262642}, "5b0d3d49-7be8-4be1-9d15-5d4d0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Talos Blog: Threat Roundup for May 18-25", "date": "2018-05-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1527596356}, "5b0e8c35-c968-4704-983c-b77b0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"IcedID\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Trickbot\"", "relationship_type": ""}], "info": "\"TrickBot\" and \"IcedID\" Botnet IOCs", "date": "2018-05-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1527697635}, "5b0d929e-4c6c-438a-9fe5-78130acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"Lazarus Group (G0032) uses Remote File Copy (T1105)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"Lazarus Group (G0032) uses Brute Force (T1110)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"Lazarus Group (G0032) uses Connection Proxy (T1090)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"Lazarus Group (G0032) uses Command-Line Interface (T1059)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"Lazarus Group (G0032) uses System Information Discovery (T1082)\"", "relationship_type": ""}], "info": "US-CERT Alert (TA18-149A) HIDDEN COBRA \u2013 Joanap Backdoor Trojan and Brambul Server Message Block Worm", "date": "2018-05-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1621849752}, "5b1154e7-9c00-4159-b091-5fb80acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"GrandSoft\"", "relationship_type": ""}, {"colour": "#8300d4", "local": false, "name": "adversary:infrastructure-type=\"exploit-distribution-point\"", "relationship_type": ""}], "info": "Grand Soft EK domains", "date": "2018-06-01", "analysis": 2, "threat_level_id": 2, "timestamp": 1571052712}, "5b115d30-5fe8-4016-a4d5-5fb80acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"FormBook\"", "relationship_type": ""}], "info": "One IP hosting multiple phishing domains", "date": "2018-06-01", "analysis": 2, "threat_level_id": 2, "timestamp": 1621849761}, "5b167b4f-5038-42e4-9a45-dfd00acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}], "info": "#TrickBot banker updates to group_tag \"\"tt0002\" version \"1000206\"", "date": "2018-06-05", "analysis": 2, "threat_level_id": 2, "timestamp": 1528204849}, "5b16dc9e-eb88-47b0-8ccd-fbae0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}], "info": "Phishing Domains", "date": "2018-06-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1528228441}, "5b16dcc8-2750-456f-8840-fbae0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}], "info": "Phishing Domains", "date": "2018-06-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1528228375}, "5b17e074-3d90-4f06-bbf0-44c9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"CryptoMix\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - New Backup Cryptomix Ransomware Variant Actively Infecting Users", "date": "2018-05-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1540562337}, "5b17eaaf-783c-4624-b5f4-42d5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Sigrun Ransomware\"", "relationship_type": ""}], "info": "OSINT - Sigrun Ransomware Author Decrypting Russian Victims for Free", "date": "2018-06-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1528891752}, "5b191ead-fac0-4f21-aaef-b9700acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0eab00", "local": false, "name": "misp-galaxy:tool=\"Necurs\"", "relationship_type": ""}], "info": "New Phishing Attacks Abuse Excel Internet Query Files", "date": "2018-06-07", "analysis": 2, "threat_level_id": 2, "timestamp": 1751449207}, "5b194472-fbac-4d90-8504-c0f80acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#f71212", "local": false, "name": "APT", "relationship_type": ""}], "info": "Sofacy Group\u2019s Parallel Attacks", "date": "2018-06-07", "analysis": 2, "threat_level_id": 2, "timestamp": 1607525062}, "5b1a247e-2ca0-4132-9210-4b5c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"PLEAD Downloader\"", "relationship_type": ""}], "info": "OSINT - PLEAD Downloader Used by BlackTech", "date": "2018-06-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1528891759}, "5b1ace23-25c0-4c98-b257-9cc8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - InvisiMole: surprisingly equipped spyware, undercover since 2013", "date": "2018-06-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1528487219}, "5b1e2aab-9e84-4908-9db2-4bb8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"PRILEX\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT -  Goodfellas, the Brazilian carding scene is after you", "date": "2018-03-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1528874953}, "5b1e79b9-cf9c-4072-b420-4be0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#211c1c", "local": false, "name": "Android Malware", "relationship_type": ""}, {"colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#001a40", "local": false, "name": "ms-caro-malware-full:malware-platform=\"AndroidOS\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Roaming Mantis\"", "relationship_type": ""}], "info": "OSINT -  Roaming Mantis uses DNS hijacking to infect Android smartphones", "date": "2018-04-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1528891813}, "5b1e9c95-75a8-4132-93e5-58ed0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"KillDisk Wiper\"", "relationship_type": ""}], "info": "Trend Micro Blog: New KillDisk Variant Hits Latin American Financial Organizations Again", "date": "2018-06-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1621849776}, "5b265497-b458-4c11-a57c-45db02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}], "info": "Malware Analysis Report (AR18-165A) MAR-10135536-12 \u00e2\u20ac\u201c North Korean Trojan: TYPEFRAME", "date": "2018-05-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1529239607}, "5b276228-9270-42f9-9ecd-4a81950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ClipboardWalletHijacker\"", "relationship_type": ""}], "info": "Clipboard Hijacker Targeting Bitcoin & Ethereum Users Infects Over 300,0000 PCs", "date": "2018-06-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1540557811}, "5b2783ba-57e4-44da-88ee-4c4f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Donut\"", "relationship_type": ""}, {"colour": "#e6007c", "local": false, "name": "workflow:state=\"complete\"", "relationship_type": ""}], "info": "OSINT - New Donut Ransomware", "date": "2018-06-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1540558659}, "5b28d191-1100-4688-aa5d-48cd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"DBGer Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ETERNALBLUE\"", "relationship_type": ""}, {"colour": "#064800", "local": false, "name": "misp-galaxy:tool=\"Mimikatz\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Mimikatz - S0002\"", "relationship_type": ""}], "info": "OSINT - DBGer Ransomware Uses EternalBlue and Mimikatz to Spread Across Networks", "date": "2018-06-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1529820217}, "5b28ffbe-0118-409f-8f26-4f0e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Olympic Destroyer\"", "relationship_type": ""}], "info": "OSINT - Malware That Hit Pyeongchang Olympics Deployed in New Attacks", "date": "2018-06-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1529820170}, "5b2f3583-d514-458a-a12e-480a02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Tick\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Multi-Stage Channels - T1104\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Replication Through Removable Media - T1091\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - Tick Group Weaponized Secure USB Drives to Target Air-Gapped Critical Systems", "date": "2018-06-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1529821311}, "5b310846-157c-46d7-8141-89f00acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b6b", "local": false, "name": "ms-caro-malware-full:malware-family=\"Redirector\"", "relationship_type": ""}, {"colour": "#f02988", "local": false, "name": "Bokbot", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}], "info": "Registrant Tracking for \"earthalgerrity@armyspy.com\"", "date": "2018-06-25", "analysis": 1, "threat_level_id": 3, "timestamp": 1732078805}, "5b28113a-05b8-4913-8fdb-27410acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "bank phishing domains", "date": "2018-06-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1529957908}, "5b325da8-0434-48ad-8b27-48de950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"KHRAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"KhRAT\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"RANCOR\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}], "info": "OSINT - RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families", "date": "2018-06-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1530610086}, "5b337664-88a4-4764-a97f-205b0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"IcedID\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}, {"colour": "#16f5f5", "local": false, "name": "IcedID", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}, {"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}, {"colour": "#00183c", "local": false, "name": "ms-caro-malware-full:malware-type=\"Trojan\"", "relationship_type": ""}, {"colour": "#00a8cd", "local": false, "name": "veris:action:malware:vector=\"Web download\"", "relationship_type": ""}, {"colour": "#00a9cf", "local": false, "name": "veris:action:malware:variety=\"Downloader\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Export data\"", "relationship_type": ""}], "info": "Blog Post: EMOTET INFECTION WITH ICEDID", "date": "2018-06-27", "analysis": 2, "threat_level_id": 2, "timestamp": 1621849804}, "5b366652-b0a4-4faa-a58b-c6040acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}, {"colour": "#004959", "local": false, "name": "veris:discovery_method=\"Int - NIDS\"", "relationship_type": ""}, {"colour": "#00d1fe", "local": false, "name": "veris:attribute:confidentiality:data:variety=\"Credentials\"", "relationship_type": ""}], "info": "Malicious Emails Outlook Themed", "date": "2018-06-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1530292629}, "5b3a4543-e5d4-485c-8960-fe190acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"NanoCore\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Razy\"", "relationship_type": ""}, {"colour": "#054000", "local": false, "name": "misp-galaxy:tool=\"njRAT\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"RemoteAccess\"", "relationship_type": ""}], "info": "Malware with legit company names in metadata", "date": "2018-07-02", "analysis": 2, "threat_level_id": 2, "timestamp": 1530552872}, "5b3b7b62-5728-4980-937b-40240acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#777c00", "local": false, "name": "ncsc-nl-ndn:feed=\"generic\"", "relationship_type": ""}, {"colour": "#a2009c", "local": false, "name": "retention:1m", "relationship_type": ""}], "info": "Clipboard CryptoCoin Hijacker", "date": "2018-07-03", "analysis": 2, "threat_level_id": 2, "timestamp": 1751449921}, "5b3b7b6f-6234-45ea-be4f-ab8202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"RIG\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT -  Down but Not Out: A Look Into Recent Exploit Kit Activities", "date": "2018-07-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1530626412}, "5b3e4d3d-0644-43ef-9ebd-30cd0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Smoke Loader\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#0042a5", "local": false, "name": "ms-caro-malware-full:malware-family=\"ShellCode\"", "relationship_type": ""}, {"colour": "#991515", "local": false, "name": "trickbot", "relationship_type": ""}, {"colour": "#3d7a00", "local": false, "name": " Smoke Loader", "relationship_type": ""}], "info": "Talos Blog - Smoking Guns - Smoke Loader learned new tricks", "date": "2018-07-05", "analysis": 2, "threat_level_id": 2, "timestamp": 1531208745}, "5b43ce0c-47e8-476c-97d6-f56402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data from Information Repositories - T1213\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"The Big Bang\"", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - APT Attack In the Middle East: The Big Bang", "date": "2018-07-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1531205768}, "5b44a06a-d458-497b-b05e-0c1e0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "Trend Micro Blog: Malicious Macro Hijacks Desktop Shortcuts to Deliver Backdoor", "date": "2018-07-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1696420897}, "5b4f5308-42c0-434a-a8c5-48ae950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OVH Phishing", "date": "2018-07-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1532095371}, "5b50b23c-d7f0-4195-8512-13c30acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}], "info": "Email Credential Phish, Dropbox Theme", "date": "2018-07-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1621849813}, "5b577b74-e1ac-4dbc-a5b2-c6bf0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}], "info": "Emotet links", "date": "2018-07-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1532459943}, "5b577bf2-48d4-492f-bd9d-c7f90acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#003860", "local": false, "name": "osint:source-type=\"pastie-website\"", "relationship_type": ""}, {"colour": "#0c9200", "local": false, "name": "misp-galaxy:tool=\"Hancitor\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Panda Banker\"", "relationship_type": ""}], "info": "Hancitor Intel", "date": "2018-07-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1532460322}, "5b58330e-b924-4828-b3a5-4986950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Kronos\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware", "date": "2016-11-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1748941278}, "5b58e29a-cb98-42a6-8b3b-4a6802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"RASPITE\"", "relationship_type": ""}], "info": "OSINT - Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions", "date": "2018-07-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1533219022}, "5b597959-6310-43e8-80b2-4d30950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Smoke Loader\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"Smoke Loader - S0226\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Kronos\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002f76", "local": false, "name": "ms-caro-malware-full:malware-family=\"Banker\"", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}], "info": "OSINT - Kronos Reborn", "date": "2018-07-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1532610824}, "5b608c59-6328-49e7-af04-22de0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#777174", "local": false, "name": "Malvertising", "relationship_type": ""}], "info": "Massive Malvertising Campaign Discovered Attempting 40,000 Infections per Week", "date": "2018-07-31", "analysis": 1, "threat_level_id": 2, "timestamp": 1533054591}, "5b60b046-c0c8-49ce-aa97-437a02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#10ca00", "local": false, "name": "misp-galaxy:threat-actor=\"Hellsing\"", "relationship_type": ""}], "info": "OSINT - Malicious document targets Vietnamese officials", "date": "2018-07-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1533301051}, "5b61a496-b034-4321-9406-e0330acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Cobalt\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"Cobalt Strike uses PowerShell\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:exploit-kit=\"ThreadKit\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"CMSTP - T1191\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Regsvr32 - T1117\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}, {"colour": "#4d3300", "local": false, "name": "cert-ist:threat_targeted_system=\"Windows\"", "relationship_type": ""}, {"colour": "#885a00", "local": false, "name": "cert-ist:threat_targeted_sector=\"Finance\"", "relationship_type": ""}, {"colour": "#fea700", "local": false, "name": "cert-ist:enriched", "relationship_type": ""}, {"colour": "#392500", "local": false, "name": "cert-ist:ioc_accuracy=\"high\"", "relationship_type": ""}, {"colour": "#3a2600", "local": false, "name": "cert-ist:threat_level=\"low\"", "relationship_type": ""}, {"colour": "#f8a400", "local": false, "name": "cert-ist:threat_type=\"apt\"", "relationship_type": ""}], "info": "Talos Blog: Multiple Cobalt Personality Disorder", "date": "2018-08-01", "analysis": 2, "threat_level_id": 2, "timestamp": 1607525069}, "5b63f5e4-bf24-4f46-8340-48fc02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Babylon\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"BetaBot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"AZORult\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Manufacturing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Oil\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Energy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Mining\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Construction\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Logistic\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - Attacks on industrial enterprises using RMS and TeamViewer", "date": "2018-08-03", "analysis": 2, "threat_level_id": 2, "timestamp": 1533279935}, "5b646415-7b48-40d5-86b4-c0070acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ab34e3", "local": false, "name": "PasteBin: MALWAREMESSIAGH", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Gozi\"", "relationship_type": ""}], "info": "Ursnif, MALWAREMESSIAGH", "date": "2018-08-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1533306089}, "5b645c85-3a4c-4a54-9b17-6b840acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ab34e3", "local": false, "name": "PasteBin: MALWAREMESSIAGH", "relationship_type": ""}, {"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}], "info": "Phishing Domains, MALWAREMESSIAGH", "date": "2018-08-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1533306992}, "5b671098-3024-42db-b972-42ae02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"NETWIRE - S0198\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Netwire\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - Off-the-shelf RATs Targeting Pakistan", "date": "2018-08-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1533485808}, "5b68aa4f-fac0-4ebe-a647-b1380acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}], "info": "RBC Themed Phish, Obfuscated Javascript in .htm attachment", "date": "2018-08-06", "analysis": 2, "threat_level_id": 2, "timestamp": 1533649882}, "5b6aad49-a01c-4070-aba8-4b32950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Cobalt\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"FIN7\"", "relationship_type": ""}, {"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"WannaSmile\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Black Ruby\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"RASTAKHIZ\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"TYRANT\"", "relationship_type": ""}], "info": "OSINT - CYBER THREATSCAPE  REPORT 2018 - MIDYEAR CYBERSECURITY  RISK REVIEW", "date": "2018-08-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1533822770}, "5b6edeb7-5088-4fe9-89ab-40e902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"KEYMARBLE\"", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}], "info": "OSINT - Malware Analysis Report (AR18-221A) MAR-10135536-17 \u00e2\u20ac\u201c North Korean Trojan: KEYMARBLE- MAR-10135536.r17.v1", "date": "2018-07-31", "analysis": 0, "threat_level_id": 3, "timestamp": 1533997473}, "5b6c4a32-92cc-499d-9dd2-3989950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Samas-Samsam\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}], "info": "OSINT - SamSam Ransomware Crew Made Nearly $6 Million From Ransom Payments", "date": "2018-07-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1534160421}, "5b716ba0-7ecc-4f64-a07c-d96d0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "Talos: Threat Roundup for August 3-10", "date": "2018-08-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1621865274}, "5b72bf0a-a300-4b09-9755-a4b00acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "[TIA-REPO Consumption] KeyPass ransomware", "date": "2018-08-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1747225316}, "5b337e5f-4810-4cbe-bb0e-4b79950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"NJRat\"", "relationship_type": ""}, {"colour": "#054000", "local": false, "name": "misp-galaxy:tool=\"njRAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"RedAlpha\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"NGO\"", "relationship_type": ""}], "info": "OSINT - RedAlpha: New Campaigns Discovered Targeting the Tibetan Community", "date": "2018-06-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1534250303}, "5b746d63-8c10-46b5-8c1a-49ec02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT-C-35\"", "relationship_type": ""}], "info": "OSINT - \u00e8\u201a\u0161\u00e8\u201e\u2018\u00e8\u2122\u00ab\u00e7\u00bb\u201e\u00e7\u00bb\u2021\u00ef\u00bc\u02c6APT-C-35\u00ef\u00bc\u2030\u00e7\u00a7\u00bb\u00e5\u0160\u00a8\u00e7\u00ab\u00af\u00e6\u201d\u00bb\u00e5\u2021\u00bb\u00e6\u00b4\u00bb\u00e5\u0160\u00a8\u00e6\u008f\u00ad\u00e9\u0153\u00b2", "date": "2018-08-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1534358234}, "5b7d1f89-9148-4961-b56f-9168950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Microsoft Disrupts APT28 Hacking Campaign Aimed at US Midterm Elections", "date": "2018-08-21", "analysis": 2, "threat_level_id": 3, "timestamp": 1534929537}, "5b7e9b01-107c-416d-a38d-18ee0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#00aad0", "local": false, "name": "veris:action:malware:variety=\"C2\"", "relationship_type": ""}, {"colour": "#00add3", "local": false, "name": "veris:action:social:vector=\"Documents\"", "relationship_type": ""}, {"colour": "#00bde6", "local": false, "name": "veris:action:misuse:vector=\"Remote access\"", "relationship_type": ""}], "info": "TALOS Blog: Picking Apart Remcos Botnet-In-A-Box", "date": "2018-08-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1696420884}, "5b84012a-f9d4-4d92-abb3-344f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Dharma Ransomware\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - New Bip Dharma Ransomware Variant Released", "date": "2018-05-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1536238352}, "5b9162c3-90b4-423b-bd69-28330acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "powerpool-malware-exploits-zero-day-vulnerability", "date": "2018-09-06", "analysis": 2, "threat_level_id": 2, "timestamp": 1732078824}, "5b9123c0-1480-4e09-877e-4783950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Sigma Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#026900", "local": false, "name": "monarc-threat:unauthorised-actions=\"corruption-of-data\"", "relationship_type": ""}, {"colour": "#039900", "local": false, "name": "monarc-threat:compromise-of-information=\"malware-infection\"", "relationship_type": ""}], "info": "OSINT - Sigma Ransomware Being Distributed Using Fake Craigslist Malspam", "date": "2018-03-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1536755790}, "5b9663f7-91d0-4bcb-ad23-4637950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"FALLCHILL\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT -  Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware", "date": "2018-08-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1540716814}, "5b991442-a9f0-4b5b-bc56-445f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Mirai\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Mirai\"", "relationship_type": ""}, {"colour": "#0da800", "local": false, "name": "misp-galaxy:tool=\"Gafgyt\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Gafgyt\"", "relationship_type": ""}], "info": "OSINT - Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall", "date": "2018-09-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1536846498}, "5b718bda-8d9c-477f-bcd5-4634950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"KEYPASS\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - New KeyPass Ransomware Campaign Underway", "date": "2018-08-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1536842677}, "5b9ba490-0e84-4127-916f-4f75950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#054000", "local": false, "name": "misp-galaxy:tool=\"njRAT\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00bde6", "local": false, "name": "veris:action:misuse:vector=\"Remote access\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - old njRAT activity", "date": "2014-03-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1536927610}, "5b9f39b4-f618-494f-ad3e-030d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - Dangerous Invoices and Dangerous Infrastructure", "date": "2018-09-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1537162058}, "5b6c44c2-e8cc-4c56-8eb9-4f0a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}], "info": "OSINT -  Familiar Feeling A Malware Campaign Targeting the Tibetan Diaspora Resurfaces", "date": "2018-08-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1537215802}, "5ba1d01f-27cc-438f-9cbc-4652950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#a200ca", "local": false, "name": "ms-caro-malware:malware-platform=\"Python\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Xbash\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Iron Group\"", "relationship_type": ""}], "info": "OSINT (expanded) - Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows", "date": "2018-09-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1537334496}, "5b141e8e-1d54-42df-ae6b-5c4802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Iron Backdoor\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#51a200", "local": false, "name": "circl:incident-classification=\"cryptojacking\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Iron Group\"", "relationship_type": ""}], "info": "OSINT - Iron Cybercrime Group Under The Scope", "date": "2018-06-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1537334732}, "5ba7542d-feb4-4a10-8aaa-4f0102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#043600", "local": false, "name": "misp-galaxy:tool=\"Poison Ivy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"PoisonIvy\"", "relationship_type": ""}, {"colour": "#0022d6", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"low\"", "relationship_type": ""}], "info": "OSINT - Poison Ivy Group and the Cyberespionage Campaign Against Chinese Military and Goverment", "date": "2018-09-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1537726146}, "544f8aa7-9224-46ad-a73f-30f9950d210b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#10c300", "local": false, "name": "misp-galaxy:threat-actor=\"Axiom\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "OSINT - Operation SMN (Novetta)", "date": "2014-10-28", "analysis": 2, "threat_level_id": 2, "timestamp": 1537703409}, "5bb3b566-b054-436e-aabf-4bd902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - CIG Circular 66  \u00e2\u20ac\u201c FASTCash  ATM Cash  Out Campaign", "date": "2018-10-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1538565800}, "5bb5d045-acf8-42ac-97ce-45c5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#0c9900", "local": false, "name": "misp-galaxy:tool=\"X-Tunnel\"", "relationship_type": ""}, {"colour": "#0c9800", "local": false, "name": "misp-galaxy:tool=\"X-Agent\"", "relationship_type": ""}], "info": "OSINT - Indicators of Compromise for Malware used by APT28", "date": "2018-10-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1538643710}, "5bb61071-d0ac-4b8a-8bba-4dc8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#22681c", "local": false, "name": "\tmalware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Persirai\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Persirai: New Internet of Things (IoT) Botnet Targets IP Cameras", "date": "2017-05-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1538680509}, "5bb71d5e-8784-489b-b33f-46e7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"CoalaBot\"", "relationship_type": ""}, {"colour": "#00bdbd", "local": false, "name": "ecsirt:availability=\"ddos\"", "relationship_type": ""}, {"colour": "#285c00", "local": false, "name": "ddos:type=\"amplification-attack\"", "relationship_type": ""}], "info": "OSINT - CoalaBot: http Ddos Bot", "date": "2017-10-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1540716975}, "5bbb1f88-fe84-4834-bccd-7916950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Matrix\"", "relationship_type": ""}], "info": "OSINT - New Fox Ransomware Matrix Variant Tries Its Best to Close All File Handles", "date": "2018-08-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1539157322}, "5bbe03c3-0ec0-4ee7-949b-4e3c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MuddyWater\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"MuddyWater - G0069\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3bb800", "local": false, "name": "enisa:nefarious-activity-abuse=\"spear-phishing-attacks\"", "relationship_type": ""}, {"colour": "#c90091", "local": false, "name": "smart-airports-threats:malicious-actions=\"social-attacks-phishing-spearphishing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}], "info": "OSINT -  MuddyWater expands operations", "date": "2018-10-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1540717131}, "5bbe09c9-9040-4415-bd25-45b7950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Panda Banker\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Man in the Browser - T1185\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Geodo\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}], "info": "OSINT - Threat Spotlight: Panda Banker Trojan Targets the US, Canada and Japan", "date": "2018-10-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1539441119}, "5bc60f40-929c-4fed-b93d-44e9950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Panda Banker\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#6d0021", "local": false, "name": "collaborative-intelligence:request=\"more-samples\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - 2018-10-09 - HANCITOR INFECTION WITH ZEUS PANDA BANKER", "date": "2018-10-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1556197334}, "5bec7912-23c8-4a0a-9597-4818950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"INDRIK SPIDER\"", "relationship_type": ""}], "info": "OSINT - Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware", "date": "2018-11-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1542225152}, "5bf26acf-d95c-4892-a05d-4db5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e100", "local": false, "name": "misp-galaxy:threat-actor=\"APT 29\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT29\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"CozyCar\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT29 - G0016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"CozyCar\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Cobalt Strike\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Cobalt Strike\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike - S0154\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Cobalt Strike\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#316200", "local": false, "name": "circl:incident-classification=\"phishing\"", "relationship_type": ""}], "info": "OSINT - CozyBear \u00e2\u20ac\u201c In from the Cold?", "date": "2018-11-18", "analysis": 0, "threat_level_id": 3, "timestamp": 1542637546}, "5afaeb66-962c-4cd6-a5c8-419e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ARS VBS Loader\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"ARS VBS Loader\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"RemoteAccess\"", "relationship_type": ""}], "info": "OSINT -  RAT Gone Rogue: Meet ARS VBS Loader", "date": "2018-05-15", "analysis": 0, "threat_level_id": 3, "timestamp": 1542964453}, "5bf26a1e-c40c-4977-92bf-49b5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"BONDUPDATER\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"OilRig\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"OilRig\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"OilRig\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Analyzing OilRig\u00e2\u20ac\u2122s Ops Tempo from Testing to Weaponization to Delivery", "date": "2018-11-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1543005910}, "5bf7ba12-bec4-4d01-8330-4373950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}], "info": "OSINT - Turla PNG Dropper is back", "date": "2018-11-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1542987280}, "5bfc6891-b838-44fe-bc17-16b702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00a0a0", "local": false, "name": "ecsirt:intrusions=\"application-compromise\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}], "info": "OSINT - `event-stream` dependency attack steals wallets from users of copay", "date": "2018-11-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1543270394}, "5bfd7696-5874-4de3-acf3-4478950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT -  DNSpionage Campaign Targets Middle East", "date": "2018-11-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1543338554}, "5c00e9b7-50ac-4aa7-b893-4a63950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0c9200", "local": false, "name": "misp-galaxy:tool=\"Hancitor\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Hancitor\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}], "info": "OSINT - Hancitor active again yith new macro - IoCs", "date": "2018-11-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1543579806}, "5c065ec5-6ab0-4cc1-a032-bf18950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Samas-Samsam\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SamSam\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "SamSam Ransomware - Alert (AA18-337A)", "date": "2018-12-04", "analysis": 0, "threat_level_id": 3, "timestamp": 1544005070}, "5c0661f7-77a0-4ec9-bdcf-d447950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SamSam\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Samas-Samsam\"", "relationship_type": ""}], "info": "MAR-10219351.r1.v2 (SamSam ransomware)", "date": "2018-11-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1544005098}, "5c066053-0e94-46eb-9746-4b7d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SamSam\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Samas-Samsam\"", "relationship_type": ""}], "info": "MAR-10164494.r1.v1 (SamSam ransomware)", "date": "2018-11-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1544005129}, "5c066106-263c-4b85-9387-4d3f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SamSam\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Samas-Samsam\"", "relationship_type": ""}], "info": "MAR-10166283.r1.v1 (SamSam ransomware)", "date": "2018-11-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1544005267}, "5c04f23f-fd50-4445-ba0b-40b3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Samas-Samsam\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SamSam\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}], "info": "OSINT - Making a Ransomware Payment? It May Now Violate U.S. Sanctions", "date": "2018-11-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1544041447}, "5c0abf20-a720-47f4-ae29-5eb60acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Third-party Software - T1072\"", "relationship_type": ""}, {"colour": "#160940", "local": false, "name": " Flash", "relationship_type": ""}, {"colour": "#008960", "local": false, "name": "cyber-threat-framework:Engagement=\"exploit-vulnerabilities\"", "relationship_type": ""}, {"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}, {"colour": "#00add3", "local": false, "name": "veris:action:social:vector=\"Documents\"", "relationship_type": ""}, {"colour": "#0042a5", "local": false, "name": "ms-caro-malware-full:malware-family=\"ShellCode\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Flash CVE-2018-15982 IOCs", "date": "2018-12-07", "analysis": 2, "threat_level_id": 1, "timestamp": 1544209363}, "5c0e7410-8460-486e-8f02-a11d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"AZORult\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Azorult\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#00b4db", "local": false, "name": "veris:action:social:variety=\"Extortion\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"win.gandcrab\"", "relationship_type": ""}], "info": "OSINT - Sextortion with a side of ransomware", "date": "2018-12-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1544604303}, "5c125ad1-a1a8-495e-ae07-48bd950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"System Time Discovery - T1124\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data Encrypted - T1022\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Operation Sharpshooter\"", "relationship_type": ""}], "info": "OSINT - \u00e2\u20ac\u02dcOperation Sharpshooter\u00e2\u20ac\u2122 Targets Global Defense, Critical Infrastructure", "date": "2018-12-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1544734085}, "5c1803a3-43cc-4be7-83bf-42f202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Password Protected ZIP with Maldoc", "date": "2018-12-17", "analysis": 0, "threat_level_id": 3, "timestamp": 1545078053}, "5c18091d-d158-41aa-88c7-4692950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#11da00", "local": false, "name": "misp-galaxy:threat-actor=\"Charming Kitten\"", "relationship_type": ""}], "info": "OSINT - The Return of The Charming Kitten", "date": "2018-12-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1545079498}, "5c18a87a-ba34-4abe-9a37-424d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#4e9c00", "local": false, "name": "circl:incident-classification=\"scam\"", "relationship_type": ""}, {"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Scam\"", "relationship_type": ""}, {"colour": "#00234d", "local": false, "name": "riskiq:threat-type=\"scam\"", "relationship_type": ""}, {"colour": "#006ded", "local": false, "name": "riskiq:threat-name=\"scam-scareware\"", "relationship_type": ""}], "info": "OSINT - New Bomb Threat Email Scam Campaign Demanding $20K in Bitcoin", "date": "2018-12-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1545142940}, "5c1def50-7570-4012-bbe0-46e202de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Mirai\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Mirai\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Mirai\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Malicious ELF binary (Mirai) - 2018-12-22 (collected on a router)", "date": "2018-12-22", "analysis": 0, "threat_level_id": 3, "timestamp": 1545466408}, "5c225981-ae64-4141-8a37-430a02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Shamoon\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"Shamoon\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - Destructive Shamoon Malware Continues its Return with a New Anti-American Message", "date": "2018-12-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1545860566}, "5c25d759-4fec-4f21-a9ed-59b90a00020f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Shamoon\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"DistTrack\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Shamoon\"", "relationship_type": ""}], "info": "Shamoon potential samples", "date": "2018-12-28", "analysis": 2, "threat_level_id": 2, "timestamp": 1621849939}, "5c2e0676-75c0-4759-b794-0b360acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#00b2d9", "local": false, "name": "veris:action:social:variety=\"Phishing\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#875737", "local": false, "name": "source:OSINT", "relationship_type": ""}], "info": "Phishing Sites", "date": "2019-01-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1546520683}, "5c2f9787-fb54-4046-816b-3a6d0acd0835": {"Orgc": {"name": "Synovus Financial", "uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"}, "Tag": [{"colour": "#10c800", "local": false, "name": "misp-galaxy:threat-actor=\"Stone Panda\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "FBI FLASH AB-000102-MW", "date": "2019-01-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1607525088}, "5c3862bd-cbb4-4373-854a-4507950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"DarkHydrus\"", "relationship_type": ""}], "info": "OSINT - DarkHydrus is launching attacks to targets in Middle East", "date": "2019-01-10", "analysis": 0, "threat_level_id": 3, "timestamp": 1547215090}, "5c38eb9d-a470-4466-8aa5-461802de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "ServHelper and FlawedGrace - New malware introduced by TA505", "date": "2019-01-11", "analysis": 2, "threat_level_id": 2, "timestamp": 1547235254}, "5c3c4a6d-15f0-4133-baff-3c2c68f8e8cf": {"Orgc": {"name": "VK-Intel", "uuid": "5bfa439e-c978-4dcd-b474-73f568f8e8cf"}, "Tag": [{"colour": "#e0b538", "local": false, "name": "Actor: Lazarus", "relationship_type": ""}, {"colour": "#421b85", "local": false, "name": "Ruse: Job Application", "relationship_type": ""}, {"colour": "#2133c6", "local": false, "name": "Powershell", "relationship_type": ""}, {"colour": "#7a0e9f", "local": false, "name": "PowerRatankba", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Trusted Relationship - T1199\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Windows Management Instrumentation - T1047\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"New Service - T1050\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data Encoding - T1132\"", "relationship_type": ""}, {"colour": "#8aec22", "local": false, "name": "report:5ZvWjgDgRhuD1zVgDT7-cg", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#005e2b", "local": false, "name": "misp:confidence-level=\"fairly-confident\"", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#4e7300", "local": false, "name": "CTIA-kill-chain:Payload", "relationship_type": ""}, {"colour": "#578000", "local": false, "name": "CTIA-kill-chain:C2", "relationship_type": ""}], "info": "2019-01-10: North Korea Lazarus Targeting REDBANC", "date": "2019-01-14", "analysis": 0, "threat_level_id": 2, "timestamp": 1547678812}, "5c3f3eca-3ce8-4bb0-8f24-43c0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Cold River\"", "relationship_type": ""}], "info": "OSINT -  Threat Actor \u00e2\u20ac\u0153Cold River\u00e2\u20ac\u009d: Network Traffic Analysis and a Deep Dive on Agent Drable", "date": "2019-01-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1547722837}, "5c37602c-b178-47ea-8f49-45d5950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:backdoor=\"ServHelper\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"FlawedGrace\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#00a9ce", "local": false, "name": "veris:action:malware:variety=\"Backdoor\"", "relationship_type": ""}, {"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}], "info": "OSINT - TA505 Group Adopts New ServHelper Backdoor and FlawedGrace RAT", "date": "2019-01-10", "analysis": 0, "threat_level_id": 3, "timestamp": 1547727524}, "5c4073ea-ed74-44e6-8965-d558950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"LoJax\"", "relationship_type": ""}, {"colour": "#2f5400", "local": false, "name": "malware_classification:malware-category=\"Rootkit\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}], "info": "OSINT - LoJax Command and Control Domains Still Active", "date": "2019-01-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1547935413}, "5c45721d-de08-4fff-b9b0-168a02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#1f3f00", "local": false, "name": "circl:incident-classification=\"system-compromise\"", "relationship_type": ""}, {"colour": "#00aeae", "local": false, "name": "ecsirt:intrusions=\"compromised\"", "relationship_type": ""}, {"colour": "#0013bb", "local": false, "name": "europol-incident:information-security=\"unauthorized-access\"", "relationship_type": ""}, {"colour": "#0014c5", "local": false, "name": "europol-incident:information-security=\"unauthorized-modification\"", "relationship_type": ""}, {"colour": "#004e5f", "local": false, "name": "veris:security_incident=\"Confirmed\"", "relationship_type": ""}], "info": "Incident - pear.php.net - compromised and delivering malicious package", "date": "2019-01-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1548332586}, "5c481c61-a718-4051-aacf-4f19950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"DarkHydrus - G0079\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"DarkHydrus\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004f4f", "local": false, "name": "ecsirt:malicious-code=\"trojan\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"RogueRobin\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"RogueRobin - S0270\"", "relationship_type": ""}, {"colour": "#39001f", "local": false, "name": "workflow:todo=\"expansion\"", "relationship_type": ""}], "info": "OSINT - DarkHydrus delivers new Trojan that can use Google Drive for C2 communications", "date": "2019-01-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1566552967}, "5c4a2972-fd10-4470-936d-4d2a02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "IOCs Associated with DNS Infrastructure Tampering", "date": "2019-01-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1548364213}, "5c463bd0-63bc-41f1-91dc-622168f8e8cf": {"Orgc": {"name": "VK-Intel", "uuid": "5bfa439e-c978-4dcd-b474-73f568f8e8cf"}, "Tag": [{"colour": "#aa6c53", "local": false, "name": "Actor: APT28", "relationship_type": ""}, {"colour": "#ab875e", "local": false, "name": "Autoit", "relationship_type": ""}, {"colour": "#671079", "local": false, "name": "Actor: Sofacy", "relationship_type": ""}, {"colour": "#0dcd05", "local": false, "name": "Downloader", "relationship_type": ""}, {"colour": "#89a9b6", "local": false, "name": "Malware: Zebrocy", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Registry Run Keys / Start Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Windows Management Instrumentation - T1047\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "2019-01-21: APT28 Autoit Zebrocy Progression", "date": "2019-01-21", "analysis": 0, "threat_level_id": 2, "timestamp": 1621849993}, "5c4cb9a7-0454-42eb-8f63-383368f8e8cf": {"Orgc": {"name": "VK-Intel", "uuid": "5bfa439e-c978-4dcd-b474-73f568f8e8cf"}, "Tag": [{"colour": "#e0b538", "local": false, "name": "Actor: Lazarus", "relationship_type": ""}, {"colour": "#302c04", "local": false, "name": "DPRK", "relationship_type": ""}, {"colour": "#403c80", "local": false, "name": "Malware: PowerRatankba,b", "relationship_type": ""}, {"colour": "#7036f2", "local": false, "name": "PowerShell Installer", "relationship_type": ""}, {"colour": "#2be799", "local": false, "name": "Keylogger", "relationship_type": ""}, {"colour": "#b11b8a", "local": false, "name": "Country: Pakistan", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"PowerRatankba\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Lazarus\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Lazarus Group - G0032\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"PowerRatankba\"", "relationship_type": ""}], "info": "2019-01-25: Lazarus Pakistan Toolkits", "date": "2019-01-26", "analysis": 0, "threat_level_id": 2, "timestamp": 1621849995}, "5c47f54e-1cf4-48d1-b188-245768f8e8cf": {"Orgc": {"name": "VK-Intel", "uuid": "5bfa439e-c978-4dcd-b474-73f568f8e8cf"}, "Tag": [{"colour": "#cdce6a", "local": false, "name": "Banker: TrickBot", "relationship_type": ""}, {"colour": "#3e9874", "local": false, "name": "Version: 1057", "relationship_type": ""}, {"colour": "#54cc21", "local": false, "name": "core-parser.dll", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Trickbot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}], "info": "2019-01-22: Emotet->TrickBot", "date": "2019-01-23", "analysis": 0, "threat_level_id": 2, "timestamp": 1621849996}, "5c500809-453c-4245-83e1-435c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"APT28 (G0007) uses XTunnel (S0117)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"APT28 uses XTunnel\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"XTunnel\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"XTunnel - S0117\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"XTunnel\"", "relationship_type": ""}, {"colour": "#00b3b3", "local": false, "name": "ecsirt:intrusions=\"backdoor\"", "relationship_type": ""}, {"colour": "#00a9ce", "local": false, "name": "veris:action:malware:variety=\"Backdoor\"", "relationship_type": ""}, {"colour": "#2c0037", "local": false, "name": "ms-caro-malware:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#001534", "local": false, "name": "ms-caro-malware-full:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}], "info": "2019-01-28: APT28 XTunnel Backdoor", "date": "2019-01-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1548770635}, "5c502e8e-09e8-4c7c-9135-4c1b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Turla RAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Turla\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Turla - G0010\"", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Kazuar\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Kazuar - S0265\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Kazuar\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#4bec00", "local": false, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"", "relationship_type": ""}, {"colour": "#008ba9", "local": false, "name": "veris:asset:variety=\"S - Remote access\"", "relationship_type": ""}, {"colour": "#00bde6", "local": false, "name": "veris:action:misuse:vector=\"Remote access\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#5f0044", "local": false, "name": "CERT-XLM:malicious-code=\"spyware-rat\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}], "info": "2019-01-28: Turla Kazuar RAT", "date": "2019-01-28", "analysis": 0, "threat_level_id": 3, "timestamp": 1548767952}, "5c5201f6-e414-4dc2-be61-4f4502de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Cisco Job Posting Targets Korean Candidates", "date": "2019-01-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1548878619}, "5c5331ac-c160-4a17-a34f-3da568f8e8cf": {"Orgc": {"name": "VK-Intel", "uuid": "5bfa439e-c978-4dcd-b474-73f568f8e8cf"}, "Tag": [{"colour": "#20ad13", "local": false, "name": "Banker: Gozi ISFB v2", "relationship_type": ""}, {"colour": "#6f236b", "local": false, "name": "Banker: Dridex", "relationship_type": ""}, {"colour": "#bcdb18", "local": false, "name": "Botnet \"3101\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "10291029JSJUYNHG", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Dridex\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "2019-01-31: ISFB v2 Installs Dridex \"3101\"", "date": "2019-01-31", "analysis": 0, "threat_level_id": 2, "timestamp": 1548966934}, "5c5b1d6e-d824-4fbe-969b-3aea950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}], "info": "Malicious XLS claiming to be from Deloitte", "date": "2019-02-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1549476362}, "5c5d6a71-da60-46ba-bc18-42d4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"DanaBot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"DanaBot\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - DanaBot updated with new C&C communication", "date": "2019-02-08", "analysis": 0, "threat_level_id": 3, "timestamp": 1549626558}, "5c63ef49-0754-4a05-b712-e88b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"menuPass\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"menuPass - G0045\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"menuPass\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"menuPass - G0045\"", "relationship_type": ""}, {"colour": "#10c800", "local": false, "name": "misp-galaxy:threat-actor=\"Stone Panda\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}], "info": "OSINT - ChessMaster Makes its Move: A Look into the Campaign\u00e2\u20ac\u2122s Cyberespionage Arsenal", "date": "2017-08-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1550071763}, "5c687cb3-08c4-46d3-9981-093702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1035\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hooking - T1179\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "Fake amf-fr.org website delivering malicious Word document and binaries", "date": "2019-02-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1550352213}, "5c687e12-522c-41f4-a498-486d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "VMRay Analyzer Report for Sample #252574 (related amf-fr.org)", "date": "2019-02-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1550352119}, "5c6baef6-fca0-446e-b0b1-ac45950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Uncommonly Used Port - T1065\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hooking - T1179\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Office Application Startup - T1137\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "Financial - socgen-compliance.com fake website delivering malicious documents", "date": "2019-02-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1550562629}, "5c6d21e5-bb60-47b7-b892-42e6950d2111": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#005b9d", "local": false, "name": "osint:source-type=\"automatic-collection\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Gafgyt\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Bashlite\"", "relationship_type": ""}, {"colour": "#0da800", "local": false, "name": "misp-galaxy:tool=\"Gafgyt\"", "relationship_type": ""}, {"colour": "#410069", "local": false, "name": "adversary:infrastructure-action=\"take-down\"", "relationship_type": ""}], "info": "IoT malware - Gafgyt.Gen28 (active) - 20190220 - 20190222", "date": "2019-02-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1708956185}, "5c706a30-8ad4-4fcc-9e17-4d3d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Stolen Developer Credentials or Signing Keys - T1441\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"BabyShark\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"STOLEN PENCIL\"", "relationship_type": ""}], "info": "OSINT - New BabyShark Malware Targets U.S. National Security Think Tanks", "date": "2019-02-22", "analysis": 0, "threat_level_id": 3, "timestamp": 1551019536}, "5c7c0198-81b0-41d8-9839-4c4d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00b3b3", "local": false, "name": "ecsirt:intrusions=\"backdoor\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Supply Chain Compromise - T1195\"", "relationship_type": ""}], "info": "OSINT - The Supreme Backdoor Factory", "date": "2019-03-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1551631434}, "5c812baa-d614-4f99-88e0-426d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}], "info": "OSINT -  New SLUB Backdoor Uses GitHub, Communicates via Slack", "date": "2019-03-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1551970460}, "5c829fc2-7e94-4722-8c67-2e8468f8e8cf": {"Orgc": {"name": "VK-Intel", "uuid": "5bfa439e-c978-4dcd-b474-73f568f8e8cf"}, "Tag": [{"colour": "#b5654e", "local": false, "name": "TerraLoader", "relationship_type": ""}, {"colour": "#f591da", "local": false, "name": "Digital Signature", "relationship_type": ""}, {"colour": "#7f3e2d", "local": false, "name": "ARTILDA CONSULTING LIMITED", "relationship_type": ""}, {"colour": "#585483", "local": false, "name": "var BV = \"6.0\"", "relationship_type": ""}, {"colour": "#073972", "local": false, "name": "rkey: \"wearenotcobaltthanks\"", "relationship_type": ""}, {"colour": "#3f86b0", "local": false, "name": ".kz Domain", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Terra Loader\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "2019-03-08: TerraLoader Signed -> JS RAT", "date": "2019-03-08", "analysis": 0, "threat_level_id": 2, "timestamp": 1621850064}, "5c8ba546-6ac8-4bfd-b03a-481e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#4e9c00", "local": false, "name": "circl:incident-classification=\"scam\"", "relationship_type": ""}], "info": "Fake invoice (per postal mail)", "date": "2019-03-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1552659324}, "5c912339-5ab4-4226-a5b2-9fc2950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"LockerGoga\"", "relationship_type": ""}], "info": "LockerGoga  - yara rules", "date": "2019-03-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1553015789}, "5c9a14a9-fdb0-4cc9-bd13-4cbf950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Operation ShadowHammer\"", "relationship_type": ""}], "info": "OSINT -  Operation ShadowHammer", "date": "2019-03-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1553684879}, "5c9b46dc-f354-4e45-b44a-4966950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Azorult\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Quasar RAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"NETWIRE - S0198\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"NETWIRE - S0198\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"QuasarRAT - S0262\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Razy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Netwire\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Quasar RAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"AZORult\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT- WinRAR Zero-day (CVE-2018-20250) Abused in Multiple Campaigns", "date": "2019-03-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1554375589}, "5ca603ab-903c-4818-99a4-4b4b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Gandcrab\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"GandCrab\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Jokeroo\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#005795", "local": false, "name": "osint:source-type=\"automatic-analysis\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}], "info": "Tor hidden services for GandCrab and jokeroo \"vendor\"", "date": "2019-04-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1554458342}, "5ca71f6e-3ee8-4013-8a5f-4171950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Hancitor\"", "relationship_type": ""}, {"colour": "#0c9200", "local": false, "name": "misp-galaxy:tool=\"Hancitor\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - Hancitor domains", "date": "2019-04-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1554456909}, "5cac8884-5a80-4a5b-b3f9-ada3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Stuxnet\"", "relationship_type": ""}, {"colour": "#086a00", "local": false, "name": "misp-galaxy:tool=\"Stuxnet\"", "relationship_type": ""}], "info": "OSINT - STUXSHOP The Oldest Stuxnet Component Dials Up", "date": "2019-04-09", "analysis": 2, "threat_level_id": 2, "timestamp": 1554837719}, "5cacb081-1854-4035-acbc-4096950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Mirai\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Mirai\"", "relationship_type": ""}], "info": "OSINT - Mirai Compiled for New Processors Surfaces in the Wild", "date": "2019-04-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1554821614}, "5cae46c1-c198-49cb-9036-4a34950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"COVELLITE\"", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}], "info": "Malware Analysis Report (AR19-100A) MAR-10135536-8 \u00e2\u20ac\u201c North Korean Trojan: HOPLIGHT MAR-10135536.r8.v1", "date": "2019-04-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1631185208}, "5caefb63-cb90-4a86-abc2-4fcc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": ""}], "info": "OSINT - OSINT Reporting Regarding DPRK and TA505 Overlap", "date": "2019-04-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1554972881}, "5cbc6f5e-a058-4a70-ba80-4b8902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2d0048", "local": false, "name": "adversary:infrastructure-status=\"compromised\"", "relationship_type": ""}], "info": "OSINT - 97 domains phishing spread over 10 IP's", "date": "2019-04-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1555853634}, "5cbd7391-72f0-4905-a438-428102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Nueva campa\u00c3\u00b1a del grupo ruso TA505 dirigida a Chile y Argentina. #ServHelper", "date": "2019-04-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1555920412}, "5cbf6a0e-bfa4-458c-9b40-416a02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}], "info": "OSINT - FINTEAM: Trojanized TeamViewer Against Government Targets", "date": "2019-04-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1556049198}, "5cc023e7-9c7c-418e-b908-4d46950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"DNSpionage\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"DNSpionage\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Karkoff\"", "relationship_type": ""}], "info": "OSINT -  DNSpionage brings out the Karkoff", "date": "2019-04-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1556104870}, "5cc209b3-82e0-4d0e-980d-4a6002de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}], "info": "OSINT - Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware", "date": "2019-04-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1556220724}, "5cc3fa33-2fac-4dbd-9e06-60de02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"BabyShark\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - BabyShark Malware Part Two \u00e2\u20ac\u201c Attacks Continue Using KimJongRAT and PCRat", "date": "2019-04-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1556350998}, "5cc410a0-be10-4990-acf6-44cc02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Tsunami\"", "relationship_type": ""}, {"colour": "#5ed600", "local": false, "name": "ddos:type=\"flooding-attack\"", "relationship_type": ""}, {"colour": "#00bdbd", "local": false, "name": "ecsirt:availability=\"ddos\"", "relationship_type": ""}], "info": "OSINT -  Analysis of an IRC based Botnet", "date": "2019-04-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1556355866}, "5cc92e5a-c624-4343-8352-40fd02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Kernel Mode Malicious Loader", "date": "2019-05-01", "analysis": 2, "threat_level_id": 3, "timestamp": 1556694075}, "5ccaeddb-dc84-4cc2-9f73-4a70950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#10ca00", "local": false, "name": "misp-galaxy:threat-actor=\"Hellsing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"NewCore RAT\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Goblin Panda continues to target Vietnam", "date": "2019-05-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1556803290}, "5cd14624-0b24-4386-85f5-4e5e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Carbanak\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Carbanak - G0008\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"Carbanak - S0030\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"FIN7 uses Carbanak\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Carbanak - G0008\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Carbanak - S0030\"", "relationship_type": ""}, {"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"FIN7 - G0046\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"FIN7\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"FIN7 - G0046\"", "relationship_type": ""}, {"colour": "#00b3b3", "local": false, "name": "ecsirt:intrusions=\"backdoor\"", "relationship_type": ""}, {"colour": "#00a9ce", "local": false, "name": "veris:action:malware:variety=\"Backdoor\"", "relationship_type": ""}, {"colour": "#2c0037", "local": false, "name": "ms-caro-malware:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#001534", "local": false, "name": "ms-caro-malware-full:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - CARBANAK Week - Fire Eye", "date": "2019-04-22", "analysis": 2, "threat_level_id": 3, "timestamp": 1557308326}, "5cd2ec29-16fc-4842-b954-282902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0fbe00", "local": false, "name": "misp-galaxy:threat-actor=\"UPS\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT3 - G0022\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak", "date": "2019-05-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1557328832}, "5cd4446a-b318-40d6-8120-473a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unconditional client-side exploitation/Injected Website/Driveby - T1372\"", "relationship_type": ""}], "info": "OSINT - keepass(dot)com spreading malware acting as the official site for KeePass password manager. Download for .dmg and .exe files are available on the site.", "date": "2019-05-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1557415377}, "5cccb246-0da0-4c93-a463-61fe0a016219": {"Orgc": {"name": "ESET", "uuid": "55f6ea5e-51ac-4344-bc8c-4170950d210f"}, "Tag": [{"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data Encrypted - T1022\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Email Collection - T1114\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data Obfuscation - T1001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scheduled Transfer - T1029\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Standard Cryptographic Protocol - T1032\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "ESET Turla LightNeuron Research", "date": "2019-05-03", "analysis": 0, "threat_level_id": 4, "timestamp": 1607525139}, "5b773e07-e694-458b-b99c-27f30a016219": {"Orgc": {"name": "ESET", "uuid": "55f6ea5e-51ac-4344-bc8c-4170950d210f"}, "Tag": [{"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Component Object Model Hijacking\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Component Object Model Hijacking - T1122\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Email Collection - T1114\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#9d6800", "local": false, "name": "cert-ist:threat_targeted_sector=\"Academic and Research\"", "relationship_type": ""}, {"colour": "#986400", "local": false, "name": "cert-ist:threat_targeted_sector=\"Gov\"", "relationship_type": ""}, {"colour": "#e49600", "local": false, "name": "cert-ist:threat_targeted_region=\"Western Europe\"", "relationship_type": ""}, {"colour": "#fea700", "local": false, "name": "cert-ist:enriched", "relationship_type": ""}, {"colour": "#372500", "local": false, "name": "cert-ist:ioc_accuracy=\"medium\"", "relationship_type": ""}, {"colour": "#3c2700", "local": false, "name": "cert-ist:threat_level=\"medium\"", "relationship_type": ""}, {"colour": "#f8a400", "local": false, "name": "cert-ist:threat_type=\"apt\"", "relationship_type": ""}, {"colour": "#FFC000", "local": false, "name": "tlp:amber", "relationship_type": ""}, {"colour": "#ff0000", "local": false, "name": "BR_CTI_Investigar", "relationship_type": ""}, {"colour": "#004577", "local": false, "name": "osint:source-type=\"block-or-filter-list\"", "relationship_type": ""}], "info": "Turla Outlook White Paper", "date": "2018-08-17", "analysis": 0, "threat_level_id": 1, "timestamp": 1772755866}, "5cda6599-990c-4803-8c89-45e4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"FIN7\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"FIN7 - G0046\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"FIN7\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"FIN7 - G0046\"", "relationship_type": ""}, {"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - [Emering] FIN7 JScript Loader Malware", "date": "2019-05-13", "analysis": 0, "threat_level_id": 3, "timestamp": 1563528133}, "5ce1619d-beec-42e3-93f5-4742950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Mirai\"", "relationship_type": ""}], "info": "OSINT -  200+ hosts attempting Linksys RCE exploits", "date": "2019-05-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1558275208}, "5cdd3938-7134-4908-9552-173cc0a8016e": {"Orgc": {"name": "EUROLEA", "uuid": "5cdc2cdd-bca4-4a76-8955-03cdc0a8016e"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#3bb800", "local": false, "name": "enisa:nefarious-activity-abuse=\"spear-phishing-attacks\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Targeted phishing - PDF documents / phishkit", "date": "2019-05-16", "analysis": 1, "threat_level_id": 3, "timestamp": 1772841678}, "5ce3fb8a-9504-42e8-b405-4a56950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}], "info": "HIDDEN COBRA - North Korean Malicious Cyber Activity (MAR-10135536.r21.v2)", "date": "2019-05-14", "analysis": 0, "threat_level_id": 3, "timestamp": 1558450447}, "5ce6aa86-9cd8-4302-9dc9-4a59950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1085\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation - T1047\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Component Object Model Hijacking - T1122\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disabling Security Tools - T1089\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1107\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Network Shared Drive - T1039\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Removable Media - T1025\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Staged - T1074\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted - T1022\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Custom Cryptographic Protocol - T1024\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Obfuscation - T1001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Fallback Channels - T1008\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Multilayer Encryption - T1079\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Cryptographic Protocol - T1032\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Zebrocy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Zebrocy (AutoIT)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Zebrocy - S0251\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ZEBROCY\"", "relationship_type": ""}, {"colour": "#00b3b3", "local": false, "name": "ecsirt:intrusions=\"backdoor\"", "relationship_type": ""}, {"colour": "#00a9ce", "local": false, "name": "veris:action:malware:variety=\"Backdoor\"", "relationship_type": ""}, {"colour": "#2c0037", "local": false, "name": "ms-caro-malware:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#001534", "local": false, "name": "ms-caro-malware-full:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#39001f", "local": false, "name": "workflow:todo=\"expansion\"", "relationship_type": ""}], "info": "OSINT - A journey to Zebrocy land", "date": "2019-05-22", "analysis": 0, "threat_level_id": 3, "timestamp": 1563528054}, "5ce8f7f8-8584-40c3-b33b-4660950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"JasperLoader\"", "relationship_type": ""}], "info": "OSINT -   Sorpresa! JasperLoader targets Italy with a new bag of tricks", "date": "2019-05-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1558772061}, "5cea377f-d36c-48cf-bd54-31ea950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#00815a", "local": false, "name": "honeypot-basic:data-capture=\"attacks\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#009e6f", "local": false, "name": "honeypot-basic:containment=\"block\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "SMTP attackers honeypot logs for 2019-05-26", "date": "2019-05-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1558854881}, "5cea4d65-d448-4e7c-af4a-4fe3950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Script-maze historical malware seen", "date": "2019-05-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1558859858}, "5cf0f134-f504-42dd-b11e-9071950d210f": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Threat Group-3390\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Threat Group-3390 - G0027\"", "relationship_type": ""}, {"colour": "#10c700", "local": false, "name": "misp-galaxy:threat-actor=\"Emissary Panda\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"LuckyMouse\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "Emissary Panda Attacks Middle East Government Sharepoint Servers by Palo Alto Unit42", "date": "2019-05-28", "analysis": 2, "threat_level_id": 1, "timestamp": 1559307564}, "5cf22f74-759c-4744-90eb-4300950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Coinminer\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"CoinMiner\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}], "info": "Linux server infection with coinminers (derived from original post with iptables rules)", "date": "2019-06-01", "analysis": 1, "threat_level_id": 3, "timestamp": 1559381168}, "5cf3787c-625c-4782-9f1a-da8f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"ATM Black Box Attack\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Malware\"", "relationship_type": ""}, {"colour": "#0083a0", "local": false, "name": "veris:asset:variety=\"T - ATM\"", "relationship_type": ""}], "info": "OSINT -  10 years of virtual dynamite: A high-level retrospective of ATM malware", "date": "2019-06-02", "analysis": 2, "threat_level_id": 3, "timestamp": 1559460802}, "5cf51bbd-6180-4dc7-a2dd-4baa950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"FlawedAmmy\"", "relationship_type": ""}], "info": "OSINT - FlawedAmmy RAT", "date": "2019-06-02", "analysis": 0, "threat_level_id": 3, "timestamp": 1566894446}, "5cf900bc-28e0-4bed-93a9-5225950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - Gaining New Visibility into Financial Threats", "date": "2019-06-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1559823376}, "5c8f9bb3-c244-4dba-89cb-4fdc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#1c3900", "local": false, "name": "circl:incident-classification=\"spam\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:android=\"Adwind\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AdWind\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"jRAT - S0283\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Adwind RAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"H-w0rm\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"H-worm\"", "relationship_type": ""}, {"colour": "#0da200", "local": false, "name": "misp-galaxy:tool=\"Adwind\"", "relationship_type": ""}], "info": "OSINT - Spam Warns about Boeing 737 Max Crashes While Pushing Malware", "date": "2019-03-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1559823829}, "5cff57e0-94cc-4166-830c-48cf950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Elderwood - G0066\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Elderwood - G0066\"", "relationship_type": ""}, {"colour": "#11d100", "local": false, "name": "misp-galaxy:threat-actor=\"Beijing Group\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - The Elderwood Project", "date": "2012-09-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1560239807}, "5cffb200-f430-44b2-83a2-c922950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Dharma Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Virus-Encoder\"", "relationship_type": ""}], "info": "Dharma Ransomware sample", "date": "2019-06-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1560263911}, "5d00a18b-fa28-4f72-bd72-4e6a950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - ThreatHunting/India/", "date": "2019-06-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1560343433}, "5d01fda4-353c-4011-854f-459c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#500064", "local": false, "name": "ms-caro-malware:malware-type=\"Trojan\"", "relationship_type": ""}, {"colour": "#00183c", "local": false, "name": "ms-caro-malware-full:malware-type=\"Trojan\"", "relationship_type": ""}, {"colour": "#004f4f", "local": false, "name": "ecsirt:malicious-code=\"trojan\"", "relationship_type": ""}, {"colour": "#5a0041", "local": false, "name": "CERT-XLM:malicious-code=\"trojan-malware\"", "relationship_type": ""}, {"colour": "#284700", "local": false, "name": "malware_classification:malware-category=\"Trojan\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Trojan downloader found on Google Play by @Maler360", "date": "2019-06-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1566554377}, "5d0c8dcc-eae0-4020-b1d0-5526950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Hide and Seek\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Hide and Seek\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#22681c", "local": false, "name": "\tmalware_classification:malware-category=\"Botnet\"", "relationship_type": ""}], "info": "OSINT - Hide \u00e2\u20ac\u02dcN Seek Botnet Updates Arsenal with Exploits Against Nexus Repository Manager & ThinkPHP", "date": "2019-06-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1561132394}, "5d108ff9-9c70-4fbe-932d-acd8950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}], "info": "Information stealer malware via fake malicious document as \"University of Luxembourg\"", "date": "2019-06-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1561369720}, "5d10a039-8c58-42e1-b663-4f85950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Related malware samples", "date": "2019-06-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1561370873}, "5d13bc95-ecbc-4af9-b684-423602de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Soft Cell case - guessed indicators (via Twitter discussion)", "date": "2019-06-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1561575047}, "5d13be9e-bb04-4946-899d-409e02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Soft Cell case - Related indicators from correlations", "date": "2019-06-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1594387608}, "5d13ce08-14f8-414c-a7d2-4cee02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Ngioweb\"", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#001a42", "local": false, "name": "ms-caro-malware-full:malware-platform=\"Linux\"", "relationship_type": ""}], "info": "An Analysis of Linux.Ngioweb Botnet", "date": "2019-06-26", "analysis": 0, "threat_level_id": 3, "timestamp": 1561579453}, "5d159a21-59d4-4881-a9e6-41ca02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001b43", "local": false, "name": "ms-caro-malware-full:malware-platform=\"MacOS_X\"", "relationship_type": ""}], "info": "OSINT - OSX/Linker: New Mac malware attempts zero-day Gatekeeper bypass", "date": "2019-06-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1561711324}, "5d1dc7d2-8c8c-40d8-9eb9-ba1d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT32\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Custom Command and Control Protocol - T1094\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#007ed9", "local": false, "name": "osint:certainty=\"93\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#460026", "local": true, "name": "workflow:todo=\"review-for-privacy\"", "relationship_type": ""}], "info": "OSINT - Threat Spotlight: Ratsnif - New Network Vermin from OceanLotus", "date": "2019-07-04", "analysis": 1, "threat_level_id": 3, "timestamp": 1562354801}, "5d2cae34-7564-4049-b9c4-4ae902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0082e1", "local": false, "name": "osint:certainty=\"75\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Agent Tesla\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Agent Tesla - S0331\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Agent Tesla\"", "relationship_type": ""}, {"colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": ""}], "info": "OSINT -  SWEED: Exposing years of Agent Tesla campaigns", "date": "2019-07-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1563210476}, "5d2deea3-eea0-41ea-91bf-4a8b950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Turla\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Turla renews its arsenal with Topinambour", "date": "2019-07-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1563341373}, "5d3145a8-b2c4-49d7-9b5c-4f4368f8e8cf": {"Orgc": {"name": "VK_INTEL_EVIL", "uuid": "5d2fbc3a-e520-4bf9-89b7-1b0a68f8e8cf"}, "Tag": [{"colour": "#7bd107", "local": false, "name": "PoSeidon", "relationship_type": ""}, {"colour": "#0235a3", "local": false, "name": "FindPOS", "relationship_type": ""}, {"colour": "#62459e", "local": false, "name": "FindStr", "relationship_type": ""}, {"colour": "#37d4e6", "local": false, "name": "Point-of-Sale", "relationship_type": ""}, {"colour": "#787ad7", "local": false, "name": "RAWINPUT", "relationship_type": ""}, {"colour": "#2be799", "local": false, "name": "Keylogger", "relationship_type": ""}, {"colour": "#0dd733", "local": false, "name": "Memory Scraper", "relationship_type": ""}, {"colour": "#3b947c", "local": false, "name": "Signed", "relationship_type": ""}, {"colour": "#e8ece2", "local": false, "name": "\"Lingarder Limited\"", "relationship_type": ""}, {"colour": "#2ac804", "local": false, "name": "Thawte", "relationship_type": ""}, {"colour": "#ef7f5c", "local": false, "name": "Version 15.10", "relationship_type": ""}, {"colour": "#0088cc", "local": true, "name": "misp-galaxy:malpedia=\"FindPOS\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "2019-07-18: Newer \"PoSeidon\" aka \"FindPOS\" aka \"FindStr\" 15.10 Point-of-Sale Malware", "date": "2019-07-19", "analysis": 2, "threat_level_id": 2, "timestamp": 1621850183}, "5d47cdea-435c-45aa-8db0-4693950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00b3b3", "local": false, "name": "ecsirt:intrusions=\"backdoor\"", "relationship_type": ""}, {"colour": "#00a9ce", "local": false, "name": "veris:action:malware:variety=\"Backdoor\"", "relationship_type": ""}, {"colour": "#2c0037", "local": false, "name": "ms-caro-malware:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#001534", "local": false, "name": "ms-caro-malware-full:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing via Service - T1194\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Video Capture - T1125\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Forced Authentication - T1187\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Deployment Software - T1017\"", "relationship_type": ""}, {"colour": "#00abd0", "local": false, "name": "veris:action:malware:variety=\"Spyware/Keylogger\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Amavaldo Banking Trojan\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Amavaldo\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}], "info": "OSINT - From Carnaval to Cinco de Mayo \u00e2\u20ac\u201c The journey of Amavaldo", "date": "2019-08-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1565505795}, "5d498330-f574-4889-bcc9-c53c950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Machete\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"El Machete\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1158\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1045\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1145\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials in Files - T1081\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Peripheral Device Discovery - T1120\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Bookmark Discovery - T1217\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Window Discovery - T1010\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Removable Media - T1025\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Staged - T1074\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Fallback Channels - T1008\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote File Copy - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Compressed - T1002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted - T1022\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Physical Medium - T1052\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Transfer - T1029\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3bb800", "local": false, "name": "enisa:nefarious-activity-abuse=\"spear-phishing-attacks\"", "relationship_type": ""}], "info": "OSINT - Sharpening the Machete", "date": "2019-08-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1566552908}, "5d52daab-6db4-45f1-9fdf-45fc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Cloud Atlas\"", "relationship_type": ""}], "info": "OSINT -  Recent Cloud Atlas activity", "date": "2019-08-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1565711390}, "5d5bfb96-ff34-4470-9107-cfdc950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Supply Chain Compromise - T1195\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted - T1022\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Shimming - T1138\"", "relationship_type": ""}], "info": "OSINT - Ruby/Gem Warning! is rest-client 1.6.13 hijacked? #713", "date": "2019-08-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1566309784}, "5d5fb3ac-ae54-42d3-9fe7-4d65950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Geodo\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#410069", "local": false, "name": "adversary:infrastructure-action=\"take-down\"", "relationship_type": ""}], "info": "OSINT - Emotet is back", "date": "2019-08-23", "analysis": 1, "threat_level_id": 3, "timestamp": 1566554356}, "5d6532ef-05a0-4a1b-a2ee-4c86950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Mirai\"", "relationship_type": ""}], "info": "OSINT - Mirai - Loligang bot", "date": "2019-08-27", "analysis": 1, "threat_level_id": 3, "timestamp": 1566913593}, "5d64d069-0fa0-45a4-bd65-b6f0950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution through API - T1106\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Gamaredon Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Gamaredon Group - G0047\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Gamaredon Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Gamaredon Group - G0047\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Gamaredon group", "date": "2019-08-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1566995352}, "5d6e7aa3-aca4-46cc-b96a-46ac950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution through API - T1106\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution through Module Load - T1129\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1085\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1035\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation - T1047\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"New Service - T1050\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Startup Items - T1165\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation Event Subscription - T1084\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1088\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1116\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disabling Security Tools - T1089\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1073\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Defense Evasion - T1211\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1143\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1045\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Prompt - T1141\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Scanning - T1046\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Permission Groups Discovery - T1069\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1063\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Service Discovery - T1007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1076\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Custom Command and Control Protocol - T1094\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Custom Cryptographic Protocol - T1024\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Cryptographic Protocol - T1032\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Compressed - T1002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"SectorJ04\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": ""}], "info": "SectorJ04 Group\u00e2\u20ac\u2122s Increased Activity in 2019", "date": "2019-08-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1568039252}, "5d78a50e-ba3c-40b3-a5c1-4fb1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Stealth Falcon\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Stealth Falcon - G0038\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Stealth Falcon\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Stealth Falcon - G0038\"", "relationship_type": ""}, {"colour": "#13f100", "local": false, "name": "misp-galaxy:threat-actor=\"Stealth Falcon\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"BITS Jobs - T1197\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"BITS Jobs - T1197\"", "relationship_type": ""}], "info": "OSINT - ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group", "date": "2019-09-09", "analysis": 0, "threat_level_id": 3, "timestamp": 1568193300}, "5d7dba44-67d4-4fad-b919-4c2d950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#380046", "local": false, "name": "ms-caro-malware:malware-type=\"HackTool\"", "relationship_type": ""}, {"colour": "#ffc100", "local": false, "name": "poshc2 beacon", "relationship_type": ""}, {"colour": "#c1e21c", "local": false, "name": " C2", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:course-of-action=\"PowerShell Mitigation\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:course-of-action=\"Network Sniffing Mitigation\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:course-of-action=\"Credential Dumping Mitigation\"", "relationship_type": ""}], "info": "On-memory post exploit payloads from encoded binary", "date": "2019-09-15", "analysis": 2, "threat_level_id": 2, "timestamp": 1568643188}, "5d832991-f5e4-4623-945f-4bf6950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"GootKit\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"GootKit\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Malware\"", "relationship_type": ""}], "info": "OSINT - New Gootkit Banking Trojan campaign against Italian Companies and Users.", "date": "2019-09-19", "analysis": 0, "threat_level_id": 3, "timestamp": 1568897957}, "5d886859-bb5c-45b5-b922-4925950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Geodo\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Emotet\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Geodo\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Emotet - S0367\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}], "info": "OSINT - Emotet Updated C2 Info 9/20", "date": "2019-09-20", "analysis": 0, "threat_level_id": 3, "timestamp": 1569224580}, "5bec8d43-b990-4129-a9f4-45d08064ab0b": {"Orgc": {"name": "citizenlab", "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "MISSING LINK: Tibetan Groups Targeted with Mobile Exploits", "date": "2019-09-24", "analysis": 1, "threat_level_id": 1, "timestamp": 1621850373}, "5d9049fa-1a6c-4668-b7aa-4bf7950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#32003e", "local": false, "name": "ms-caro-malware:malware-type=\"DDoS\"", "relationship_type": ""}, {"colour": "#670080", "local": false, "name": "ms-caro-malware:malware-platform=\"Linux\"", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}], "info": "New IoT multiplatform Linux malware: Linux/AirDropBot", "date": "2019-09-29", "analysis": 2, "threat_level_id": 3, "timestamp": 1569866386}, "5d9aedea-94c8-4c33-a80d-2bc1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Threat Group-3390\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Threat Group-3390 - G0027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Threat Group-3390\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Threat Group-3390 - G0027\"", "relationship_type": ""}, {"colour": "#10c700", "local": false, "name": "misp-galaxy:threat-actor=\"Emissary Panda\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"LuckyMouse\"", "relationship_type": ""}, {"colour": "#14f800", "local": false, "name": "misp-galaxy:threat-actor=\"Threat Group-3390\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - #EmissaryPanda #APT older sample (2018)", "date": "2019-10-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1575970217}, "5d9b516c-e5f0-4e7c-a958-5d8c0a019371": {"Orgc": {"name": "ESET", "uuid": "55f6ea5e-51ac-4344-bc8c-4170950d210f"}, "Tag": [{"colour": "#12e100", "local": false, "name": "misp-galaxy:threat-actor=\"APT 29\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution through API - T1106\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution through Module Load - T1129\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1085\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1035\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1107\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1045\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation Event Subscription - T1084\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Connection Proxy - T1090\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Obfuscation - T1001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Network Shared Drive - T1039\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Removable Media - T1025\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Fallback Channels - T1008\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Admin Shares - T1077\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Operation Ghost - White Paper", "date": "2019-10-07", "analysis": 2, "threat_level_id": 1, "timestamp": 1622553001}, "5dbe8440-9cdc-4af1-acb7-34b902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#420014", "local": false, "name": "collaborative-intelligence:request=\"sample\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Operation WizardOpium\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": ""}], "info": "OSINT - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium", "date": "2019-11-03", "analysis": 2, "threat_level_id": 3, "timestamp": 1572768064}, "5dc12abf-dbec-4acb-83a5-419d950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Turla RAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Turla\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Turla - G0010\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Turla\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Turla - G0010\"", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:tool=\"Turla\"", "relationship_type": ""}], "info": "OSINT - Turla/Venomous Bear Implants", "date": "2019-11-04", "analysis": 0, "threat_level_id": 3, "timestamp": 1575969968}, "5dbae98e-7974-4480-86db-44be950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution through API - T1106\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1170\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials in Files - T1081\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Uncommonly Used Port - T1065\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Dans l\u00e2\u20ac\u2122\u00c5\u201cil de notre CyberSOC : la campagne malspam Aggah diversifie ses outils", "date": "2019-10-23", "analysis": 0, "threat_level_id": 3, "timestamp": 1575969880}, "5dc16ccc-c038-4b5b-91e6-4879950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "IECrypt sample analysed with VMRay Analyzer Report for Sample #245141 (IECrypt)", "date": "2019-11-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1572959929}, "5dc3249f-6ebc-44fd-b78d-448d02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Dridex\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"FriedEx\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Bitpaymer\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"INDRIK SPIDER\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - BitPaymer Source Code Fork: Meet DoppelPaymer Ransomware and Dridex 2.0", "date": "2019-07-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1573070402}, "5dd5a9e7-72a8-4b7e-b0c3-49e702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#000a64", "local": false, "name": "europol-incident:availability=\"dos-ddos\"", "relationship_type": ""}, {"colour": "#009c9c", "local": false, "name": "rsit:availability=\"ddos\"", "relationship_type": ""}], "info": "OSINT - Trojan.ElectrumDoSMiner -  a Trojan responsible for the denial of service attacks against Electrum bitcoin wallets.", "date": "2019-11-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1574284024}, "5dd6477f-5d64-4026-bb9f-4cff950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Supply Chain Compromise - T1195\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"", "relationship_type": ""}, {"colour": "#c5003b", "local": false, "name": "collaborative-intelligence:request=\"historical-information\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}], "info": "OSINT -  Wrong hashes (from getmonero.org) #6151 - malicious binaries", "date": "2019-11-21", "analysis": 0, "threat_level_id": 1, "timestamp": 1574325174}, "5de7883b-22bc-4264-995c-4d1f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Supply Chain Compromise - T1195\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Other Network Medium - T1011\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#00497f", "local": false, "name": "osint:source-type=\"source-code-repository\"", "relationship_type": ""}, {"colour": "#007ad2", "local": false, "name": "osint:certainty=\"100\"", "relationship_type": ""}], "info": "Malicious PyPI packages", "date": "2019-12-04", "analysis": 0, "threat_level_id": 1, "timestamp": 1575466984}, "5defbf60-c77c-4611-b627-03e368f8e8cf": {"Orgc": {"name": "VK_INTEL_EVIL", "uuid": "5d2fbc3a-e520-4bf9-89b7-1b0a68f8e8cf"}, "Tag": [{"colour": "#cdce6a", "local": false, "name": "Banker: TrickBot", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "Anchor", "relationship_type": ""}, {"colour": "#0dd733", "local": false, "name": "Memory Scraper", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"TrickBot\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "2019-12-10: TrickBot Project \u00e2\u20ac\u0153Anchor:\u00e2\u20ac\u009d Window Into Sophisticated Operation", "date": "2019-12-10", "analysis": 0, "threat_level_id": 2, "timestamp": 1621850506}, "5df0b000-ce20-4cee-89d6-1e9f950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:banker=\"Trickbot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Trick Bot\"", "relationship_type": ""}], "info": "OSINT - trickbot cashcore hashes", "date": "2019-12-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1576055979}, "5dee2bc3-47ac-4784-a52a-4da2950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution through API - T1106\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1085\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1035\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Search Order Hijacking - T1038\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Kernel Modules and Extensions - T1215\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Port Knocking - T1205\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Redundant Access - T1108\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Binary Padding - T1009\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1116\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disabling Security Tools - T1089\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution Guardrails - T1480\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1107\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rootkit - T1014\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1045\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1099\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Connection Proxy - T1090\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Custom Command and Control Protocol - T1094\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Custom Cryptographic Protocol - T1024\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Fallback Channels - T1008\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#10c300", "local": false, "name": "misp-galaxy:threat-actor=\"Axiom\"", "relationship_type": ""}], "info": "OSINT - BfV Cyber-Brief Nr. 01/2019 - Hinweis auf aktuelle Angriffskampagne -", "date": "2019-12-09", "analysis": 0, "threat_level_id": 1, "timestamp": 1576068623}, "5df37253-ecc0-40ff-9ab9-4c44950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"HTran\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"HTRAN\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"HTRAN - S0040\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"HTRAN\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"HTRAN - S0040\"", "relationship_type": ""}, {"colour": "#0b8900", "local": false, "name": "misp-galaxy:tool=\"Htran\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"MimiKatz\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Mimikatz\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Mimikatz - S0002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Mimikatz\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Mimikatz - S0002\"", "relationship_type": ""}, {"colour": "#064800", "local": false, "name": "misp-galaxy:tool=\"Mimikatz\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"PsExec\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"PsExec - S0029\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"PsExec\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"PsExec - S0029\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"PsExec\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Windows Credential Editor\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Windows Credential Editor - S0005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Windows Credential Editor\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Windows Credential Editor - S0005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Windows Credential Editor\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"China Chopper\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"China Chopper - S0020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"China Chopper\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"China Chopper - S0020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"China Chopper\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Poison Ivy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"PoisonIvy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"PoisonIvy - S0012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"PoisonIvy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"PoisonIvy - S0012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"PoisonIvy\"", "relationship_type": ""}, {"colour": "#043600", "local": false, "name": "misp-galaxy:tool=\"Poison Ivy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"poisonivy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"GALLIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Netcat\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"NBTScan\"", "relationship_type": ""}], "info": "OSINT -  GALLIUM: Targeting global telecom", "date": "2019-12-12", "analysis": 0, "threat_level_id": 1, "timestamp": 1576484865}, "5deea6f2-568c-4fe3-a457-0d230a0a019b": {"Orgc": {"name": "Hestat", "uuid": "5cb1fe4f-5ebc-4dc2-b79f-4374b49abff9"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Empire - S0363\"", "relationship_type": ""}, {"colour": "#009922", "local": false, "name": "Threat Source:OSINT", "relationship_type": ""}, {"colour": "#ff8a00", "local": false, "name": "Source:Urlscan.io", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Tracking Powershell Empire C2 via Urlscan", "date": "2019-12-09", "analysis": 0, "threat_level_id": 2, "timestamp": 1588338859}, "5d9b5933-964c-433c-b84f-4c680a2fe004": {"Orgc": {"name": "MiSOC", "uuid": "5d49b744-1ef4-4480-b486-40f06b08ac45"}, "Tag": [{"colour": "#4de3bf", "local": false, "name": "Emotet", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation - T1047\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Cryptographic Protocol - T1032\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Empire - S0363\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Emotet\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Cobalt Strike - S0154\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"New Service - T1050\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Emotet in Depth TTP 10-07-19", "date": "2019-10-07", "analysis": 1, "threat_level_id": 2, "timestamp": 1621850615}, "5dfce305-c520-4a71-9094-47c702de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - TA505 evolves ServHelper, uses Predator The Thief and Team Viewer Hijacking", "date": "2019-12-20", "analysis": 2, "threat_level_id": 1, "timestamp": 1576855575}, "5e00d123-d688-417f-aafe-40fb02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2c0037", "local": false, "name": "ms-caro-malware:malware-type=\"Backdoor\"", "relationship_type": ""}], "info": "OSINT - Reversing a real-world 249 bytes backdoor!", "date": "2019-12-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1577112228}, "5e04e696-4e74-4be0-a8e1-4cee02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Predator The Thief\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1503\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Credential Access - T1212\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials in Files - T1081\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials in Registry - T1214\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credential Dumping - T1003\"", "relationship_type": ""}], "info": "OSINT - Let\u00e2\u20ac\u2122s play (again) with Predator the thief \u00e2\u20ac\u201c Fumik0_'s box", "date": "2019-12-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1577379958}, "5e05dbcc-074c-40d1-884b-2a2402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Threat Group-3390\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Threat Group-3390 - G0027\"", "relationship_type": ""}, {"colour": "#10c700", "local": false, "name": "misp-galaxy:threat-actor=\"Emissary Panda\"", "relationship_type": ""}], "info": "OSINT - The #BronzeUnion/#LuckyMouse/#APT27 infection checker", "date": "2019-12-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1577444825}, "5e0a3406-952c-49c8-b084-414002de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"FIN7\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"FIN7 (G0046) uses Carbanak (S0030)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-relationship=\"FIN7 uses Carbanak\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"FIN7\"", "relationship_type": ""}, {"colour": "#12e400", "local": false, "name": "misp-galaxy:threat-actor=\"Anunak\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Search Order Hijacking\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"DLL Search Order Hijacking\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "OSINT - Introducing BIOLOAD: FIN7 BOOSTWRITE\u00e2\u20ac\u2122s Lost Twin", "date": "2019-12-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1577727740}, "5e149458-bdf4-4f6a-8e1c-8f1102de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#4e9c00", "local": false, "name": "circl:incident-classification=\"scam\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Vishing\"", "relationship_type": ""}], "info": "OSINT - Spam via mobile phone", "date": "2020-01-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1578407416}, "5de6335d-e128-4bc0-87e2-4db4950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#22681c", "local": false, "name": "\tmalware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT33 - G0064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT33 - G0064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT33\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MAGNALLIUM\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  More than a Dozen Obfuscated APT33 Botnets Used for Extreme Narrow Targeting", "date": "2019-11-13", "analysis": 2, "threat_level_id": 1, "timestamp": 1579534868}, "5e27f3d8-e238-4290-8b2c-422e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Muhstik\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Tsunami (ELF)\"", "relationship_type": ""}], "info": "Muhstik Botnet Attacks Tomato Routers", "date": "2020-01-22", "analysis": 0, "threat_level_id": 2, "timestamp": 1579678870}, "5e2a9dc9-adb4-49bc-9be1-4304950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Nodera Ransomware\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "dnc:malware-type=\"Ransomware\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "Ransomware", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"Ransom\"", "relationship_type": ""}], "info": "OSINT - First Node.js-based Ransomware : Nodera", "date": "2020-01-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1579854868}, "5e2a97e7-4bd4-41c4-8aaf-4262950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Pupy - S0192\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Pupy - S0192\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"PupyRAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Magic Hound\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Magic Hound - G0059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Magic Hound - G0059\"", "relationship_type": ""}, {"colour": "#12dc00", "local": false, "name": "misp-galaxy:threat-actor=\"Cleaver\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"OilRig\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT35\"", "relationship_type": ""}, {"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#4bec00", "local": false, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"", "relationship_type": ""}, {"colour": "#008ba9", "local": false, "name": "veris:asset:variety=\"S - Remote access\"", "relationship_type": ""}, {"colour": "#00bde6", "local": false, "name": "veris:action:misuse:vector=\"Remote access\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#5f0044", "local": false, "name": "CERT-XLM:malicious-code=\"spyware-rat\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Iranian PupyRAT Bites Middle Eastern Organizations", "date": "2020-01-23", "analysis": 0, "threat_level_id": 1, "timestamp": 1582700226}, "5e33608b-9604-494a-b9b7-4fa6950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3d7a00", "local": false, "name": " Malicious Batch Script", "relationship_type": ""}, {"colour": "#3d7a00", "local": false, "name": " VBS Downloader", "relationship_type": ""}], "info": "VBS Downloader and Defender Control", "date": "2020-01-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1580455113}, "5e2c4c13-1f64-4e4e-8165-4801950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#cdce6a", "local": false, "name": "Banker: TrickBot", "relationship_type": ""}, {"colour": "#ad00ff", "local": false, "name": "malware:emotet", "relationship_type": ""}], "info": "Emotet/Trickbot", "date": "2020-01-25", "analysis": 1, "threat_level_id": 3, "timestamp": 1580456151}, "5e263cf3-b1f8-4393-ad21-42a3950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#a0a300", "local": false, "name": "dnc:malware-type=\"CoinMiner\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "XMRig and OPSEC Fail", "date": "2020-01-20", "analysis": 2, "threat_level_id": 3, "timestamp": 1580456204}, "5e211b87-8f34-43f5-b02b-42e4950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffd890", "local": false, "name": " Ransomware", "relationship_type": ""}], "info": "Ako Ransomware", "date": "2020-01-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1580456326}, "5e30d3b9-b330-44ac-8104-97af950d210f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#991515", "local": false, "name": "trickbot", "relationship_type": ""}, {"colour": "#cd05ff", "local": false, "name": "emotet:epoch=\"1\"", "relationship_type": ""}, {"colour": "#0ab4a7", "local": false, "name": "Cobalt Strike", "relationship_type": ""}, {"colour": "#6772d6", "local": false, "name": "PowerView", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Emotet - Trickbot - CobaltStrike - gtag mor85", "date": "2020-01-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1580472207}, "5e38d6d4-7d88-40ab-8313-4db80a0a020f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#10e874", "local": false, "name": "Powershell Empire", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ff8a00", "local": false, "name": "Source:Urlscan.io", "relationship_type": ""}, {"colour": "#009922", "local": false, "name": "Threat Source:OSINT", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}], "info": "Updating: Tracking Powershell Empire C2 via Urlscan", "date": "2020-02-04", "analysis": 0, "threat_level_id": 2, "timestamp": 1580785351}, "5e3be06f-d0a8-4ed9-abe9-46be950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Warzone RAT", "date": "2020-02-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1580982704}, "5e471206-3fb8-43d3-adfd-4806950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Dever Ransomware", "date": "2020-02-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1581894349}, "5e47247f-bca8-473d-871d-447a950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#a0a300", "local": false, "name": "dnc:malware-type=\"CoinMiner\"", "relationship_type": ""}], "info": "XMRig & Masscan", "date": "2020-02-14", "analysis": 1, "threat_level_id": 3, "timestamp": 1581721614}, "5e4886b7-3f14-4ab0-867f-4ea30a0a020f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"BITS Jobs - T1197\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Cryptographic Protocol - T1032\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#bf0dcc", "local": false, "name": "maldoc", "relationship_type": ""}], "info": "IRS Doc Malware", "date": "2020-02-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1732078838}, "5e4b486e-9968-4af1-87dc-4ff4950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#cdce6a", "local": false, "name": "Banker: TrickBot", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}], "info": "Trickbot and AdFind Recon", "date": "2020-02-18", "analysis": 2, "threat_level_id": 3, "timestamp": 1582857280}, "5e54ef58-004c-4acd-b0d6-967a950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ff0000", "local": false, "name": "Mirai", "relationship_type": ""}], "info": "Linux/Mirai-Fbot - New variant with strong infection spreading rate", "date": "2020-02-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1587123147}, "5e4f0d23-1c64-49fb-8099-4f000a0a020f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#bf0dcc", "local": false, "name": "maldoc", "relationship_type": ""}, {"colour": "#a5de2c", "local": false, "name": "ostap", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Ostap Maldoc Samples", "date": "2020-02-20", "analysis": 0, "threat_level_id": 3, "timestamp": 1621850668}, "5e5709a4-8850-453e-9f11-275a0a0a020f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#bd472d", "local": false, "name": "keylogger/infostealer", "relationship_type": ""}, {"colour": "#ff9f0f", "local": false, "name": "racoon", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1086\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote File Copy - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Compressed - T1002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Racoon Stealer", "date": "2020-02-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1696420878}, "5e55be1a-3a30-48ae-9934-4199950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Permission Groups Discovery - T1069\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": ""}], "info": "Interesting Recon Script", "date": "2020-02-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1582912038}, "5e5da86d-bfec-4b9a-ae77-57540a0a020f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": ""}, {"colour": "#700cf0", "local": false, "name": "MalSpam", "relationship_type": ""}, {"colour": "#595757", "local": false, "name": "Remcos RAT", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Blocking - T1054\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1099\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indirect Command Execution - T1202\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Uncommonly Used Port - T1065\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Remcos RAT 02-28-20", "date": "2020-03-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1696421019}, "5e66200c-ad74-4768-b331-425a950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#5f0006", "local": false, "name": "maec-malware-capabilities:maec-malware-capability=\"machine-access-control\"", "relationship_type": ""}, {"colour": "#f30083", "local": false, "name": "workflow:state=\"ongoing\"", "relationship_type": ""}, {"colour": "#3F63AD", "local": false, "name": "attack-pattern:name=\"password brute forcing\"", "relationship_type": ""}, {"colour": "#001a42", "local": false, "name": "ms-caro-malware-full:malware-platform=\"Linux\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}], "info": "Hajime Linux IoT botnet's P2P nodes (activity since Jan 2020)", "date": "2020-03-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1587369610}, "5e66dd0a-d858-4f9e-b0b2-a7c6950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#ffd890", "local": false, "name": " Ransomware", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command-Line Interface - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}], "info": "Harma and Odveta Ransomware", "date": "2020-03-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1583972578}, "5e6aa53c-bcf8-4279-9c48-40d0950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#32003e", "local": false, "name": "ms-caro-malware:malware-type=\"DDoS\"", "relationship_type": ""}, {"colour": "#5ed600", "local": false, "name": "ddos:type=\"flooding-attack\"", "relationship_type": ""}, {"colour": "#001a42", "local": false, "name": "ms-caro-malware-full:malware-platform=\"Linux\"", "relationship_type": ""}], "info": "Rhombus - Linux DDoS botnet aims VPS & IoT, w/persistence & dropper", "date": "2020-03-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1584048290}, "5e6f3fa2-ed28-484c-97ad-4b9e02de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Revenge RAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}], "info": "OSINT - revengeRAT targeting France", "date": "2020-03-16", "analysis": 1, "threat_level_id": 3, "timestamp": 1585059006}, "5e6f46d6-d104-4a35-83e7-965402de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA428\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": ""}], "info": "OSINT - new sample of operation lagtime TA428", "date": "2020-03-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1584352112}, "5e6793ed-2868-4474-a485-42210a0a020f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#3b9989", "local": false, "name": " Cobalt Strike Beacon", "relationship_type": ""}, {"colour": "#991515", "local": false, "name": "trickbot", "relationship_type": ""}, {"colour": "#0ab4a7", "local": false, "name": "Cobalt Strike", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"TrickBot\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Trickbot Gtag QW1", "date": "2020-03-10", "analysis": 0, "threat_level_id": 3, "timestamp": 1621850731}, "5e70a28a-d97c-47f6-a229-40990a0a020f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#0ab4a7", "local": false, "name": "Cobalt Strike", "relationship_type": ""}, {"colour": "#991515", "local": false, "name": "trickbot", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"TrickBot\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Trickbot Gtag lib693/tt0002", "date": "2020-03-17", "analysis": 0, "threat_level_id": 3, "timestamp": 1621850733}, "5e761095-13f8-422c-837a-4aa60a0a020f": {"Orgc": {"name": "laskowski-tech.com", "uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"}, "Tag": [{"colour": "#6ed8f0", "local": false, "name": "Lokibot", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#4d3300", "local": false, "name": "cert-ist:threat_targeted_system=\"Windows\"", "relationship_type": ""}, {"colour": "#815500", "local": false, "name": "cert-ist:malware_type=\"Stealer\"", "relationship_type": ""}, {"colour": "#764e00", "local": false, "name": "cert-ist:malware_type=\"Keylogger\"", "relationship_type": ""}, {"colour": "#fea700", "local": false, "name": "cert-ist:enriched", "relationship_type": ""}, {"colour": "#372500", "local": false, "name": "cert-ist:ioc_accuracy=\"medium\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:android=\"LokiBot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"LokiBot\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Loki Password Stealer (PWS)\"", "relationship_type": ""}, {"colour": "#3a2600", "local": false, "name": "cert-ist:threat_level=\"low\"", "relationship_type": ""}, {"colour": "#f6a300", "local": false, "name": "cert-ist:threat_type=\"malware_outbreak\"", "relationship_type": ""}], "info": "Lokibot Equation Editor Sample", "date": "2020-03-21", "analysis": 0, "threat_level_id": 3, "timestamp": 1621850735}, "5e7a18bc-abe8-4fc7-ab5f-4ae1950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Pivot from IP address (105.235.129.138) where the C2 was running", "date": "2020-03-24", "analysis": 1, "threat_level_id": 3, "timestamp": 1585060842}, "5e78dc2c-afc8-411f-94a5-40bb950d210f": {"Orgc": {"name": "wilbursecurity.com", "uuid": "5e16d2bc-5c68-4ef1-bc80-47f5950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disabling Security Tools - T1089\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Group Policy Modification - T1484\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1158\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1085\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credential Dumping - T1003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1063\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Scanning - T1046\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1076\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote File Copy - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Admin Shares - T1077\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#0ab4a7", "local": false, "name": "Cobalt Strike", "relationship_type": ""}, {"colour": "#6772d6", "local": false, "name": "PowerView", "relationship_type": ""}, {"colour": "#c311f0", "local": false, "name": "Ryuk", "relationship_type": ""}, {"colour": "#33FF00", "local": false, "name": "tlp:green", "relationship_type": ""}, {"colour": "#991515", "local": false, "name": "trickbot", "relationship_type": ""}], "info": "Trickbot to Ryuk in Two Hours", "date": "2020-03-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1585237597}, "5ea0b0dc-45d0-4d5e-bed5-4271950d210f": {"Orgc": {"name": "The DFIR Report", "uuid": "5e9e5d86-5b94-4ff6-b07e-4e3e950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Gozi\"", "relationship_type": ""}, {"colour": "#0ab4a7", "local": false, "name": "Cobalt Strike", "relationship_type": ""}, {"colour": "#bd8c8c", "local": false, "name": "Ursnif", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compile After Delivery - T1500\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1170\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Regsvr32 - T1117\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Application Layer Protocol - T1071\"", "relationship_type": ""}], "info": "Ursnif Campaign f1.pipen.at", "date": "2020-04-22", "analysis": 0, "threat_level_id": 3, "timestamp": 1592743551}, "5ea98601-c03c-4025-a31b-4171950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#ff0000", "local": false, "name": "Mirai", "relationship_type": ""}], "info": "Linux/Mirai-Fbot - New actor on propagation", "date": "2020-04-29", "analysis": 1, "threat_level_id": 3, "timestamp": 1590614064}, "5e9f7d98-9fc0-4e7b-9d54-41a4950d210f": {"Orgc": {"name": "The DFIR Report", "uuid": "5e9e5d86-5b94-4ff6-b07e-4e3e950d210f"}, "Tag": [{"colour": "#991515", "local": false, "name": "trickbot", "relationship_type": ""}, {"colour": "#db00c5", "local": false, "name": "PyXie", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Trickbot to Pyxie", "date": "2020-04-21", "analysis": 0, "threat_level_id": 3, "timestamp": 1588246044}, "5ebd9f11-4628-4dc2-abaf-4d54950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#ff0000", "local": false, "name": "Mirai", "relationship_type": ""}], "info": "Linux/Mirai-Hilix (w/New TABLE encoder) aims Realtek & Huawei routers", "date": "2020-05-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1589487271}, "5ec2382b-1f78-40cf-b07b-4d5d950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#2c0037", "local": false, "name": "ms-caro-malware:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#530068", "local": false, "name": "ms-caro-malware:malware-type=\"TrojanDownloader\"", "relationship_type": ""}], "info": "KuGou trojan backdoor campaign aim RDP on HFS panels", "date": "2020-05-18", "analysis": 1, "threat_level_id": 2, "timestamp": 1589787453}, "5ec960a6-b798-445c-8ae2-478a950d210f": {"Orgc": {"name": "MalwareMustDie", "uuid": "569e04b2-efd0-45bd-b83a-4f7b950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#457b00", "local": false, "name": "malware_classification:malware-category=\"Botnet\"", "relationship_type": ""}, {"colour": "#5ed600", "local": false, "name": "ddos:type=\"flooding-attack\"", "relationship_type": ""}], "info": "Linux/KAITEN AK47(a Mod-Telnet-Scanner) & Echo-loader hexstrings spread", "date": "2020-05-23", "analysis": 1, "threat_level_id": 3, "timestamp": 1590257775}, "5eddeee6-22ec-419b-8634-429602de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - TA505 IoC - 2020-06-06", "date": "2020-06-08", "analysis": 2, "threat_level_id": 2, "timestamp": 1591603181}, "5ede1810-6cfc-4a01-adb0-470902de0b81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Netwire\"", "relationship_type": ""}], "info": "OSINT - New Cyber Operation Targets Italy: Digging Into the Netwire Attack Chai", "date": "2020-06-08", "analysis": 2, "threat_level_id": 3, "timestamp": 1591613958}, "5edf24d5-6b5c-4e65-bc89-426e950d210f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Dridex\"", "relationship_type": ""}, {"colour": "#0da700", "local": false, "name": "misp-galaxy:tool=\"Dridex\"", "relationship_type": ""}], "info": "OSINT - IQ-FA006:Dridex XLS Documents with Fancy Lures", "date": "2020-06-09", "analysis": 2, "threat_level_id": 3, "timestamp": 1591686650}, "5ee3822c-6828-418c-b619-62de950d210f": {"Orgc": {"name": "The DFIR Report", "uuid": "5e9e5d86-5b94-4ff6-b07e-4e3e950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Dharma\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Dharma Ransomware\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "Ransomware", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": ""}], "info": "Dharma Ransomware Event", "date": "2020-06-12", "analysis": 0, "threat_level_id": 3, "timestamp": 1592742357}, "0733f160-8e52-4548-a4c8-19a1cfb41d0d": {"Orgc": {"name": "Centre for Cyber security Belgium", "uuid": "5cf66e53-b5f8-43e7-be9a-49880a3b4631"}, "Tag": [{"colour": "#f82378", "local": false, "name": "zloader", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#DADCF0", "local": false, "name": "inthreat:event-src=\"feed-osint\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#e6007c", "local": false, "name": "workflow:state=\"complete\"", "relationship_type": ""}], "info": "zloader: VBA, R1C1 References, and Other Tomfoolery", "date": "2020-06-24", "analysis": 0, "threat_level_id": 4, "timestamp": 1726894805}, "946e7701-5bdd-4efe-ae94-a6626fc8092b": {"Orgc": {"name": "The DFIR Report", "uuid": "5e9e5d86-5b94-4ff6-b07e-4e3e950d210f"}, "Tag": [{"colour": "#ab022a", "local": false, "name": "Dridex", "relationship_type": ""}, {"colour": "#10e874", "local": false, "name": "Powershell Empire", "relationship_type": ""}, {"colour": "#0da700", "local": false, "name": "misp-galaxy:tool=\"Dridex\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Dridex to Empire", "date": "2020-07-15", "analysis": 2, "threat_level_id": 3, "timestamp": 1596485073}, "355c00b3-a85f-4a6c-850f-95bc7357abd1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Linux/CDRThief\u2009\u2014\u2009Indicators of Compromise - Who is calling? CDRThief targets Linux VoIP softswitches", "date": "2020-09-22", "analysis": 2, "threat_level_id": 2, "timestamp": 1600777302}, "4dd5ab8b-f4dd-4d69-9873-745dd8196b94": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Ryuk ransomware\"", "relationship_type": ""}], "info": "Ransomware Activity Targeting the Healthcare and Public Health Sector", "date": "2020-10-29", "analysis": 2, "threat_level_id": 1, "timestamp": 1751530073}, "d353f73e-4c80-4cc8-84c1-940b4899df95": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Ryuk ransomware\"", "relationship_type": ""}], "info": "unc1878 - ryuk", "date": "2020-10-29", "analysis": 2, "threat_level_id": 2, "timestamp": 1603993373}, "cd8b9093-e319-4719-81b3-04a275b2f048": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Ryuk ransomware\"", "relationship_type": ""}], "info": "OSINT - Ryuk Ransomware: Extensive Attack Infrastructure Revealed", "date": "2020-10-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1604048189}, "58a8e2b1-1010-47bc-ad21-b98e0288426a": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Ryuk ransomware\"", "relationship_type": ""}], "info": "SEKOA IOC - CSV GitHub - Ryuk", "date": "2020-10-31", "analysis": 2, "threat_level_id": 2, "timestamp": 1604173318}, "0fadc113-6e22-4524-96b1-7b8fc98fa64c": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Ryuk ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Cobalt Strike\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Anatomy of Attack: Inside BazarBackdoor to Ryuk Ransomware \"one\" Group via Cobalt Strike", "date": "2020-11-09", "analysis": 2, "threat_level_id": 1, "timestamp": 1604914828}, "6c6aa762-c302-46fd-b49c-b3fbf3f0eaa1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Cobalt Strike\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Cobalt Strike\"", "relationship_type": ""}], "info": "CobaltStrike C2s on Port 443", "date": "2020-11-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1606404607}, "0b988513-9535-42f0-9ebc-5d6aec2e1c79": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Egregor\"", "relationship_type": ""}], "info": "OSINT - Egregor: The New Ransomware Variant To Watch", "date": "2020-11-27", "analysis": 2, "threat_level_id": 1, "timestamp": 1607324075}, "ff477867-67c8-4210-99c9-52cf737b9811": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Snifula\"", "relationship_type": ""}, {"colour": "#0b8c00", "local": false, "name": "misp-galaxy:tool=\"Snifula\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "usrnif download google", "date": "2020-12-04", "analysis": 2, "threat_level_id": 2, "timestamp": 1607093995}, "1c4e9e86-eff3-485f-aa1d-1bff68101b14": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Cobalt Strike\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Cobalt Strike\"", "relationship_type": ""}], "info": "OSINT - CobaltStrike C2s Dec2020_10", "date": "2020-12-10", "analysis": 0, "threat_level_id": 2, "timestamp": 1607605096}, "f78232e7-0b7a-49f7-9e57-1482db2b6335": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - UNC2452 / SUNBURST @vxunderground OSINT related findings", "date": "2020-12-14", "analysis": 0, "threat_level_id": 1, "timestamp": 1607931286}, "e6d2f7c9-c183-43c9-bd3c-3dcfbb34665c": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT Threat Advisory: SolarWinds supply chain attack", "date": "2020-12-15", "analysis": 2, "threat_level_id": 1, "timestamp": 1608022091}, "ffb85ca7-6a43-4b9f-a759-b6a7ea2235f9": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"RegretLocker\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "RegretLocker - compiled information, activity and samples", "date": "2020-12-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1609337868}, "56864321-e4c0-4a50-b7cf-1102ee4c2808": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#d46aea", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_tcp_out_connection\"", "relationship_type": ""}, {"colour": "#c8b852", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_install_startup_script_by_registry\"", "relationship_type": ""}, {"colour": "#e31d46", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_request_dns_by_name\"", "relationship_type": ""}, {"colour": "#59b97f", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_check_external_ip\"", "relationship_type": ""}, {"colour": "#a380b5", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_change_folder_appearance\"", "relationship_type": ""}, {"colour": "#a3fd40", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_av_malicious_match\"", "relationship_type": ""}, {"colour": "#63eb02", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_use_encryption_api\"", "relationship_type": ""}, {"colour": "#4b44cc", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_enumerate_processes\"", "relationship_type": ""}, {"colour": "#9d9c90", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_establish_http_connection\"", "relationship_type": ""}, {"colour": "#c9b80b", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_delay_execution_by_sleep\"", "relationship_type": ""}, {"colour": "#22d63f", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_dynamic_api_usage_by_api\"", "relationship_type": ""}, {"colour": "#3ef66f", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_modify_windows_backup_settings\"", "relationship_type": ""}, {"colour": "#11a2d6", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_drop_pe_file\"", "relationship_type": ""}, {"colour": "#df8416", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_create_named_mutex\"", "relationship_type": ""}, {"colour": "#41f1e3", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_install_scheduled_task_by_schtasks\"", "relationship_type": ""}, {"colour": "#6d96f5", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_create_process_with_hidden_window\"", "relationship_type": ""}, {"colour": "#00905d", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_known_suspicious_file\"", "relationship_type": ""}, {"colour": "#3932a1", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"vmray_delay_by_scheduled_task_delayed\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"RegretLocker\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "RegretLocker - VMRay Analyzer Report for Sample #1500977", "date": "2020-12-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1609336602}, "f42c106c-df01-47f3-bc36-16072ad63856": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Egregor\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone", "date": "2021-01-04", "analysis": 2, "threat_level_id": 2, "timestamp": 1609779788}, "4ce77fdd-19a8-4037-ac75-4ece0c05d63f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0c9900", "local": false, "name": "cycat:type=\"fingerprint\"", "relationship_type": ""}, {"colour": "#13f200", "local": false, "name": "cycat:scope=\"investigation\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Cobalt Strike\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"metasploit\"", "relationship_type": ""}], "info": "C2-JARM - A list of JARM hashes for different ssl implementations used by some C2 tools.", "date": "2021-01-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1609857141}, "86836f20-44df-443f-9ee4-6fcf0e554883": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Babuk Ranomsware\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Babuk Ransomware", "date": "2021-01-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1609871056}, "28d7a5af-b0e2-40f0-8ead-6e140ff316d4": {"Orgc": {"name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}], "info": "Leonardo S.p.A. Data Breach Analysis blog post from Reaqta", "date": "2021-01-08", "analysis": 2, "threat_level_id": 1, "timestamp": 1610465345}, "e82f98b7-0734-44f9-99c4-1ac38805dbad": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:amitt-misinformation-pattern=\"Create fake Social Media Profiles / Pages / Groups\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Build social network persona - T1341\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Conduct social engineering - T1249\"", "relationship_type": ""}], "info": "OSINT - New campaign targeting security researchers", "date": "2021-01-26", "analysis": 2, "threat_level_id": 2, "timestamp": 1611668896}, "2ebc21a4-5635-4a7d-9553-ec5f58be0ee6": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Client Software Binary - T1554\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Traffic Signaling - T1205\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Command History - T1070.003\"", "relationship_type": ""}, {"colour": "#075900", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": ""}], "info": "OSINT - Kobalos \u2013 A complex Linux threat to high performance computing infrastructure", "date": "2021-02-02", "analysis": 2, "threat_level_id": 2, "timestamp": 1612271360}, "2e29b34e-9558-46ba-96b2-211295ece344": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Hildegard: New TeamTNT Malware Targeting Kubernetes", "date": "2021-02-04", "analysis": 2, "threat_level_id": 1, "timestamp": 1612437672}, "6021536f-a808-4b9c-8136-d7460aba047c": {"Orgc": {"name": "CERT-FR_1510", "uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"}, "Tag": [{"colour": "#ff1f00", "local": false, "name": "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "cossi:TLP=\"white\"", "relationship_type": ""}, {"colour": "#008e63", "local": false, "name": "cossi:RechercheSourceOuverte=\"Autorisee\"", "relationship_type": ""}, {"colour": "#00714f", "local": false, "name": "cossi:fiabilite=\"Bonne\"", "relationship_type": ""}, {"colour": "#c60750", "local": false, "name": "misp-galaxy:threat-actor=\"FIN11\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA505\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00714f", "local": false, "name": "cert-fr:fiabilite=\"Bonne\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "PAP:CLEAR", "relationship_type": ""}], "info": "[CERT-FR] Infrastructure d'attaque du groupe cybercriminel TA505", "date": "2021-02-08", "analysis": 2, "threat_level_id": 2, "timestamp": 1776577177}, "3dd18ce2-fa55-4f0d-b88e-7d4144cb0dcb": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Egregor\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"REvil - S0496\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Sodinokibi\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Gandcrab\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"GandCrab\"", "relationship_type": ""}], "info": "OSINT - AN ANALYSIS OF THE EGREGOR RANSOMWARE", "date": "2021-02-11", "analysis": 2, "threat_level_id": 2, "timestamp": 1613399927}, "60118dab-1ab8-40b2-b02b-b6f80aba047c": {"Orgc": {"name": "CERT-FR_1510", "uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"}, "Tag": [{"colour": "#ff1f00", "local": false, "name": "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"", "relationship_type": ""}, {"colour": "#008e63", "local": false, "name": "cossi:RechercheSourceOuverte=\"Interdite\"", "relationship_type": ""}, {"colour": "#00714f", "local": false, "name": "cossi:fiabilite=\"Bonne\"", "relationship_type": ""}, {"colour": "#6d35f2", "local": false, "name": "misp-galaxy:threat-actor=\"IRIDIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TeleBots\"", "relationship_type": ""}, {"colour": "#12e300", "local": false, "name": "misp-galaxy:threat-actor=\"Sandworm\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"ELECTRUM\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "cossi:TLP=\"white\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#004577", "local": false, "name": "osint:source-type=\"block-or-filter-list\"", "relationship_type": ""}, {"colour": "#00714f", "local": false, "name": "cert-fr:fiabilite=\"Bonne\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "PAP:CLEAR", "relationship_type": ""}, {"colour": "#493000", "local": false, "name": "cert-ist:threat_targeted_system=\"Linux\"", "relationship_type": ""}, {"colour": "#e49600", "local": false, "name": "cert-ist:threat_targeted_region=\"Western Europe\"", "relationship_type": ""}, {"colour": "#fea700", "local": false, "name": "cert-ist:enriched", "relationship_type": ""}, {"colour": "#392500", "local": false, "name": "cert-ist:ioc_accuracy=\"high\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": ""}, {"colour": "#3a2600", "local": false, "name": "cert-ist:threat_level=\"low\"", "relationship_type": ""}, {"colour": "#f8a400", "local": false, "name": "cert-ist:threat_type=\"apt\"", "relationship_type": ""}], "info": "[CERT-FR] Sandworm intrusion set campaign targeting Centreon systems", "date": "2021-01-27", "analysis": 0, "threat_level_id": 4, "timestamp": 1788004532}, "eb4ee171-8930-4c15-8917-9af8775417fb": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"France\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-ics-groups=\"Sandworm\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Sandworm Team - G0034\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"ELECTRUM\"", "relationship_type": ""}, {"colour": "#12e300", "local": false, "name": "misp-galaxy:threat-actor=\"Sandworm\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TeleBots\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Server Software Component - T1505\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task/Job - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1548\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": ""}], "info": "CERT-FR report extended - sandworm intrusion set campaign targeting Centreon systems", "date": "2021-02-16", "analysis": 2, "threat_level_id": 4, "timestamp": 1613463604}, "5898d6f2-7bd4-4dca-8f4a-4c6cfe92b726": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Gamaredon Group - G0047\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0026eb", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"moderate\"", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": ""}], "info": "Gamaredon Group (common notes from McAfee and other sources)", "date": "2021-02-17", "analysis": 2, "threat_level_id": 3, "timestamp": 1613550775}, "1edd5ee1-7c91-4233-840a-6c419d6afc62": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - IronNetInjector: Turla\u2019s New Malware Loading Tool", "date": "2021-02-20", "analysis": 2, "threat_level_id": 2, "timestamp": 1613811965}, "fd875781-262e-4159-a0cd-ac0241784cc7": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "March 2021 Exchange Server Security Updates for older Cumulative Updates of Exchange Server", "date": "2021-03-09", "analysis": 2, "threat_level_id": 1, "timestamp": 1615361330}, "0165e5d7-51e6-4c2e-a382-1dd1e706f7bb": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#001cad", "local": false, "name": "estimative-language:likelihood-probability=\"very-likely\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}], "info": "OSINT - DearCry ransomware (abusing Exchange Server)", "date": "2021-03-12", "analysis": 2, "threat_level_id": 1, "timestamp": 1615541608}, "eb8ec4e4-ea78-4cf5-80bc-974e765f08df": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "CISA.gov - AA21-062A Mitigate Microsoft Exchange Server Vulnerabilities", "date": "2021-03-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1615717945}, "174f7375-c811-4c4a-81e0-1d41582f340d": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT  - Analyzing attacks taking advantage of the Exchange Server vulnerabilities", "date": "2021-03-26", "analysis": 2, "threat_level_id": 2, "timestamp": 1616759918}, "9362e0e3-62ff-475e-8d32-1ffbb5078e8d": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Cheating the cheater: How adversaries are using backdoored video game cheat engines and modding tools", "date": "2021-03-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1617204700}, "b7f8805b-fec8-4491-b866-83a457212437": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}], "info": "FireEye Mandiant PulseSecure Exploitation Countermeasures", "date": "2021-04-21", "analysis": 2, "threat_level_id": 1, "timestamp": 1618997892}, "01e8868d-48ae-41aa-8516-ea5a303758b8": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#2f5400", "local": false, "name": "malware_classification:malware-category=\"Rootkit\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Netfilter Rootkit Samples - F. Roth - Google sheet + expansion", "date": "2021-06-19", "analysis": 1, "threat_level_id": 1, "timestamp": 1624087411}, "e0eaf6f2-a12c-4b31-9d19-f77faf1ea4c9": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Sodinokibi\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}], "info": "Kaseya ransomware attack - indicators and information publicly available", "date": "2021-07-05", "analysis": 1, "threat_level_id": 1, "timestamp": 1625650507}, "21daf42e-7045-461c-8656-ff9894186820": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware", "date": "2021-07-16", "analysis": 2, "threat_level_id": 1, "timestamp": 1626429105}, "0f5d36d5-9eda-429f-8c72-bdfaa7b6a750": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:surveillance-vendor=\"NSO group\"", "relationship_type": ""}], "info": "OSINT - NSO related domains", "date": "2021-07-19", "analysis": 2, "threat_level_id": 1, "timestamp": 1626691535}, "b6a0d910-69ae-463d-80a8-1f84839a2514": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Nanocore RAT\"", "relationship_type": ""}, {"colour": "#054100", "local": false, "name": "misp-galaxy:tool=\"NanoCoreRAT\"", "relationship_type": ""}], "info": "Nanocore 20210816", "date": "2021-08-17", "analysis": 0, "threat_level_id": 3, "timestamp": 1629204277}, "f66e0cfa-40d1-438c-aa2f-4c95fe4318c5": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}], "info": "AA21-110A Exploitation of Pulse Connect Secure Vulnerabilities", "date": "2021-04-29", "analysis": 0, "threat_level_id": 3, "timestamp": 1629872383}, "159de01c-e6db-46c9-98a2-5434584086d5": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - M\u0113ris botnet", "date": "2021-09-17", "analysis": 2, "threat_level_id": 1, "timestamp": 1631886713}, "d5ccd0b6-f554-4182-8ac3-c8a4d5789ba6": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Turla - G0010\"", "relationship_type": ""}, {"colour": "#12e200", "local": false, "name": "misp-galaxy:threat-actor=\"Turla Group\"", "relationship_type": ""}], "info": "TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines", "date": "2021-09-24", "analysis": 2, "threat_level_id": 1, "timestamp": 1632471288}, "67a072d6-3d20-4024-a987-e8fdd226a075": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"LockBit\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"LockBit\"", "relationship_type": ""}], "info": "OINT - Hunting the LockBit Gang's Exfiltration Infrastructures", "date": "2021-09-24", "analysis": 2, "threat_level_id": 1, "timestamp": 1632483195}, "ad7665ec-fef2-44eb-a019-b1b25a8aec05": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#053a00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Dependencies and Development Tools - T1195.001\"", "relationship_type": ""}], "info": "Malware Discovered in Popular NPM Package, ua-parser-js", "date": "2021-10-24", "analysis": 2, "threat_level_id": 2, "timestamp": 1635063955}, "5df8df26-fe0e-4858-94a7-6cf71d9519c9": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Pre-OS Boot - T1542\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden File System - T1564.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rename System Utilities - T1036.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Patch System Image - T1601.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1406\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bootkit - T1542.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing Policy Modification - T1553.006\"", "relationship_type": ""}, {"colour": "#054300", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Evasion - T1497.003\"", "relationship_type": ""}, {"colour": "#075900", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Window Discovery - T1010\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1420\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Peripheral Device Discovery - T1120\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1424\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1426\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Time Discovery - T1124\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Removable Media - T1025\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1417\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1513\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": ""}, {"colour": "#064500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Multi-Stage Channels - T1104\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Transfer - T1029\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ESPecter bootkit\"", "relationship_type": ""}], "info": "UEFI threats moving to the ESP: Introducing ESPecter bootkit", "date": "2021-10-05", "analysis": 0, "threat_level_id": 1, "timestamp": 1637336858}, "ed46f822-41e6-4dca-a1c5-ad768306bfe9": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"MuddyWater - G0069\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"MuddyWater - G0069\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MuddyWater\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iran\"", "relationship_type": ""}], "info": "CYBERCOM_Malware_Alert -  MuddyWater has been seen using a variety of techniques to maintain access to victim networks.", "date": "2022-01-13", "analysis": 0, "threat_level_id": 2, "timestamp": 1642082225}, "8cc5335e-915b-4e16-837d-49143e6987b4": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": ""}, {"colour": "#7c0025", "local": false, "name": "collaborative-intelligence:request=\"related-samples\"", "relationship_type": ""}, {"colour": "#420014", "local": false, "name": "collaborative-intelligence:request=\"sample\"", "relationship_type": ""}], "info": "MSFT - MSTIC - Destructive malware targeting Ukrainian organizations", "date": "2022-01-16", "analysis": 2, "threat_level_id": 4, "timestamp": 1642348752}, "4b825576-e9e3-4f7b-a9a7-e0ad91550ea2": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:amitt-misinformation-pattern=\"Create Master Narratives\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:amitt-misinformation-pattern=\"Facilitate State Propaganda\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:amitt-misinformation-pattern=\"Search Engine Optimization\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:amitt-misinformation-pattern=\"Create fake websites\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:amitt-misinformation-pattern=\"Legacy web content\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": ""}], "info": "Disinformation - The GRU\u2019s galaxy of Russian-speaking websites", "date": "2022-01-28", "analysis": 2, "threat_level_id": 4, "timestamp": 1643358520}, "0e887f03-5aa2-4a7b-b0f7-66208c6c657b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Lazarus Group - G0032\"", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - North Korea\u2019s Lazarus APT leverages Windows Update client, GitHub in latest campaign", "date": "2022-01-28", "analysis": 2, "threat_level_id": 2, "timestamp": 1643368411}, "91a106b2-5ae3-4433-a885-fe3023adb768": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#2d0048", "local": false, "name": "adversary:infrastructure-status=\"compromised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Mirai\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Mirai\"", "relationship_type": ""}], "info": "Compromised host delivering malware (Mirai)", "date": "2022-01-28", "analysis": 0, "threat_level_id": 1, "timestamp": 1643379935}, "4b475a5f-ea47-4f2f-aea3-d8ba9bd1b6b6": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:surveillance-vendor=\"Cytrox\"", "relationship_type": ""}], "info": "OSINT - Cytrox Spyware Indicators of Compromise", "date": "2022-01-30", "analysis": 2, "threat_level_id": 3, "timestamp": 1643539206}, "b9b6dcfa-0b11-40dc-9bf4-9a36a2c1a046": {"Orgc": {"name": "Centre for Cyber security Belgium", "uuid": "5cf66e53-b5f8-43e7-be9a-49880a3b4631"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disk Structure Wipe - T1561.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Signed Binary Proxy Execution - T1218\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Group Policy Modification - T1484.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#054300", "local": false, "name": "admiralty-scale:source-reliability=\"a\"", "relationship_type": ""}, {"colour": "#0eb100", "local": false, "name": "admiralty-scale:information-credibility=\"1\"", "relationship_type": ""}], "info": "HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine", "date": "2022-02-24", "analysis": 0, "threat_level_id": 1, "timestamp": 1664880605}, "a097dd7c-8e29-40eb-a70d-1fb0b5cca689": {"Orgc": {"name": "SCTIF", "uuid": "5a313608-0410-4941-aaeb-8607950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "HermeticWiper", "date": "2022-02-25", "analysis": 1, "threat_level_id": 1, "timestamp": 1645809833}, "5dd2ce03-5651-47c6-9e96-633c5fbc2c90": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iran\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MuddyWater\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"MuddyWater - G0069\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "CISA - Malware Analysis Report (AR22-055A) - MAR\u201310369127\u20131.v1 - MuddyWater", "date": "2022-02-22", "analysis": 2, "threat_level_id": 2, "timestamp": 1645945639}, "08c5fe06-4375-4fce-a555-b02352cef2d6": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#62009e", "local": false, "name": "adversary:infrastructure-state=\"active\"", "relationship_type": ""}], "info": "gsocket.io - Global Socket Relay Network (GSRN) - infrastructure", "date": "2022-03-01", "analysis": 1, "threat_level_id": 4, "timestamp": 1646125939}, "6181159d-d7e0-422f-b7f5-26cc0abe1822": {"Orgc": {"name": "CERT-FR_1510", "uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"}, "Tag": [{"colour": "#ff1f00", "local": false, "name": "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "cossi:TLP=\"white\"", "relationship_type": ""}, {"colour": "#008e63", "local": false, "name": "cossi:RechercheSourceOuverte=\"Autorisee\"", "relationship_type": ""}, {"colour": "#00714f", "local": false, "name": "cossi:fiabilite=\"Bonne\"", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00714f", "local": false, "name": "cert-fr:fiabilite=\"Bonne\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "PAP:CLEAR", "relationship_type": ""}], "info": "[CERT-FR] Campagnes d'hame\u00e7onnage du mode op\u00e9ratoire d'attaquants Nobelium", "date": "2021-11-02", "analysis": 0, "threat_level_id": 4, "timestamp": 1700843537}, "62167543-c4e0-4f39-a23e-c09f0abe1822": {"Orgc": {"name": "CERT-FR_1510", "uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"}, "Tag": [{"colour": "#ff1f00", "local": false, "name": "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "cossi:TLP=\"white\"", "relationship_type": ""}, {"colour": "#008e63", "local": false, "name": "cossi:RechercheSourceOuverte=\"Autorisee\"", "relationship_type": ""}, {"colour": "#12e300", "local": false, "name": "misp-galaxy:threat-actor=\"Sandworm\"", "relationship_type": ""}, {"colour": "#6d35f2", "local": false, "name": "misp-galaxy:threat-actor=\"IRIDIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TeleBots\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"ELECTRUM\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "PAP:CLEAR", "relationship_type": ""}], "info": "[NCSC-UK] Cyclops blink", "date": "2022-02-23", "analysis": 0, "threat_level_id": 4, "timestamp": 1686051322}, "de6bc50b-dfc7-4938-a0f0-2305f9e4d2b8": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"", "relationship_type": ""}], "info": "Nvidia leak - abused certificate for signing malicious code and tools such as mimikatz", "date": "2022-03-07", "analysis": 2, "threat_level_id": 2, "timestamp": 1646639834}, "2ec1f538-1915-4636-8b38-101cb1efce5e": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1552.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Lazarus Group - G0032\"", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}], "info": "A22-108A TraderTraitor North Korean State-Sponsored APT Targets Blockchain Companies", "date": "2022-04-20", "analysis": 0, "threat_level_id": 3, "timestamp": 1650976786}, "c65578dd-3d7d-4a1a-bc30-7d12af38a59a": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Lazarus Group - G0032\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Lazarus Group - G0032\"", "relationship_type": ""}, {"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}], "info": "TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies", "date": "2022-04-19", "analysis": 0, "threat_level_id": 1, "timestamp": 1650976901}, "ff6b1c02-8c44-4646-9d3f-9a831b5ba006": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#316200", "local": false, "name": "circl:incident-classification=\"phishing\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "Phishing La Banque Postale - Lookyloo Capture (http://one.doesntexist.com/p/b2ba4)", "date": "2022-05-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1652441662}, "5e67e70a-9666-4c32-b3ec-4b51d43a8e4b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Leverage compromised 3rd party resources - T1375\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application or System Exploitation - T1499.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Sample Linux miner - XMring", "date": "2022-06-01", "analysis": 2, "threat_level_id": 1, "timestamp": 1654067773}, "63a9a6fa-f518-4591-9dbe-d0bb0f0ea588": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - First Exploitation of Follina Seen in the Wild", "date": "2022-06-01", "analysis": 0, "threat_level_id": 1, "timestamp": 1654068974}, "053f26a4-8fac-4733-a114-a6c0bdfd1e1c": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"PlugX\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"PlugX - S0013\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"PlugX - S0013\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"PlugX\"", "relationship_type": ""}, {"colour": "#043400", "local": false, "name": "misp-galaxy:tool=\"PlugX\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ShadowPad\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"ShadowPad - S0596\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ShadowPad\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Poison Ivy\"", "relationship_type": ""}, {"colour": "#043600", "local": false, "name": "misp-galaxy:tool=\"Poison Ivy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT -  Space Pirates: analyzing the tools and connections of a new hacker group", "date": "2022-05-31", "analysis": 2, "threat_level_id": 1, "timestamp": 1654069642}, "3410ad13-ef34-48c9-bc6f-b1b111a30e06": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": ""}], "info": "OSINT - Russia's APT28 uses fear of nuclear war to spread Follina docs in Ukraine", "date": "2022-06-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1655990647}, "34493f6d-9441-45df-9cb4-4de473709081": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Safe Mode Boot - T1562.009\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "dnc:malware-type=\"Ransomware\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "Ransomware", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#1f2325", "local": false, "name": "Intel 471:GIR=\"1.2.2 - Ransomware-as-a-Service (RaaS)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"MedusaLocker\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"MedusaLocker\"", "relationship_type": ""}], "info": "#StopRansomware: MedusaLocker", "date": "2022-06-30", "analysis": 0, "threat_level_id": 1, "timestamp": 1657009711}, "704d14e0-3a68-46a2-9b20-88a781463250": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Maui Ransomware\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Maui ransomware\"", "relationship_type": ""}, {"colour": "#7f1796", "local": false, "name": "target:healthcare", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"north korea\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "dnc:malware-type=\"Ransomware\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "Ransomware", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"Ransom\"", "relationship_type": ""}], "info": "[TLP:WHITE] Joint CSA: North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector", "date": "2022-07-06", "analysis": 0, "threat_level_id": 1, "timestamp": 1666860331}, "65475a3f-5488-4cf8-b9da-29714522e9ae": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}], "info": "CISA - MAR-10382254.r1.v1: XMRIG Cryptominer", "date": "2022-06-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1657285147}, "f1bb8c57-f133-449e-974d-4fb0156050e1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Finance\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "CSSF - Warnings", "date": "2022-07-08", "analysis": 1, "threat_level_id": 2, "timestamp": 1657287549}, "f811ccb3-5724-4ff4-a920-36d81100e7b8": {"Orgc": {"name": "BSK", "uuid": "56024f6c-da70-4584-b689-48ef950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#053a00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "relationship_type": ""}, {"colour": "#002642", "local": false, "name": "osint:source-type=\"microblog-post\"", "relationship_type": ""}], "info": "Github Repo Compromise Domain MyJino RU", "date": "2022-08-03", "analysis": 0, "threat_level_id": 1, "timestamp": 1659520660}, "e7ba6328-3c18-4578-a7c2-96a151170246": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:region=\"005 - South America\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Mexico\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA558\"", "relationship_type": ""}], "info": "OSINT - Reservations Requested: TA558 Targets Hospitality and Travel", "date": "2022-08-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1661327170}, "013585af-ba0a-480a-8f2f-48df896d9229": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"FIN7 - G0046\"", "relationship_type": ""}, {"colour": "#dd5a72", "local": false, "name": "misp-galaxy:threat-actor=\"FIN7\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - JSSLoader: the shellcode edition", "date": "2022-08-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1660912821}, "19b55cd3-2c7f-4bb5-805c-308b412958b0": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#1f2325", "local": false, "name": "misp-galaxy:malpedia=\"Astaroth\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Astaroth - S0373\"", "relationship_type": ""}, {"colour": "#c581b3", "local": false, "name": "misp-galaxy:rat=\"Guildma\"", "relationship_type": ""}], "info": "Brazil malspam pushes Astaroth (Guildma) malware", "date": "2022-08-19", "analysis": 0, "threat_level_id": 1, "timestamp": 1661430902}, "be8c3307-4b09-4ddf-af24-41c2385d8036": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Remcos - S0332\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"Remcos\"", "relationship_type": ""}], "info": "Remcos RAT New TTPS \u2013 Detection & Response", "date": "2022-08-29", "analysis": 0, "threat_level_id": 1, "timestamp": 1661935212}, "42e5a5d8-59d6-4075-9c9d-2d334b9d74e1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"cameroon\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"ivory coast\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"morocco\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"senegal\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"togo\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"DangerousSavanna\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa", "date": "2022-09-06", "analysis": 0, "threat_level_id": 2, "timestamp": 1662644030}, "7360197a-48e6-4792-b7c6-5d616d5c79c9": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#b00074", "local": false, "name": "maec-malware-behavior:maec-malware-behavior=\"mine-for-cryptocurrency\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Hezb\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}, {"colour": "#0eb100", "local": false, "name": "admiralty-scale:information-credibility=\"1\"", "relationship_type": ""}], "info": "Hezb cryptomining malware", "date": "2022-09-12", "analysis": 0, "threat_level_id": 2, "timestamp": 1664443644}, "d4766c50-0269-4cda-acea-850ea4fdb198": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Kinsing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Kinsing - S0599\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Kinsing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:cryptominers=\"Hezb\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Hezb\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Dark.IoT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Dark\"", "relationship_type": ""}, {"colour": "#22681c", "local": false, "name": "\tmalware_classification:malware-category=\"Botnet\"", "relationship_type": ""}], "info": "Kinsing & Dark.IoT botnet among threats targeting CVE-2022-26134", "date": "2022-06-22", "analysis": 0, "threat_level_id": 4, "timestamp": 1666604798}, "761270e6-3a97-4c18-9a44-a844cb5b562b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Tool - T1588.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1587.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Non-Application Layer Protocol - T1095\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Accounts - T1078.002\"", "relationship_type": ""}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Accounts - T1078.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol - T1048.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Shutdown/Reboot - T1529\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Chisel (ELF)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Chisel (Windows)\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Lorenz\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Lorenz Ransomware\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "dnc:malware-type=\"Ransomware\"", "relationship_type": ""}, {"colour": "#39b300", "local": false, "name": "enisa:nefarious-activity-abuse=\"ransomware\"", "relationship_type": ""}, {"colour": "#006c6c", "local": false, "name": "ecsirt:malicious-code=\"ransomware\"", "relationship_type": ""}, {"colour": "#2b4d00", "local": false, "name": "malware_classification:malware-category=\"Ransomware\"", "relationship_type": ""}, {"colour": "#00acd1", "local": false, "name": "veris:action:malware:variety=\"Ransomware\"", "relationship_type": ""}, {"colour": "#000000", "local": false, "name": "Ransomware", "relationship_type": ""}, {"colour": "#420053", "local": false, "name": "ms-caro-malware:malware-type=\"Ransom\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"Ransom\"", "relationship_type": ""}], "info": "Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free", "date": "2022-09-12", "analysis": 0, "threat_level_id": 4, "timestamp": 1666603345}, "758d96ed-9dd4-4009-9270-65f2c3dd30cc": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#064b00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hijack Execution Flow - T1574\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal on Host - T1070\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Execution Guardrails - T1480\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Initialization Scripts - T1037\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": ""}, {"colour": "#075900", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1417\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Host Information - T1592\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Access Control - T1548.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1587.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"BumbleBee\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"BumbleBee\"", "relationship_type": ""}, {"colour": "#00b3b3", "local": false, "name": "ecsirt:intrusions=\"backdoor\"", "relationship_type": ""}, {"colour": "#00a9ce", "local": false, "name": "veris:action:malware:variety=\"Backdoor\"", "relationship_type": ""}, {"colour": "#2c0037", "local": false, "name": "ms-caro-malware:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#001534", "local": false, "name": "ms-caro-malware-full:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Bookworm\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Bookworm\"", "relationship_type": ""}], "info": "Buzzing in the Background: BumbleBee, a New Modular Backdoor Evolved From BookWorm", "date": "2022-09-02", "analysis": 0, "threat_level_id": 2, "timestamp": 1666603410}, "5eeec9aa-9d88-4ece-9e6f-9d92884ae404": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"GALLIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"DragonOK - G0017\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"DragonOK - G0017\"", "relationship_type": ""}, {"colour": "#e834ab", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Mustang Panda - G0129\"", "relationship_type": ""}, {"colour": "#14f700", "local": false, "name": "misp-galaxy:threat-actor=\"DragonOK\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Earth Berberoka\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"GALLIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Mustang Panda\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"Winnti - S0141\"", "relationship_type": ""}, {"colour": "#10c300", "local": false, "name": "misp-galaxy:threat-actor=\"Axiom\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Winnti Group - G0044\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Winnti Group - G0044\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"PlugX\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-malware=\"PlugX - S0013\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"PlugX - S0013\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:rat=\"PlugX\"", "relationship_type": ""}, {"colour": "#043400", "local": false, "name": "misp-galaxy:tool=\"PlugX\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": ""}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Component Object Model - T1559.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1060\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1088\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1073\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": ""}, {"colour": "#053a00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Name or Location - T1036.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1045\"", "relationship_type": ""}, {"colour": "#064f00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inter-Process Communication - T1559\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Services - T1569\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1548\"", "relationship_type": ""}, {"colour": "#064b00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hijack Execution Flow - T1574\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hide Artifacts - T1564\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal on Host - T1070\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Service Discovery - T1007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1076\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": ""}, {"colour": "#075900", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Obfuscation - T1001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": ""}, {"colour": "#064500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Proxy - T1090.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Impersonation - T1001.003\"", "relationship_type": ""}, {"colour": "#064f00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": ""}], "info": "Dissecting PlugX to Extract Its Crown Jewels", "date": "2022-09-14", "analysis": 0, "threat_level_id": 4, "timestamp": 1663580963}, "83e15192-96d8-476c-aa39-0317de8dba80": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials - T1589.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Multi-Factor Authentication Request Generation - T1621\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing via Service - T1194\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing via Service - T1566.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials in Files - T1081\"", "relationship_type": ""}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Accounts - T1078.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1087.002\"", "relationship_type": ""}, {"colour": "#064f00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1136.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"", "relationship_type": ""}, {"colour": "#1f3f00", "local": false, "name": "circl:incident-classification=\"system-compromise\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - Uber Breach & Attack Analysis", "date": "2022-09-18", "analysis": 0, "threat_level_id": 4, "timestamp": 1666020853}, "2e7a515f-c380-4915-a505-9568ccc00d22": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#002b4a", "local": false, "name": "osint:source-type=\"technical-report\"", "relationship_type": ""}, {"colour": "#4c3011", "local": false, "name": "cccs:malware_classification=\"webshell\"", "relationship_type": ""}, {"colour": "#825600", "local": false, "name": "cert-ist:malware_type=\"Webshell\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"MimiKatz\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-tool=\"Mimikatz - S0002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Mimikatz - S0002\"", "relationship_type": ""}, {"colour": "#064800", "local": false, "name": "misp-galaxy:tool=\"Mimikatz\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Netcat\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Volatile Cedar - G0123\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Volatile Cedar\"", "relationship_type": ""}], "info": "DeftTorero: tactics, techniques and procedures of intrusions revealed", "date": "2022-10-03", "analysis": 0, "threat_level_id": 4, "timestamp": 1665044144}, "c8a8758f-aa63-41c9-8119-804434dab957": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#3a7300", "local": false, "name": "circl:incident-classification=\"malware\"", "relationship_type": ""}, {"colour": "#8bf800", "local": false, "name": "malware_classification:memory-classification=\"user-process\"", "relationship_type": ""}], "info": "OSINT - Linux malware found on a single compromised Linux host", "date": "2022-10-07", "analysis": 0, "threat_level_id": 2, "timestamp": 1665404397}, "b7a486af-8b67-4f58-873b-0ae25fea43e9": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Prynt Stealer\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"WorldWind\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"DarkEye\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"Prynt Stealer\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"WorldWind\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"DarkEye\"", "relationship_type": ""}, {"colour": "#00b3b3", "local": false, "name": "ecsirt:intrusions=\"backdoor\"", "relationship_type": ""}, {"colour": "#00a9ce", "local": false, "name": "veris:action:malware:variety=\"Backdoor\"", "relationship_type": ""}, {"colour": "#2c0037", "local": false, "name": "ms-caro-malware:malware-type=\"Backdoor\"", "relationship_type": ""}, {"colour": "#001534", "local": false, "name": "ms-caro-malware-full:malware-type=\"Backdoor\"", "relationship_type": ""}], "info": "[OSINT] No Honor Among Thieves - Prynt Stealer\u2019s Backdoor Exposed", "date": "2022-09-01", "analysis": 0, "threat_level_id": 1, "timestamp": 1666601798}, "4b1c186d-8bf2-4297-9cbc-f8f00192770b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#065000", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unsecured Credentials - T1552\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Time Discovery - T1124\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Service Discovery - T1007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Location Discovery - T1614\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": ""}, {"colour": "#909609", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Prynt Stealer\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"Prynt Stealer\"", "relationship_type": ""}], "info": "Prynt Stealer Spotted In the Wild - A New Info Stealer Performing Clipper And Keylogger Activities", "date": "2022-04-21", "analysis": 0, "threat_level_id": 1, "timestamp": 1666601854}, "2af530f6-7486-4a15-aa87-248d0c0b1e9f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#440055", "local": false, "name": "ms-caro-malware:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#4bec00", "local": false, "name": "enisa:nefarious-activity-abuse=\"remote-access-tool\"", "relationship_type": ""}, {"colour": "#008ba9", "local": false, "name": "veris:asset:variety=\"S - Remote access\"", "relationship_type": ""}, {"colour": "#00bde6", "local": false, "name": "veris:action:misuse:vector=\"Remote access\"", "relationship_type": ""}, {"colour": "#001739", "local": false, "name": "ms-caro-malware-full:malware-type=\"RemoteAccess\"", "relationship_type": ""}, {"colour": "#5f0044", "local": false, "name": "CERT-XLM:malicious-code=\"spyware-rat\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA2541\"", "relationship_type": ""}, {"colour": "#316200", "local": false, "name": "circl:incident-classification=\"phishing\"", "relationship_type": ""}], "info": "Charting TA2541's Flight", "date": "2022-02-15", "analysis": 0, "threat_level_id": 1, "timestamp": 1666773062}, "e132e5f2-1a09-43e4-b2d6-8046c730616f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}], "info": "OSINT - Fortinet says SSL-VPN pre-auth RCE bug is exploited in attacks", "date": "2022-12-13", "analysis": 1, "threat_level_id": 1, "timestamp": 1671440259}, "0ebe51c2-31f1-4ba4-b7ab-1f5e62531e45": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Raspberry Robin\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "OSINT - QNAP worm aka Raspberry Robin", "date": "2022-12-19", "analysis": 2, "threat_level_id": 4, "timestamp": 1671443120}, "78deca96-305c-4582-9cd8-c5c39dcc2ab1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT (VT Collection) - GodFather Malware Returns Targeting Banking Users", "date": "2023-01-10", "analysis": 0, "threat_level_id": 3, "timestamp": 1673365538}, "f6098894-bbc6-4ee8-adbb-fc99b4c86f04": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deliver Malicious App via Authorized App Store - T1475\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1646\"", "relationship_type": ""}, {"colour": "#00829e", "local": false, "name": "veris:asset:variety=\"U - Mobile phone\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Godfather Trojan IOCs", "date": "2023-01-10", "analysis": 1, "threat_level_id": 1, "timestamp": 1673365597}, "042a4478-fe19-4ed0-a309-b96da3542a95": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": "targets"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "attributed-to"}], "info": "Analysis of FG-IR-22-398 \u2013 FortiOS - heap-based buffer overflow in SSLVPNd", "date": "2023-01-13", "analysis": 1, "threat_level_id": 1, "timestamp": 1673616092}, "f2049d65-5315-4c37-9bbb-900c9b851204": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - CircleCI incident report for January 4, 2023 security incident", "date": "2023-01-19", "analysis": 1, "threat_level_id": 4, "timestamp": 1674116421}, "d3e23455-b121-4ea7-84c5-47d67808e7d7": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}], "info": "Microsoft Office 365 Phishing - hosted on IPFS - https://ipfs.io/ipfs/QmdZDtyPrvVegTU7p6JZ5dm3CoZnH2qdEjTRfsUY8Nncwh", "date": "2023-01-19", "analysis": 0, "threat_level_id": 3, "timestamp": 1674136785}, "abc51826-68fd-4cef-9a06-86ec17e66ef1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "Pandora analysis (Ilnas-04570323.exe) - malicious files included in an email", "date": "2023-03-14", "analysis": 2, "threat_level_id": 3, "timestamp": 1678791723}, "659a6331-0690-4b3b-ae16-e29a1fc31fc2": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"Sordeal-Stealer\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"", "relationship_type": ""}, {"colour": "#075900", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1056.002\"", "relationship_type": ""}], "info": "Malicious GitHub user and account - distributing malicious code and running  Sordeal-Stealer", "date": "2023-04-11", "analysis": 2, "threat_level_id": 2, "timestamp": 1681225599}, "e9bf73b9-f82c-4203-ba04-deacf8d9fbd6": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"SNOWYAMBER\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"HALFRIG\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"QUARTERRIG\"", "relationship_type": ""}], "info": "SNOWYAMBER, HALFRIG, QUARTERRIG - IoC Reference", "date": "2023-04-13", "analysis": 0, "threat_level_id": 1, "timestamp": 1681482747}, "68cf0b2c-e449-4b2e-a7f7-b2b55cf951b5": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"SNOWYAMBER\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Search Order Hijacking - T1574.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"HTML Smuggling - T1027.006\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Right-to-Left Override - T1036.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Mark-of-the-Web Bypass - T1553.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"One-Way Communication - T1102.003\"", "relationship_type": ""}], "info": "SNOWYAMBER - Malware Analysis Report", "date": "2023-04-13", "analysis": 0, "threat_level_id": 1, "timestamp": 1681739653}, "a57a8551-4e22-44b9-a72d-fa8345532029": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"HALFRIG\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Search Order Hijacking - T1574.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"HTML Smuggling - T1027.006\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Mark-of-the-Web Bypass - T1553.005\"", "relationship_type": ""}, {"colour": "#054300", "local": false, "name": "admiralty-scale:source-reliability=\"a\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}], "info": "HALFRIG - Malware Analysis Report", "date": "2023-04-13", "analysis": 0, "threat_level_id": 1, "timestamp": 1681907481}, "04e8bb1e-b445-40a6-a68a-1ce85e32d229": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"QUARTERRIG\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Search Order Hijacking - T1574.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"HTML Smuggling - T1027.006\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Mark-of-the-Web Bypass - T1553.005\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "QUARTERRIG - Malware Analysis Report", "date": "2023-04-13", "analysis": 0, "threat_level_id": 1, "timestamp": 1682166784}, "207feacb-6379-484d-8bea-b7281114b381": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#075300", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obtain Capabilities - T1588\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Digital Certificates - T1588.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Stage Capabilities - T1608\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Install Digital Certificate - T1608.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Supply Chain Compromise - T1195\"", "relationship_type": ""}, {"colour": "#053a00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "relationship_type": ""}, {"colour": "#064b00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hijack Execution Flow - T1574\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Invalid Code Signature - T1036.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal - T1070\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": ""}, {"colour": "#065000", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Debugger Evasion - T1622\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Location Discovery - T1614\"", "relationship_type": ""}, {"colour": "#064700", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Language Discovery - T1614.001\"", "relationship_type": ""}, {"colour": "#075700", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#064500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Manipulation - T1565\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Stored Data Manipulation - T1565.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:backdoor=\"POOLRAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"POOLRAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"IconicStealer\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"ICONICSTEALER\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"DAVESHELL\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"SIGFLIP\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:backdoor=\"VEILEDSIGNAL\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"COLDCAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"TAXHAUL\"", "relationship_type": ""}], "info": "3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible", "date": "2023-04-20", "analysis": 0, "threat_level_id": 1, "timestamp": 1684937230}, "f07207d5-e6f7-4369-9a9d-a1390b83aaeb": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}], "info": "Is Hagga Threat Actor (ab)using FSociety framework ?", "date": "2022-11-21", "analysis": 2, "threat_level_id": 2, "timestamp": 1683878227}, "a52a070a-6925-41ea-94d8-56f0d85dc268": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": ""}, {"colour": "#542f20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Software - T1219\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": ""}], "info": "An Analysis of Infrastructure linked to the Hagga Threat Actor", "date": "2022-07-12", "analysis": 2, "threat_level_id": 2, "timestamp": 1683880646}, "99f9138a-c8f8-44aa-9a0c-3736d74c2df3": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Volt Typhoon\"", "relationship_type": "attributed-to"}, {"colour": "#80ff00", "local": false, "name": "PAP:WHITE", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Telecoms\"", "relationship_type": "targets"}], "info": "Volt Typhoon targets US critical infrastructure with living-off-the-land techniques", "date": "2023-05-25", "analysis": 1, "threat_level_id": 1, "timestamp": 1731934053}, "f45fe125-7f3f-4335-bf74-5ab61eb5b645": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"FormBook\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1193\"", "relationship_type": ""}], "info": "FormBook campaign", "date": "2023-06-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1686914589}, "b0135754-b115-47c4-811c-e6840fe03f50": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Serverless InfoStealer delivered in Est European Countries", "date": "2021-12-17", "analysis": 0, "threat_level_id": 1, "timestamp": 1687347426}, "68690840-5104-4c1a-9223-6d0a35c52704": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing Certificates - T1588.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Digital Certificates - T1588.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Install Digital Certificate - T1608.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Link Target - T1608.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Management Instrumentation - T1047\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": ""}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": ""}, {"colour": "#075600", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript/JScript - T1059.007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Shared Modules - T1129\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#075700", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"", "relationship_type": ""}, {"colour": "#064500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": ""}, {"colour": "#064f00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Service Discovery - T1007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Window Discovery - T1010\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"", "relationship_type": ""}, {"colour": "#064700", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Language Discovery - T1614.001\"", "relationship_type": ""}, {"colour": "#075900", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"", "relationship_type": ""}, {"colour": "#054100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Shutdown/Reboot - T1529\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Office Application Startup - T1137\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Winlogon Helper DLL - T1547.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Shortcut Modification - T1547.009\"", "relationship_type": ""}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Binary Padding - T1027.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal from Tools - T1027.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Embedded Payloads - T1027.009\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Invalid Code Signature - T1036.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Double File Extension - T1036.007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Thread Execution Hijacking - T1055.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": ""}, {"colour": "#075900", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Access Token Manipulation - T1134\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1218.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": ""}, {"colour": "#065000", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Access Control - T1548.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"VBA Stomping - T1564.007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Debugger Evasion - T1622\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Kimsuky\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT43\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations", "date": "2023-03-28", "analysis": 0, "threat_level_id": 1, "timestamp": 1687420054}, "81f607d5-2b83-477c-95f5-342030de6570": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"RedDelta\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"PlugX\"", "relationship_type": ""}, {"colour": "#e834ab", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"Mustang Panda - G0129\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Mustang Panda\"", "relationship_type": ""}], "info": "Chinese Threat Actors Targeting Europe in SmugX Campaign", "date": "2023-07-03", "analysis": 0, "threat_level_id": 1, "timestamp": 1689165761}, "ea593018-b2e9-4e7e-8da9-cc20a751e3f6": {"Orgc": {"name": "ESET", "uuid": "55f6ea5e-51ac-4344-bc8c-4170950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Belarus\"", "relationship_type": ""}], "info": "MoustachedBouncer: Espionage against foreign diplomats in Belarus", "date": "2023-07-21", "analysis": 0, "threat_level_id": 1, "timestamp": 1784653974}, "6b6fa46d-4a17-44a4-a234-d69487b04597": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "CISA - MAR-10459736.r1.v1 - WHIRLPOOL Variant", "date": "2023-08-25", "analysis": 2, "threat_level_id": 3, "timestamp": 1692944619}, "89495010-cd5a-4250-9e57-c346426ae62a": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Pandora analysis (NEW ORDER LIST GREEN VALLEY CORP.xlam)", "date": "2023-08-25", "analysis": 0, "threat_level_id": 3, "timestamp": 1692954726}, "f33a2168-bea2-4b71-82ab-5e766c0a9227": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": true, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": true, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": true, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}], "info": "Pandora analysis (INV0027378237.7z) - Malicious attachment", "date": "2023-08-28", "analysis": 2, "threat_level_id": 3, "timestamp": 1693208729}, "e8141fc5-e84d-4aeb-8879-f71caffab35a": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": true, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": true, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": true, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Unidentified 103 (FIN8)\"", "relationship_type": ""}, {"colour": "#b7344f", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"FIN8 - G0061\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"FIN8 - G0061\"", "relationship_type": ""}, {"colour": "#07db5b", "local": false, "name": "misp-galaxy:threat-actor=\"FIN8\"", "relationship_type": ""}], "info": "FIN8-LINKED ACTOR TARGETS CITRIX NETSCALER SYSTEMS", "date": "2023-08-29", "analysis": 2, "threat_level_id": 2, "timestamp": 1693316666}, "fb6f4727-4993-4cc0-a177-56e37a0eddde": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": true, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": true, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": true, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:clear", "relationship_type": ""}], "info": "Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868)", "date": "2023-08-29", "analysis": 2, "threat_level_id": 2, "timestamp": 1693320156}, "98eb923a-6da8-4c63-87a0-a97a2eef3c98": {"Orgc": {"name": "Centre for Cyber security Belgium", "uuid": "5cf66e53-b5f8-43e7-be9a-49880a3b4631"}, "Tag": [{"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#0fc000", "local": false, "name": "admiralty-scale:information-credibility=\"2\"", "relationship_type": ""}, {"colour": "#E08AB5", "local": false, "name": "DOTRUNPEX", "relationship_type": ""}, {"colour": "#BFC5AA", "local": false, "name": "Loader", "relationship_type": ""}, {"colour": "#a00919", "local": false, "name": "feedly:source=\"Sekoia.io Blog\"", "relationship_type": ""}, {"colour": "#335a00", "local": false, "name": "malware_classification:malware-category=\"Downloader\"", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"", "relationship_type": ""}, {"colour": "#1f2325", "local": false, "name": "misp-galaxy:malpedia=\"vidar\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"XLoader\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Agent Tesla\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AsyncRAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Ave Maria\"", "relationship_type": ""}, {"colour": "#c6db8b", "local": false, "name": "misp-galaxy:malpedia=\"DarkCloud Stealer\"", "relationship_type": ""}, {"colour": "#cb1870", "local": false, "name": "misp-galaxy:malpedia=\"LgoogLoader\"", "relationship_type": ""}, {"colour": "#1f2325", "local": false, "name": "misp-galaxy:malpedia=\"RedLine Stealer\"", "relationship_type": ""}, {"colour": "#bf1e78", "local": false, "name": "misp-galaxy:malpedia=\"SectopRAT\"", "relationship_type": ""}, {"colour": "#5b067c", "local": false, "name": "misp-galaxy:malpedia=\"Stealc\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Agent Tesla - S0331\"", "relationship_type": ""}, {"colour": "#3db017", "local": false, "name": "misp-galaxy:mitre-malware=\"WarzoneRAT - S0670\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"QuasarRAT - S0262\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-tool=\"Remcos - S0332\"", "relationship_type": ""}, {"colour": "#d9b45c", "local": false, "name": "misp-galaxy:rat=\"AsyncRAT\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"Vidar\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"DarkCloud Stealer\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"FormBook\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Agent Tesla\"", "relationship_type": ""}, {"colour": "#1f2325", "local": false, "name": "misp-galaxy:malpedia=\"BitRAT\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "misp-galaxy:mitre-malware=\"WannaCry - S0366\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Shared Modules - T1129\"", "relationship_type": ""}, {"colour": "#064500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic API Resolution - T1027.007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#064f00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Obfuscation - T1001\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "CustomerLoader: a new malware distributing a wide variety of payloads", "date": "2023-07-14", "analysis": 2, "threat_level_id": 2, "timestamp": 1693969205}, "47bc8ca0-5956-441a-9b26-a6da7e10376b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Police.CH - Erpresserische Kryptow\u00e4hrung-Adressen", "date": "2023-09-08", "analysis": 0, "threat_level_id": 3, "timestamp": 1694174327}, "e3b6b6a1-fe4a-4475-948b-fe763b7254a4": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deliver Malicious App via Authorized App Store - T1475\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"China\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Manipulation - T1565\"", "relationship_type": ""}], "info": "Spyware Telegram mod distributed via Google Play - Evil Telegram doppelganger attacks Chinese users", "date": "2023-09-11", "analysis": 2, "threat_level_id": 3, "timestamp": 1694415518}, "08af4546-b6e5-4cdc-ab0f-d5290dec8307": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#828f60", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"041bc611-87da-4ad4-a46b-b37926180b7d\"", "relationship_type": ""}, {"colour": "#e4b282", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e56fb691-4acb-4a45-890f-9988ca8e1db1\"", "relationship_type": ""}, {"colour": "#caa635", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"89ec2169-2205-4c7e-95e2-11d3e85443a4\"", "relationship_type": ""}, {"colour": "#d05c29", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"719b79ce-4e59-4862-8d3e-282b97124d57\"", "relationship_type": ""}, {"colour": "#7be860", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"bbd6c5d0-6c1f-41db-8591-6be6c853af15\"", "relationship_type": ""}, {"colour": "#5d9458", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"3456fa61-e230-42b8-b100-d1cf560ba095\"", "relationship_type": ""}, {"colour": "#9f4fe6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2c373316-6ce5-4f43-9daf-02c94cb0c0a5\"", "relationship_type": ""}, {"colour": "#28f071", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"0eea33ef-23b6-413e-9e29-3f06b0fe9c9e\"", "relationship_type": ""}, {"colour": "#fd2a40", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"edc3317c-b298-4364-8977-486afac37cb5\"", "relationship_type": ""}, {"colour": "#2f25f9", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"69d1635c-cd2b-4331-8a2c-8b66e98f45d8\"", "relationship_type": ""}, {"colour": "#d06241", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"343f4ca7-4745-4f12-ad76-25538936deea\"", "relationship_type": ""}, {"colour": "#f4da83", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a860bd61-390f-4a33-976e-9d421c245615\"", "relationship_type": ""}, {"colour": "#6c9f1e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"ce5ab594-3c59-45af-8338-65901d1d027c\"", "relationship_type": ""}, {"colour": "#e66c1b", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"8ef65734-9d51-48d4-aea6-fc775f92f4fa\"", "relationship_type": ""}, {"colour": "#b14e06", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"5b330985-0104-4097-a7b7-eac5fd65322f\"", "relationship_type": ""}, {"colour": "#45eb95", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"fc5b8a15-c3de-4c93-803a-ce92b76e54e7\"", "relationship_type": ""}, {"colour": "#858835", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"c57876e5-099a-4b04-8f09-6ff9cf266048\"", "relationship_type": ""}, {"colour": "#2d0219", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"fd846751-22ce-46b4-a232-cc4f8797596c\"", "relationship_type": ""}, {"colour": "#05e7b7", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"691e655e-5f24-4a03-9742-10c04e70e81c\"", "relationship_type": ""}, {"colour": "#5485e2", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"7b8278a3-fae9-455a-aad6-475a51d8ec78\"", "relationship_type": ""}, {"colour": "#0a49bb", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"6fde81c5-4e69-4e50-b065-d1f40160d688\"", "relationship_type": ""}, {"colour": "#020323", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"fc682b58-a253-40a6-b734-214d976b1209\"", "relationship_type": ""}, {"colour": "#12646a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"3cbb3d7b-4cae-4c7e-a682-e8b70e3f1ee4\"", "relationship_type": ""}, {"colour": "#1ae406", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d574506b-78ac-4061-b01f-096e192435b9\"", "relationship_type": ""}, {"colour": "#1fdf99", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f01496d3-6783-4574-b690-55d1c058658b\"", "relationship_type": ""}, {"colour": "#d08ba3", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"49168b08-e6dd-40a0-acbf-c3ad19629c10\"", "relationship_type": ""}, {"colour": "#d47714", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f73cb603-750c-4b48-b539-2981bd11f4f8\"", "relationship_type": ""}, {"colour": "#a222c6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"75ebee53-fa0b-40a5-a03b-086b1ad78ae6\"", "relationship_type": ""}, {"colour": "#45564f", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"cdba188f-b6e9-4d05-8c71-55c2635f18ee\"", "relationship_type": ""}, {"colour": "#d2d35b", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2d3008ec-0ef3-4040-ad90-02bfffcbcb4f\"", "relationship_type": ""}, {"colour": "#b1333c", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"b657c846-82a5-49d4-a21a-c03333b3e084\"", "relationship_type": ""}, {"colour": "#4fe6b8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"66ab02e2-e21d-411d-95aa-c10d2b6af7bc\"", "relationship_type": ""}, {"colour": "#db020e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e5d5721d-7dac-4c8f-ad36-40d68e7b2cf1\"", "relationship_type": ""}, {"colour": "#a98cd9", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"ad406ffd-dc56-467f-a3d1-d5766a19088d\"", "relationship_type": ""}, {"colour": "#7d3ac0", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"126cf03a-a600-4214-b0c1-ff3a96da40d3\"", "relationship_type": ""}, {"colour": "#0eadd1", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d300ed74-db05-4581-9313-2d6c3c49bb40\"", "relationship_type": ""}, {"colour": "#f47d4e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"af1564b9-286f-4fd9-a083-eaa0c45e7ea4\"", "relationship_type": ""}, {"colour": "#204d26", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"7c4ba5a6-711b-4cd1-be8a-e2f08bfbc184\"", "relationship_type": ""}, {"colour": "#19e2d2", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"031d44b0-5163-4433-8d8f-f5e2c170746a\"", "relationship_type": ""}, {"colour": "#b0e911", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"bd7ea606-6be2-4e66-8e25-0aa73bbfaf53\"", "relationship_type": ""}, {"colour": "#8530a4", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a4c8d6ab-0459-4347-a05a-280aa81d8edd\"", "relationship_type": ""}, {"colour": "#73eade", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"296cae9a-96c9-412c-8e4e-c7be9405208c\"", "relationship_type": ""}, {"colour": "#b83e56", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"200007b9-4c5a-4604-8f10-46ec46853048\"", "relationship_type": ""}, {"colour": "#398689", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"c566cd7d-819f-4e39-b93a-80c0e5bfcafc\"", "relationship_type": ""}, {"colour": "#b0248a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f4702807-c428-41f7-8097-6f19070186e6\"", "relationship_type": ""}, {"colour": "#89aee9", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"b73d96e3-ae7f-4095-83de-fa2523d887d7\"", "relationship_type": ""}, {"colour": "#330d27", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"0a35d2c4-896f-410f-a410-5a156d1aeb68\"", "relationship_type": ""}, {"colour": "#fa56f5", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"b0bd15d0-884d-4df2-ac3a-3256f3e18917\"", "relationship_type": ""}, {"colour": "#158c80", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"cf4144e8-d431-4618-a4cc-809ee0c82d0d\"", "relationship_type": ""}, {"colour": "#0a18c4", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"8a841dab-f386-454d-8112-6bab03a8b650\"", "relationship_type": ""}, {"colour": "#56b70b", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2f48791f-e918-422f-b154-8cf13b2c470d\"", "relationship_type": ""}, {"colour": "#9aabf7", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"c2685af8-747a-45d3-956a-819124642abf\"", "relationship_type": ""}, {"colour": "#67b470", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"24a836a9-ec21-420b-b459-23cdc1ce47b8\"", "relationship_type": ""}, {"colour": "#6c4795", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"dfe708b2-695a-4243-950d-bec6b39c222e\"", "relationship_type": ""}, {"colour": "#1b3ac1", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"1655f4f3-154f-4242-b716-1cd743998f42\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "AA23-250A: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475", "date": "2023-10-10", "analysis": 0, "threat_level_id": 3, "timestamp": 1696961391}, "276f7055-c5e0-4b14-8645-c7028d0c74aa": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"israel\"", "relationship_type": "targets"}], "info": "BiBi-Linux: A New Wiper Dropped By Pro-Hamas Hacktivist Group", "date": "2023-11-21", "analysis": 2, "threat_level_id": 2, "timestamp": 1700581494}, "df7b7020-9f17-4a3c-9824-1baa4ff67cb1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Kinsing\"", "relationship_type": ""}], "info": "CVE-2023-46604 (Apache ActiveMQ) Vulnerability Exploited to Infect Systems With Cryptominers and Rootkits", "date": "2023-11-22", "analysis": 0, "threat_level_id": 3, "timestamp": 1733135743}, "c578cb44-e440-486d-80a4-8cf6256c1d53": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#2e2c61", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"9a280255-c770-4d42-ae50-aff1896ebded\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities", "date": "2023-12-05", "analysis": 0, "threat_level_id": 3, "timestamp": 1702630147}, "b6084bdd-5570-4e1e-965c-c587c9ae1c77": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "PSA: Fake CVE-2023-45124 Phishing Scam Tricks Users Into Installing Backdoor Plugin", "date": "2023-12-05", "analysis": 2, "threat_level_id": 3, "timestamp": 1701869265}, "b6ae21ad-670a-4c81-a61f-78d76ae3bdfa": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "targets"}, {"colour": "#053a00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "relationship_type": ""}], "info": "The Golden Tax Department and the Emergence of GoldenSpy Malware", "date": "2020-06-22", "analysis": 0, "threat_level_id": 4, "timestamp": 1702644765}, "124008c0-e519-4f1d-b1fd-bd42bfae2198": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}], "info": "MAR-10478915-1.v1 Citrix Bleed", "date": "2023-12-06", "analysis": 2, "threat_level_id": 3, "timestamp": 1701849487}, "c98a638f-29c5-4233-a283-34ddbcc40be4": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#68efec", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f0a904f4-b3f5-4e42-b565-418dc6932d44\"", "relationship_type": ""}, {"colour": "#51be74", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e8b9ef62-f34a-4d8c-8095-196c7e6f607d\"", "relationship_type": ""}, {"colour": "#d38736", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"84783d50-c513-428f-b288-17b4bd24821b\"", "relationship_type": ""}, {"colour": "#53b733", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2d41cc0d-be1b-47e5-8491-ada86f624ec4\"", "relationship_type": ""}, {"colour": "#113234", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a1fe1a1c-ae50-4812-a064-dbec116d1fc3\"", "relationship_type": ""}, {"colour": "#bd998c", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"4ff7e674-9bdb-43bf-bce4-406351ac1188\"", "relationship_type": ""}, {"colour": "#6eb6e0", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"4c312255-f721-4a07-b49a-006387d79a2d\"", "relationship_type": ""}, {"colour": "#7fd8f6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"7a388102-a1e3-4f69-99a0-23d4d2344312\"", "relationship_type": ""}, {"colour": "#ecdd8b", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"23a9ad16-95c1-4b7d-98b8-049fdd9ef8b2\"", "relationship_type": ""}, {"colour": "#90085c", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"75868d94-271e-4dac-8885-b51843a4c9d4\"", "relationship_type": ""}, {"colour": "#fe0ad8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2fd37eac-035a-48f7-83da-cefa8937d859\"", "relationship_type": ""}, {"colour": "#c7b048", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"be2cdeb0-048c-4aa2-8cee-0dba9687e975\"", "relationship_type": ""}, {"colour": "#0e06f8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d6d7c433-a139-43b7-9f6c-8cc6e97b8a72\"", "relationship_type": ""}, {"colour": "#e38422", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"c31d692e-0be1-4678-abf0-2e64dfb24890\"", "relationship_type": ""}, {"colour": "#11d9bc", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a6c90d18-9b9d-4bdf-9cfa-b0abb5889f86\"", "relationship_type": ""}, {"colour": "#0ce7dd", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f8695dd5-3fa7-40c8-941f-ee8f7d8d0080\"", "relationship_type": ""}, {"colour": "#7640b6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"9a9fd346-3ca7-42ee-874b-ba706dbdcb03\"", "relationship_type": ""}, {"colour": "#9d71ee", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"22b606d1-33c8-4182-9ad1-9d5c7fbd7daf\"", "relationship_type": ""}, {"colour": "#085f9e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"96115b0f-f094-4ae6-bad4-e5a6715f48e0\"", "relationship_type": ""}, {"colour": "#189e0b", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"9c44b26b-ebfa-402b-bf16-10fe3551bbc7\"", "relationship_type": ""}, {"colour": "#d9e051", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"11d0fed1-9205-4d0f-85e5-d8b76cc3b3c1\"", "relationship_type": ""}, {"colour": "#29cae6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"351cb297-4ddc-4ee1-8e65-40b054834106\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "AA23-339A Threat Actors Exploit Adobe ColdFusion CVE- 2023-26360 for Initial Access to Government Servers", "date": "2023-12-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1701872197}, "f3290493-8f74-4220-aa04-b83408e37a0c": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#001e3a", "local": false, "name": "phishing:techniques=\"fake-website\"", "relationship_type": ""}, {"colour": "#0073de", "local": false, "name": "phishing:psychological-acceptability=\"high\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"luxembourg\"", "relationship_type": "targets"}], "info": "Phishing targeting Luxembourg services (hosted and served on/from AWS)", "date": "2023-12-19", "analysis": 2, "threat_level_id": 2, "timestamp": 1721049635}, "f0ef984c-2467-40aa-83c6-7c671a6379cb": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT -  BattleRoyal, DarkGate Cluster Spreads via Email and Fake Browser Updates", "date": "2023-12-22", "analysis": 0, "threat_level_id": 2, "timestamp": 1703240722}, "ab1a2393-2d57-46c9-91ab-16a4cc4b0b03": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN", "date": "2024-01-11", "analysis": 2, "threat_level_id": 1, "timestamp": 1704964651}, "4451faac-cba0-4647-8451-d21de2c71f92": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#001e3a", "local": false, "name": "phishing:techniques=\"fake-website\"", "relationship_type": ""}, {"colour": "#005fb7", "local": false, "name": "phishing:state=\"unknown\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}], "info": "A host (hosted in RU) with only phishing websites", "date": "2024-01-30", "analysis": 0, "threat_level_id": 1, "timestamp": 1706609705}, "81866b54-7f4b-42f0-bcc1-84b7d8578e74": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}], "info": "OSINT - KrustyLoader - Rust malware linked to Ivanti ConnectSecure compromises", "date": "2024-01-30", "analysis": 0, "threat_level_id": 1, "timestamp": 1706730814}, "34237efb-adf4-452b-a322-0cbed70c7b33": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "uses"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation", "date": "2024-01-31", "analysis": 2, "threat_level_id": 1, "timestamp": 1706730921}, "233c76c8-f94a-4ff7-9664-b666618e9de4": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "PAP:CLEAR", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Ivanti Connect Secure: Journey to the core of the DSLog backdoor", "date": "2024-02-12", "analysis": 2, "threat_level_id": 1, "timestamp": 1707733756}, "c5077ce0-6f6a-4f1a-b5b8-18c087806d07": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Linux and Mac File and Directory Permissions Modification - T1222.002\"", "relationship_type": ""}, {"colour": "#064500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1588.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"", "relationship_type": ""}, {"colour": "#89bea3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"AppleScript - T1059.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Command History - T1070.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Connection Proxy - T1090\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Connection Proxy - T1090\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"/etc/passwd and /etc/shadow - T1003.008\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "AA22-138B Threat Actors Chaining VMware Vulnerabilities for Full System Control", "date": "2022-06-02", "analysis": 0, "threat_level_id": 3, "timestamp": 1707733884}, "987a8747-d2a3-433c-b0f5-e541a8afc229": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#FFC000", "local": false, "name": "false-positive:risk=\"cannot-be-judged\"", "relationship_type": ""}], "info": "(fake? exercise) Phishing targeting different organisation in Benelux (\"cybersecurity\" company Pistachio)", "date": "2024-02-16", "analysis": 0, "threat_level_id": 3, "timestamp": 1708105105}, "f7d4de59-58ac-409e-a3cb-d50261b3f825": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Phobos\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sigma-rules=\"Publicly Accessible RDP Service\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Health\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Phobos\"", "relationship_type": ""}], "info": "OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro", "date": "2024-02-19", "analysis": 2, "threat_level_id": 4, "timestamp": 1708337267}, "69df43bb-2c48-4b4d-aa85-8477e92cb010": {"Orgc": {"name": "THA-CERT", "uuid": "58a4d347-8460-4fc7-a882-6728c0a82ae5"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "PAP:CLEAR", "relationship_type": ""}], "info": "I-Soon / Anxun data leak in Github", "date": "2024-02-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1711144914}, "f8912a82-2870-4de2-9663-5fdbee0ed401": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Sophos\"", "relationship_type": ""}], "info": "OSINT - ConnectWise ScreenConnect attacks deliver malware", "date": "2024-02-23", "analysis": 2, "threat_level_id": 2, "timestamp": 1708699989}, "9802116c-3ec3-4a8e-8b39-5c69b08df5ab": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)", "date": "2024-04-13", "analysis": 2, "threat_level_id": 1, "timestamp": 1713023036}, "196cf336-896a-4cc1-9aa9-3480ecd9cf27": {"Orgc": {"name": "Centre for Cyber security Belgium", "uuid": "5cf66e53-b5f8-43e7-be9a-49880a3b4631"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#086200", "local": false, "name": "admiralty-scale:source-reliability=\"c\"", "relationship_type": ""}, {"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}, {"colour": "#bd8c8c", "local": false, "name": "Ursnif", "relationship_type": ""}, {"colour": "#9258A7", "local": false, "name": "Vidar", "relationship_type": ""}, {"colour": "#ff3bf0", "local": false, "name": "VidarStealer", "relationship_type": ""}, {"colour": "#c42094", "local": false, "name": "batloader", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#D6064D", "local": false, "name": "Python", "relationship_type": ""}, {"colour": "#006980", "local": false, "name": "stone:malware-categorization=\"Loader\"", "relationship_type": ""}, {"colour": "#add1d0", "local": false, "name": "malware_advertising", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Traffic Capture or Redirection - T1410\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-malware=\"Ursnif - S0386\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sigma-rules=\"Ursnif\"", "relationship_type": ""}, {"colour": "#1f2325", "local": false, "name": "misp-galaxy:malpedia=\"vidar\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:stealer=\"Vidar\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"", "relationship_type": ""}], "info": "BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif", "date": "2023-03-16", "analysis": 0, "threat_level_id": 2, "timestamp": 1679499354}, "11879a3f-0ca4-491b-8774-d30496e66b34": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"Akira\"", "relationship_type": "attributed-to"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"/etc/passwd and /etc/shadow - T1003.008\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Groups - T1069.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Groups - T1069.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:region=\"150 - Europe\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:region=\"021 - Northern America\"", "relationship_type": "targets"}, {"colour": "#064f00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1136.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": ""}, {"colour": "#542f20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Software - T1219\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Connection Proxy - T1090\"", "relationship_type": ""}, {"colour": "#054100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Transfer Data to Cloud Account - T1537\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": ""}], "info": "OSINT - #StopRansomware: Akira Ransomware", "date": "2024-04-19", "analysis": 0, "threat_level_id": 2, "timestamp": 1713537157}, "ea44bf19-332c-4dd8-8149-cd64a020c460": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": "attributed-to"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0022d6", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"low\"", "relationship_type": ""}, {"colour": "#0a8200", "local": false, "name": "misp-galaxy:rat=\"NukeSped\"", "relationship_type": "uses"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Employment\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"north korea\"", "relationship_type": "attributed-to"}], "info": "OSINT - Potential abuse by Lazarus group using LinkedIn to spread malware", "date": "2024-04-24", "analysis": 1, "threat_level_id": 1, "timestamp": 1753865840}, "251a72a3-6229-4b4d-85a6-ba6d080dc1af": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#13eb00", "local": false, "name": "misp-galaxy:threat-actor=\"Lazarus Group\"", "relationship_type": "attributed-to"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Lazarus infrastructure (pivot via Censys)", "date": "2024-04-24", "analysis": 0, "threat_level_id": 1, "timestamp": 1713947804}, "92214b3e-76c6-48b1-bf92-061c7f55e302": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "uses"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"ArcaneDoor\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Cisco Talos Intelligence Group\"", "relationship_type": "documents"}], "info": "OSINT - ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices", "date": "2024-04-25", "analysis": 0, "threat_level_id": 1, "timestamp": 1714132910}, "482a37ad-cfaf-41cc-9bef-b3829dde3b3f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#4d24f9", "local": false, "name": "misp-galaxy:threat-actor=\"APT28\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Kampania APT28 skierowana przeciwko polskim instytucjom rz\u0105dowym", "date": "2024-05-08", "analysis": 2, "threat_level_id": 1, "timestamp": 1715185445}, "b1a15b0e-d143-4e93-9a8c-45968fd29936": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}], "info": "OSINT - Advisory: Active exploitation of Check Point Remote Access VPN vulnerability (CVE-2024-24919)", "date": "2024-05-31", "analysis": 2, "threat_level_id": 3, "timestamp": 1717137286}, "fba1fa66-183d-4e82-bb89-78bfcb4d6e29": {"Orgc": {"name": "Centre for Cyber security Belgium", "uuid": "5cf66e53-b5f8-43e7-be9a-49880a3b4631"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#075200", "local": false, "name": "admiralty-scale:source-reliability=\"b\"", "relationship_type": ""}, {"colour": "#f38e82", "local": false, "name": "Microsoft Exchange Vulnerability", "relationship_type": ""}, {"colour": "#cb58ae", "local": false, "name": "Zero Day", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#00223b", "local": false, "name": "osint:source-type=\"blog-post\"", "relationship_type": ""}, {"colour": "#986400", "local": false, "name": "cert-ist:threat_targeted_sector=\"Gov\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Spear phishing\"", "relationship_type": ""}, {"colour": "#9f6900", "local": false, "name": "cert-ist:threat_targeted_sector=\"Media\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:region=\"142 - Asia\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:region=\"150 - Europe\"", "relationship_type": ""}, {"colour": "#11d000", "local": false, "name": "admiralty-scale:information-credibility=\"3\"", "relationship_type": ""}], "info": "OSINT of Exchange 0-day campaign (Atos)", "date": "2022-10-03", "analysis": 2, "threat_level_id": 1, "timestamp": 1666617468}, "10a54888-bba3-4af5-bc5b-fcda933ac0e2": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#7b0059", "local": false, "name": "smart-airports-threats:system-failures=\"software-bugs\"", "relationship_type": ""}], "info": "TR-87 - CrowdStrike Agent causing BSOD loop on Windows - Faulty Update on Falcon Sensor", "date": "2024-07-19", "analysis": 2, "threat_level_id": 2, "timestamp": 1721380187}, "a9f67dbb-ba26-4635-be1d-0780bc140897": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#931d5c", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"Initial Access - Phishing [T1566]\"", "relationship_type": ""}, {"colour": "#81ba8c", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"Defense Evasion - Impair Defenses: Disable or Modify Tools [T1562.001]\"", "relationship_type": ""}, {"colour": "#12646a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"3cbb3d7b-4cae-4c7e-a682-e8b70e3f1ee4\"", "relationship_type": ""}, {"colour": "#9f4fe6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2c373316-6ce5-4f43-9daf-02c94cb0c0a5\"", "relationship_type": ""}, {"colour": "#2dc215", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"Impact - Inhibit System Recovery [T1490]\"", "relationship_type": ""}, {"colour": "#68efec", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f0a904f4-b3f5-4e42-b565-418dc6932d44\"", "relationship_type": ""}, {"colour": "#45eb95", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"fc5b8a15-c3de-4c93-803a-ce92b76e54e7\"", "relationship_type": ""}, {"colour": "#acd35e", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"Initial Access - Valid Accounts [T1078]\"", "relationship_type": ""}, {"colour": "#2f25f9", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"69d1635c-cd2b-4331-8a2c-8b66e98f45d8\"", "relationship_type": ""}, {"colour": "#cb99f6", "local": false, "name": "misp-galaxy:misp-attack-pattern=\"Impact - Data Encrypted for Impact [T1486]\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "CISA - AA24-131A #StopRansomware: Black Basta", "date": "2024-05-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1721396492}, "636cabbd-4bde-4fb2-bc6b-6b2c05fafcd5": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:nice-framework-skills=\"Skill in performing network data analysis - S0688\"", "relationship_type": "recommends-use-of"}], "info": "OSINT - RDGAs: The Next Chapter in Domain Generation Algorithms", "date": "2024-07-24", "analysis": 2, "threat_level_id": 3, "timestamp": 1721827141}, "0420f1c3-4b8d-4875-854e-5cb5f02408ca": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"india\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Bank\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Finance\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"RansomEXX\"", "relationship_type": "targeted-by"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#5db900", "local": false, "name": "circl:incident-classification=\"ransomware\"", "relationship_type": ""}, {"colour": "#6bd600", "local": false, "name": "circl:topic=\"finance\"", "relationship_type": ""}], "info": "OSINT - Major Payment Disruption: Ransomware Strikes Indian Banking Infrastructure", "date": "2024-08-21", "analysis": 0, "threat_level_id": 3, "timestamp": 1724258031}, "489836ca-1176-4799-a698-877dc53b085f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Hospitality\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Identify people of interest - T1269\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Conduct social engineering - T1268\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Identify sensitive personnel information - T1274\"", "relationship_type": ""}], "info": "Fake booking.com service website gathering PII including passport", "date": "2024-08-23", "analysis": 0, "threat_level_id": 3, "timestamp": 1724404100}, "e7ec6346-b312-48da-ba1c-8004d3e80eb1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Fake booking.com website - Lookyloo Capture (https://booking-0ef4-8213-ae7f-3fec3e22.1facc.pw/?stays=superb-apartment-to-rent-in-central-nijmegen&sid=9648547963&id=376818034&awg_dvm=FCgjGHuw8y)", "date": "2024-08-23", "analysis": 0, "threat_level_id": 3, "timestamp": 1724414125}, "3594b211-1c7c-4e20-8c85-62564c2e7267": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Finance\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Retail\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1660\"", "relationship_type": "uses"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - NGate Android malware relays NFC traffic to steal cash", "date": "2024-08-23", "analysis": 2, "threat_level_id": 3, "timestamp": 1724415650}, "5d71e617-63fc-4314-bbc3-29a606536f63": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spear phishing messages with malicious attachments - T1367\"", "relationship_type": ""}], "info": "Malicious comment on GitHub pointing to malware", "date": "2024-08-27", "analysis": 0, "threat_level_id": 3, "timestamp": 1725351365}, "317bb250-bddd-4c57-82a3-5a068f5b8d7f": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#86c437", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"7e0ace8d-1170-5ba6-953b-07f0edb931e5\"", "relationship_type": ""}, {"colour": "#245764", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"68936c88-a7d9-5c57-87d5-82cee0258446\"", "relationship_type": ""}, {"colour": "#961351", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"4980a23b-8576-5f43-919f-be1d65511c71\"", "relationship_type": ""}, {"colour": "#a1aaf6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a9732dfc-5d7f-5613-a990-e75667575a20\"", "relationship_type": ""}, {"colour": "#07ccb8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"6e60f5c4-cab1-54e7-99eb-e2243d934596\"", "relationship_type": ""}, {"colour": "#9e186e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"8beef3c6-31f3-592a-8f2c-1a35f1454621\"", "relationship_type": ""}, {"colour": "#6552ba", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2d516005-9134-548b-b85f-5f827436dc8c\"", "relationship_type": ""}, {"colour": "#07bf7d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"bc83dee5-b6d3-5534-8a27-11345878471a\"", "relationship_type": ""}, {"colour": "#ee9742", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"6232b886-5dee-508f-a0c9-6c96ffa34455\"", "relationship_type": ""}, {"colour": "#58fe96", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"04ad4243-c5bb-552b-8eca-fa4b48befb68\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"ransomhub\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"cyclops\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"knight\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "CISA - AA24-242A #StopRansomware: RansomHub Ransomware", "date": "2024-08-30", "analysis": 2, "threat_level_id": 2, "timestamp": 1725006937}, "931832a0-f7dc-4088-b0d0-9808ad05d585": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"FluBot\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:bhadra-framework=\"Data interception\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:bhadra-framework=\"SMS interception\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deliver Malicious App via Other Means - T1476\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remotely Wipe Data Without Authorization - T1469\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Call Control - T1616\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Manipulation - T1641\"", "relationship_type": ""}, {"colour": "#999442", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SMS Control - T1582\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Capture SMS Messages - T1412\"", "relationship_type": ""}], "info": "VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import feature.", "date": "2024-08-30", "analysis": 1, "threat_level_id": 3, "timestamp": 1725019901}, "7315018a-36ea-47b4-b3e6-3c68b58788bf": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"FluBot\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "FluBot - Distribution vectors & Threat network infrastructure", "date": "2024-08-30", "analysis": 0, "threat_level_id": 3, "timestamp": 1764990053}, "f1d154e7-f660-4146-8140-5985f0d69aa8": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#5208b8", "local": false, "name": "misp-galaxy:threat-actor=\"Earth Lusca\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"China\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Trend Micro\"", "relationship_type": "authored-by"}, {"colour": "#5e0033", "local": true, "name": "workflow:todo=\"review-the-source-credibility\"", "relationship_type": ""}], "info": "OSINT - Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion", "date": "2024-09-04", "analysis": 2, "threat_level_id": 3, "timestamp": 1725448717}, "d67bfbe0-e01d-4e2e-8a56-214805d85aee": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#95dce6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"7e6945c5-7f3b-55f6-bcb7-fa324c6bdaed\"", "relationship_type": ""}, {"colour": "#f47803", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"cfbd0546-fbbe-50bc-9839-f5942a2351aa\"", "relationship_type": ""}, {"colour": "#b5e81e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"5831810d-b580-5f7a-a1e7-faed4d1a563f\"", "relationship_type": ""}, {"colour": "#454ba2", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"486b67c5-001e-5f63-a107-32fc8a0241d3\"", "relationship_type": ""}, {"colour": "#1780f6", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"8853f41e-8f72-5458-ab93-952f356cfe5a\"", "relationship_type": ""}, {"colour": "#4373d7", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e50f5d5e-71ea-562f-a620-81b1959d12bf\"", "relationship_type": ""}, {"colour": "#8f4bfa", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"0dfcaefb-2c4e-5c91-a456-1f99d838489c\"", "relationship_type": ""}, {"colour": "#fe49ff", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"29a2e23c-a528-5a0b-9951-62f952c61a41\"", "relationship_type": ""}, {"colour": "#a424e2", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"72daa13a-e9e7-5e55-b00e-33bd4b388780\"", "relationship_type": ""}, {"colour": "#7e0469", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f5c5bb0a-b069-5007-81ce-a5237603e5d2\"", "relationship_type": ""}, {"colour": "#e6c438", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"fcee58e5-5ecd-59dd-b6f3-a2ca3773d319\"", "relationship_type": ""}, {"colour": "#484fb1", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"5204f946-8433-5ec8-9191-7befc4fabd19\"", "relationship_type": ""}, {"colour": "#ee4feb", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e3483879-54f7-577e-bc58-ff095f52940a\"", "relationship_type": ""}, {"colour": "#b56d6a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"9ee6c31a-4150-5379-b985-e326e66af3ca\"", "relationship_type": ""}, {"colour": "#e7a5a9", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e6927ba4-7209-5b63-a292-b0debffe25ee\"", "relationship_type": ""}, {"colour": "#ff90df", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"9c5bce7a-fd1d-5dce-8baf-50b158ddd0ef\"", "relationship_type": ""}, {"colour": "#1cf4fb", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d4702430-9466-5d8a-8c61-df2dda91d764\"", "relationship_type": ""}, {"colour": "#f68ba9", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"b3d2e49a-5e0d-5874-abe5-7056de875f42\"", "relationship_type": ""}, {"colour": "#0db1c8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"ddbb1e82-5ec2-58f6-a798-21a99cdd86bc\"", "relationship_type": ""}, {"colour": "#1da9a4", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"819ae972-e7cb-50fa-951f-39f313782283\"", "relationship_type": ""}, {"colour": "#ec9b97", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"6c1fac21-26db-5cfa-b85b-b35035980c89\"", "relationship_type": ""}, {"colour": "#45c4d9", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"ffdadad3-c8d6-58e2-b167-f7d519a773d2\"", "relationship_type": ""}, {"colour": "#3d7941", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"ebcb5766-2582-57d4-abdb-217f7d3cf6bf\"", "relationship_type": ""}, {"colour": "#a6879d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"65b221c8-e332-5ee8-9690-df517ca14b0e\"", "relationship_type": ""}, {"colour": "#c082a7", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a4c3c998-327a-5e05-8a71-274d32a0fc61\"", "relationship_type": ""}, {"colour": "#28ae17", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"8cc97e25-1098-5b49-a89a-b227ac8acfb6\"", "relationship_type": ""}, {"colour": "#3afb42", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"deaa17ef-2126-59f8-bfda-8ad576e9f255\"", "relationship_type": ""}, {"colour": "#c39305", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"02af8157-334a-5ad7-95da-71d2da89b995\"", "relationship_type": ""}, {"colour": "#d74e07", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"5e84e7dc-47d0-5cbf-a650-10b7f0cfba02\"", "relationship_type": ""}, {"colour": "#a516b0", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"ee63b40a-73ae-5655-a319-f550fe7da87e\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:intelligence-agency=\"GRU (Russian Federation)\"", "relationship_type": "attributed-to"}], "info": "AA24-249A: Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure", "date": "2024-09-06", "analysis": 0, "threat_level_id": 3, "timestamp": 1725608935}, "eaa6f2f7-a944-47d2-a71d-cc7080c27fed": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Lumma Stealer\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Lumma Stealer Malware (delivered via GitHub Spam) - Pandora analysis (l6E.exe)", "date": "2024-09-19", "analysis": 0, "threat_level_id": 4, "timestamp": 1784327165}, "1cccd5d8-5d52-4610-b8b7-7bbebd0d6d7b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"SloppyLemming\"", "relationship_type": "attributed-to"}, {"colour": "#ba5c0b", "local": false, "name": "misp-galaxy:country=\"sri lanka\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"pakistan\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"bangladesh\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Police - Law enforcement\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Energy\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Telecoms\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Technology\"", "relationship_type": "targets"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Unraveling SloppyLemming\u2019s Operations Across South Asia", "date": "2024-09-26", "analysis": 2, "threat_level_id": 3, "timestamp": 1727339046}, "b0454a71-cd8b-440b-bf27-1a52800b2579": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"dragonforce\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": ""}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Accounts - T1078.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Inside the Dragon: DragonForce Ransomware Group", "date": "2024-10-01", "analysis": 0, "threat_level_id": 3, "timestamp": 1727768647}, "4fe85264-fb26-494e-8eb7-da101e19e291": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575)", "date": "2024-10-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1729840578}, "581c63d3-9c2b-4af0-994c-c73cf9d2e895": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Denial of Service - T1464\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Endpoint Denial of Service - T1499\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Endpoint Denial of Service - T1642\"", "relationship_type": ""}], "info": "OSINT - Gorilla DDoS", "date": "2024-11-07", "analysis": 0, "threat_level_id": 3, "timestamp": 1748877175}, "ffea72a3-7935-4078-b769-b872475c5eae": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#362ef9", "local": false, "name": "misp-galaxy:country=\"afghanistan\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"eswatini\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"india\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"indonesia\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"pakistan\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"philippines\"", "relationship_type": "targets"}, {"colour": "#c05590", "local": false, "name": "misp-galaxy:country=\"south africa\"", "relationship_type": "targets"}, {"colour": "#1237d4", "local": false, "name": "misp-galaxy:country=\"taiwan\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"thailand\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"vietnam\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Earth Estries\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Consulting\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Managed Services Provider\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"NGO\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Telecoms\"", "relationship_type": "targets"}], "info": "OSINT - Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions", "date": "2024-11-27", "analysis": 2, "threat_level_id": 3, "timestamp": 1732697965}, "10f82b82-84ee-4adf-8565-e0d6d034c2a3": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Kinsing\"", "relationship_type": "attributed-to"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "abuses"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"", "relationship_type": "uses"}], "info": "Kinsing cryptomining exploiting Erlang service", "date": "2024-12-02", "analysis": 0, "threat_level_id": 3, "timestamp": 1741249327}, "b2a90426-2dc0-4022-b51e-8be190ffb7e5": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"pakistan\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Hong Kong\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Pakistan\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Academia - University\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Civil Aviation\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Defense\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Electric\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Energy\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"engineering\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Environment\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"IT - Security\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Multi-sector\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Pharmacy\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Security actors\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "uses"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "uses"}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "uses"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "uses"}, {"colour": "#054100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Portable Executable Injection - T1055.002\"", "relationship_type": "uses"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "uses"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "uses"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.", "date": "2024-10-24", "analysis": 0, "threat_level_id": 3, "timestamp": 1733752769}, "5ac29be4-309c-436f-84ff-49dd4f98e940": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": true, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": true, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": true, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": true, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#788300", "local": false, "name": "vulnerability:exploitability=\"industrialised\"", "relationship_type": ""}, {"colour": "#505600", "local": false, "name": "vulnerability:sighting=\"exploited\"", "relationship_type": ""}], "info": "OSINT - Threat Advisory: Oh No Cleo! Cleo Software Actively Being Exploited in the Wild", "date": "2024-12-10", "analysis": 2, "threat_level_id": 3, "timestamp": 1733842681}, "8506c95a-f2da-48c2-a1e0-339db58b1ba7": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Telecoms\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "uses"}], "info": "spearphishing campaign targeted at least 20 Autonomous System (AS) owners", "date": "2024-12-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1734122191}, "946c05c1-d7b6-4420-b88a-aa2b24addd81": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Conduct active scanning - T1254\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:preventive-measure=\"Packet filtering\"", "relationship_type": ""}], "info": "Mitigating Brute Force Attacks on NetScaler Devices", "date": "2024-12-16", "analysis": 2, "threat_level_id": 4, "timestamp": 1734347035}, "7cf90d8d-61f0-4e36-8083-15f66e3556ad": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"", "relationship_type": "attributed-to"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT", "date": "2024-12-16", "analysis": 2, "threat_level_id": 3, "timestamp": 1734382956}, "308d9f5c-4650-4548-9e2a-38a33a0a4c9a": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Sekoia\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}], "info": "OSINT - Mamba 2FA: A new contender in the AiTM phishing ecosystem", "date": "2024-10-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1734383501}, "87c159e3-5105-491e-87ba-94a7f0a52e09": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#8a3dcf", "local": false, "name": "misp-galaxy:country=\"serbia\"", "relationship_type": "attributed-to"}], "info": "OSINT - The Qualcomm DSP Driver - How Serbian authorities have deployed surveillance technology and digital repression tactics", "date": "2024-12-18", "analysis": 0, "threat_level_id": 3, "timestamp": 1734533886}, "d1c399c5-3b2e-4f4d-aef6-6ccfe93cd1ec": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"france\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Smishing\"", "relationship_type": "uses"}, {"colour": "#ffffff", "local": false, "name": "PAP:CLEAR", "relationship_type": ""}, {"colour": "#376d00", "local": false, "name": "circl:incident-classification=\"smishing\"", "relationship_type": ""}], "info": "\"Packets everywhere!\" report about delivery abuse system and phishing", "date": "2025-01-13", "analysis": 0, "threat_level_id": 3, "timestamp": 1736758448}, "590dd2db-c431-4d97-9b0c-5d1f26ab24b8": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"ukraine\"", "relationship_type": "targets"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#001fc2", "local": false, "name": "estimative-language:likelihood-probability=\"almost-certain\"", "relationship_type": ""}, {"colour": "#0029ff", "local": false, "name": "estimative-language:confidence-in-analytic-judgment=\"high\"", "relationship_type": ""}], "info": "OSINT - Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger", "date": "2025-02-19", "analysis": 2, "threat_level_id": 3, "timestamp": 1739984090}, "18c55588-626c-4e78-8840-45f9014d195c": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Telecoms\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UNC3236\"", "relationship_type": "related-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Volt Typhoon\"", "relationship_type": "related-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"GreyNoise\"", "relationship_type": "created-by"}], "info": "OSINT - GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks", "date": "2025-03-06", "analysis": 2, "threat_level_id": 2, "timestamp": 1741258691}, "b67a25bb-e31d-4f5c-8c79-6a46c8dcee19": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"north korea\"", "relationship_type": "operates-from"}], "info": "Over 2,400 IP addresses linked to Astrill VPN, often used by North Korean fake IT workers.", "date": "2025-03-11", "analysis": 0, "threat_level_id": 3, "timestamp": 1741689246}, "7e3793a8-59a9-4cf2-8299-9483007ff154": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#cb630a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"9b611c3f-6b02-5902-b9e8-17712d5f5d41\"", "relationship_type": ""}, {"colour": "#53f418", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"7b350f17-4a7f-5bcf-8d70-99ad68d6e877\"", "relationship_type": ""}, {"colour": "#1abd7d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"448a3535-d185-51ea-8a27-44653d7564af\"", "relationship_type": ""}, {"colour": "#3ab4df", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d3348f0a-7fac-56b0-9451-5964969db1e8\"", "relationship_type": ""}, {"colour": "#40fc13", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"46bbfd46-eafe-54ca-9650-ab508cc8a674\"", "relationship_type": ""}, {"colour": "#6b3d7c", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"70ba8a57-1955-5bfc-b9bb-62d7de6b8a57\"", "relationship_type": ""}, {"colour": "#3367e3", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"b4e42a35-5b21-5ebd-b3ac-c76e82697b4e\"", "relationship_type": ""}, {"colour": "#af5e1e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e3dda5ee-f8f5-57bd-b93b-9e5099efa9f9\"", "relationship_type": ""}, {"colour": "#762a98", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d403910f-4795-5b3a-83ea-829d77a27ea0\"", "relationship_type": ""}, {"colour": "#b207c2", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"6eff3df2-d200-578a-a415-73c07dad1d0f\"", "relationship_type": ""}, {"colour": "#50f90f", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"8e68267c-4e0b-5f11-837a-dcaef267cac0\"", "relationship_type": ""}, {"colour": "#f1f521", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a55a55fe-f531-5cc7-b355-ff840f1939b3\"", "relationship_type": ""}, {"colour": "#5799b2", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"82659de7-1b3f-5f03-a372-75473da90e83\"", "relationship_type": ""}, {"colour": "#3ce1db", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"1fedf479-4f99-5863-aec6-4c12bb571586\"", "relationship_type": ""}, {"colour": "#c6a04d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d2f0ca00-0de6-50fe-bf4a-b7b421c7ae1d\"", "relationship_type": ""}, {"colour": "#5adac5", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"591d9c18-7da9-55fe-8578-25f2d11eef8e\"", "relationship_type": ""}, {"colour": "#3b89eb", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"56d63469-4d9f-5acc-9b40-aded774106ad\"", "relationship_type": ""}, {"colour": "#96b98f", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a7a98e8d-3c74-5527-a1d3-2d5e35a5c976\"", "relationship_type": ""}, {"colour": "#75fa03", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"91f8ecb8-c1e8-5979-ba37-5bacc384138b\"", "relationship_type": ""}, {"colour": "#d7ce1d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"1c2865ae-25a9-50c7-b3f2-a981a62ceaec\"", "relationship_type": ""}, {"colour": "#16597d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f5895575-716d-5499-aa94-263a31963495\"", "relationship_type": ""}, {"colour": "#ec7afe", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"6466ddc0-6916-51a4-a694-297a300cfdd8\"", "relationship_type": ""}, {"colour": "#167e41", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"293a8af8-95bf-5a60-9fd1-5261ce8dfc01\"", "relationship_type": ""}, {"colour": "#67880d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"cada2b2e-5bb9-50c2-baa9-931281cdb4da\"", "relationship_type": ""}, {"colour": "#7f67b4", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"5684f76d-1dcd-5ce4-95b4-9a9d3d26bc3d\"", "relationship_type": ""}, {"colour": "#d96ba0", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"a78878fd-ab24-5465-a78d-e63d1f6aa9c5\"", "relationship_type": ""}, {"colour": "#3fdf8e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"85e10e04-66f1-5a89-b31d-18772c539503\"", "relationship_type": ""}, {"colour": "#8ebdec", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2bd2a65d-f22a-5d2e-a1a2-6264f0efec7e\"", "relationship_type": ""}, {"colour": "#028aad", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"76f4c676-64c5-5ee8-bc91-36574c08dada\"", "relationship_type": ""}, {"colour": "#51e64d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"c86a5059-d498-5084-bd88-ee079ef921ad\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"medusa\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}], "info": "AA25-071A Stop Ransomware: Medusa Ransomware", "date": "2025-03-03", "analysis": 0, "threat_level_id": 3, "timestamp": 1741853219}, "e1e99c15-81b9-440f-9bc3-3ce9b3a079c1": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Buying/Renting Fraud\"", "relationship_type": ""}], "info": "Fake trademark-related invoice", "date": "2025-04-07", "analysis": 2, "threat_level_id": 3, "timestamp": 1744025457}, "1f97d8d7-3cbf-406f-b56e-da6876290656": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Palo Alto\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Threat Brief: CVE-2025-31324", "date": "2025-05-12", "analysis": 2, "threat_level_id": 3, "timestamp": 1747036234}, "cc3f6225-ea99-45f8-9cbe-228d77d25ebf": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Void Blizzard\"", "relationship_type": ""}], "info": "OSINT - New Russia-affiliated actor Void Blizzard targets critical sectors for espionage", "date": "2025-06-04", "analysis": 0, "threat_level_id": 3, "timestamp": 1749022636}, "ff2d1e23-caba-4a52-a374-ba223b1e7700": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#fa2a0d", "local": false, "name": "JAG", "relationship_type": ""}], "info": "Malicious File Creates Network Socket and Contacts fdh32fsdfhs.shop - Kunai Analysis Report sample - 2d266ab2597c72424aa21bc00718f9a13e5836e8", "date": "2025-06-20", "analysis": 0, "threat_level_id": 3, "timestamp": 1786895296}, "d9da16a2-8444-45cb-8bb4-d27abf23a261": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#505600", "local": false, "name": "vulnerability:sighting=\"exploited\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"SharPyShell\"", "relationship_type": ""}], "info": "Microsoft SharePoint Server Remote Code Execution Vulnerability - CVE-2025-53770", "date": "2025-07-21", "analysis": 2, "threat_level_id": 1, "timestamp": 1753170196}, "59ed4725-5f2a-4844-8dc4-e6926dbcb5ce": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#079fdf", "local": false, "name": "misp-galaxy:threat-actor=\"APT31\"", "relationship_type": ""}, {"colour": "#10c700", "local": false, "name": "misp-galaxy:threat-actor=\"Emissary Panda\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Storm-2603\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Microsoft\"", "relationship_type": ""}], "info": "OSINT -  Disrupting active exploitation of on-premises SharePoint vulnerabilities", "date": "2025-07-23", "analysis": 2, "threat_level_id": 1, "timestamp": 1753257959}, "11352988-db69-4d22-89fc-6f84689edfab": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"north korea\"", "relationship_type": "attributed-to"}, {"colour": "#c802f6", "local": false, "name": "misp-galaxy:malpedia=\"BeaverTail\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:software=\"BeaverTail\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"InvisibleFerret\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Zscaler\"", "relationship_type": "published-by"}], "info": "OSINT - From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West", "date": "2025-07-30", "analysis": 0, "threat_level_id": 4, "timestamp": 1753866923}, "0e955ede-dd8d-404e-acb4-41f47f79c820": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Microsoft\"", "relationship_type": "published-by"}, {"colour": "#e2c55c", "local": false, "name": "misp-galaxy:threat-actor=\"Turla\"", "relationship_type": "attributed-to"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "attributed-to"}], "info": "OSINT - Frozen in transit: Secret Blizzard\u2019s AiTM campaign against diplomats", "date": "2025-08-01", "analysis": 0, "threat_level_id": 4, "timestamp": 1754035577}, "957de389-e7a6-4e1b-87b3-a7b5e94d3c34": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#13f000", "local": false, "name": "misp-galaxy:threat-actor=\"Operation C-Major\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": ""}, {"colour": "#064d00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Binary Padding - T1027.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "relationship_type": ""}, {"colour": "#064500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": ""}], "info": "Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery", "date": "2025-08-22", "analysis": 2, "threat_level_id": 4, "timestamp": 1755864522}, "24fe9665-88f8-49d9-9d28-2de0020acf48": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "targets"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Exclusive disclosure of the attack activities of the APT group \u201cNightEagle\u201d", "date": "2025-08-27", "analysis": 0, "threat_level_id": 4, "timestamp": 1756277120}, "50d572f9-06d0-4f0b-af1c-3958a5fedefe": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"CISA\"", "relationship_type": ""}, {"colour": "#680600", "local": false, "name": "acs-marking:classification=\"U\"", "relationship_type": ""}, {"colour": "#950900", "local": false, "name": "acs-marking:formal_determination=\"INFORMATION-DIRECTLY-RELATED-TO-CYBERSECURITY-THREAT\"", "relationship_type": ""}, {"colour": "#900900", "local": false, "name": "acs-marking:formal_determination=\"PUBREL\"", "relationship_type": ""}, {"colour": "#640600", "local": false, "name": "acs-marking:privilege_action=\"CISAUSES\"", "relationship_type": ""}, {"colour": "#af9e86", "local": false, "name": "misp-galaxy:stix-2.1-acs-marking=\"080af042-05fb-5fd7-a79e-f39575484fe6\"", "relationship_type": ""}, {"colour": "#291f22", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f33e2054-ba49-5c04-8e57-6dc66a9f2b96\"", "relationship_type": ""}, {"colour": "#762a98", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d403910f-4795-5b3a-83ea-829d77a27ea0\"", "relationship_type": ""}, {"colour": "#6b3d7c", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"70ba8a57-1955-5bfc-b9bb-62d7de6b8a57\"", "relationship_type": ""}, {"colour": "#60420a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"51b1072c-a986-515c-a2fb-bbb2a7241047\"", "relationship_type": ""}, {"colour": "#d171a8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"efddc9d6-9bb0-552e-ac9b-c6499f6049d4\"", "relationship_type": ""}, {"colour": "#232459", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"918216d4-6ac6-54af-bdff-f7fc58bfe9e2\"", "relationship_type": ""}, {"colour": "#1f0360", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2409ed7f-16b5-5b3e-9191-2540d10faaa1\"", "relationship_type": ""}, {"colour": "#e4f98a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f46cd8e2-1948-5483-aabf-5be02c2ad3f3\"", "relationship_type": ""}, {"colour": "#4d8046", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"f110010d-fdee-5f8d-9849-c2b381d1bdd8\"", "relationship_type": ""}, {"colour": "#3f01c8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"569c6e5c-5ee5-5df4-adde-b573d6d7bb53\"", "relationship_type": ""}, {"colour": "#f7c394", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"0ab8bf2c-74aa-5668-a0ab-592ab43a4b44\"", "relationship_type": ""}, {"colour": "#125e83", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"2ddfbe6d-27f8-5169-b3ce-6e503b90bdc0\"", "relationship_type": ""}, {"colour": "#36a604", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d8ce9d6b-d20e-5952-8431-906e9de532d1\"", "relationship_type": ""}, {"colour": "#ce1a94", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"3ecd847f-0bcd-5a46-991d-69fbe586bc5a\"", "relationship_type": ""}, {"colour": "#74fed8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e31867d2-3a33-51e8-b3c5-306fa5d11b63\"", "relationship_type": ""}, {"colour": "#3d43a5", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"c8ce0a29-cef7-56e4-839e-3e8777a96465\"", "relationship_type": ""}, {"colour": "#1d9a65", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"83359dc0-4926-5733-b9af-7418fc56a365\"", "relationship_type": ""}, {"colour": "#cc3b7a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"68aee884-5781-5f90-8931-c2520d9a21c3\"", "relationship_type": ""}, {"colour": "#d5cce8", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"6c0f6d48-24d0-5e78-9bce-0a1b18f54add\"", "relationship_type": ""}, {"colour": "#940268", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"45586a03-735c-5bdf-b135-92cbaa746a9d\"", "relationship_type": ""}, {"colour": "#3827bc", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"bb34d16a-1500-5545-9b98-402a0c0bfc90\"", "relationship_type": ""}, {"colour": "#38b998", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"60852bbe-252a-54f8-8b71-9496f226aeba\"", "relationship_type": ""}, {"colour": "#aeacd0", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"232e039c-3635-57fa-b3e1-3626c06e9a11\"", "relationship_type": ""}, {"colour": "#e15a6c", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"3cb79368-ec7d-582f-ade6-acf8af4343f5\"", "relationship_type": ""}, {"colour": "#a13955", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"b39a0271-a42f-5212-8631-bb51d797da77\"", "relationship_type": ""}, {"colour": "#9c2453", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"9abb14cb-6a76-5d87-ac5c-9213d7f8a59e\"", "relationship_type": ""}, {"colour": "#45badb", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"7708532b-1bb9-5c63-9c21-43db72394cb2\"", "relationship_type": ""}, {"colour": "#b23180", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"b427aaf7-394c-56f0-8fea-4261048b7d9d\"", "relationship_type": ""}, {"colour": "#3b89eb", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"56d63469-4d9f-5acc-9b40-aded774106ad\"", "relationship_type": ""}, {"colour": "#fc8c41", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"be3eba09-8a39-58b2-8bf6-4147da9b7197\"", "relationship_type": ""}, {"colour": "#524d11", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"4dbd048f-d272-596a-ab12-c254d73a9e54\"", "relationship_type": ""}, {"colour": "#14bc3a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e4402575-bd29-5833-831e-4e5ce8e77b5d\"", "relationship_type": ""}, {"colour": "#abf24f", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e5a23a79-7d6c-51b6-8fcd-55acd815ba20\"", "relationship_type": ""}, {"colour": "#697914", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"e963a5a0-2867-560c-9b7f-99e0b339cadf\"", "relationship_type": ""}, {"colour": "#7d263b", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"436dc800-f2e4-536b-9579-795129763964\"", "relationship_type": ""}, {"colour": "#34902a", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"7331b5c1-b945-5ac8-9603-cfd28645b3fd\"", "relationship_type": ""}, {"colour": "#4a2815", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"30927766-94e7-5cd6-98fa-d02abfaead6c\"", "relationship_type": ""}, {"colour": "#c6a04d", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"d2f0ca00-0de6-50fe-bf4a-b7b421c7ae1d\"", "relationship_type": ""}, {"colour": "#8033ff", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"19def47a-a4c5-5b09-9205-65b222bdbeec\"", "relationship_type": ""}, {"colour": "#bd4c9b", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"cd76bf2f-bb26-5f77-8d7d-a4aeb8eb83ba\"", "relationship_type": ""}, {"colour": "#509f5e", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"deaf8eca-b92b-5a03-9271-f1ef7efb25e5\"", "relationship_type": ""}, {"colour": "#40fc13", "local": false, "name": "misp-galaxy:stix-2.1-attack-pattern=\"46bbfd46-eafe-54ca-9650-ab508cc8a674\"", "relationship_type": ""}, {"colour": "#67e136", "local": false, "name": "misp-galaxy:stix-2.1-malware=\"e4ee9d1b-d9fd-504c-8278-e2e52ce42094\"", "relationship_type": ""}, {"colour": "#eda195", "local": false, "name": "misp-galaxy:stix-2.1-malware=\"8b61efeb-dd3d-56ea-8667-97b6513fd2bf\"", "relationship_type": ""}, {"colour": "#239360", "local": false, "name": "misp-galaxy:stix-2.1-malware=\"eae0b645-0737-58da-95d4-5a4b04b0dd1f\"", "relationship_type": ""}, {"colour": "#ec8572", "local": false, "name": "misp-galaxy:stix-2.1-vulnerability=\"f93426c5-b89e-5fdf-977d-09265e0bdf0b\"", "relationship_type": ""}, {"colour": "#89ba7f", "local": false, "name": "misp-galaxy:stix-2.1-vulnerability=\"78b77032-ee11-515e-877b-e5385029b546\"", "relationship_type": ""}, {"colour": "#0669a7", "local": false, "name": "misp-galaxy:stix-2.1-vulnerability=\"95acfe82-0914-5d67-b270-f546746c005d\"", "relationship_type": ""}, {"colour": "#71da2b", "local": false, "name": "misp-galaxy:stix-2.1-vulnerability=\"8df511d1-5504-5bf5-b30e-5457e663ad8d\"", "relationship_type": ""}, {"colour": "#b3f07d", "local": false, "name": "misp-galaxy:stix-2.1-vulnerability=\"689e2082-4edd-59f0-9577-c0fe49a310e2\"", "relationship_type": ""}, {"colour": "#fe0e4b", "local": false, "name": "misp-galaxy:stix-2.1-vulnerability=\"da49a902-2ccc-56f5-a578-c64cfa2a4f3c\"", "relationship_type": ""}, {"colour": "#c6d0a8", "local": false, "name": "misp-galaxy:stix-2.1-location=\"737ef7c9-66ff-5424-92c0-a23790851a89\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "AA25-239A: Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System", "date": "2025-08-29", "analysis": 0, "threat_level_id": 4, "timestamp": 1756476532}, "de0e2e6b-18d8-4237-a852-5877b3ddab58": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Google Cloud Blog\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Instance Metadata API - T1552.005\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Additional Cloud Credentials - T1098.001\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Widespread Data Theft Targets Salesforce Instances via Salesloft Drift", "date": "2025-09-05", "analysis": 2, "threat_level_id": 4, "timestamp": 1757072192}, "1d1eb8f6-bb88-40c3-9f1a-5e13f08646a5": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}], "info": "OSINT - Oracle Security Alert Advisory - CVE-2025-61882", "date": "2025-10-06", "analysis": 2, "threat_level_id": 4, "timestamp": 1759745387}, "3496d16f-84bf-489c-9bc1-95635a9afd36": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#6090c4", "local": false, "name": "misp-galaxy:threat-actor=\"UNC5174\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - Bringing Access Back \u2014 Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect", "date": "2025-10-16", "analysis": 2, "threat_level_id": 4, "timestamp": 1760629191}, "ffcf7530-3c0b-4f7b-af24-e91447a33904": {"Orgc": {"name": "Ransom-ISAC", "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Compressed - T1002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted - T1022\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "HardBit 4.0 Investigation by Reyben Cortes", "date": "2025-10-19", "analysis": 0, "threat_level_id": 4, "timestamp": 1760891104}, "7cd52cc4-93f7-477f-ba7c-7f9d0ea67ea9": {"Orgc": {"name": "Ransom-ISAC", "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"North Korea\"", "relationship_type": ""}, {"colour": "#053a00", "local": true, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": true, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "XCTDH Crypto Heist Part 1 - Ellis Stannard", "date": "2025-10-29", "analysis": 0, "threat_level_id": 4, "timestamp": 1761832917}, "e73730af-7409-4d76-aa96-f174ece74809": {"Orgc": {"name": "Ransom-ISAC", "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Dependencies and Development Tools - T1195.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"North Korea\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "XCTDH Crypto Heist Part 2 - Ellis Stannard", "date": "2025-10-29", "analysis": 0, "threat_level_id": 4, "timestamp": 1761834843}, "cf909fc3-0e55-4962-b462-2219981ea53c": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"ukraine\"", "relationship_type": "targets"}, {"colour": "#fbd57d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Impersonation - T1656\"", "relationship_type": "uses"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"SentinelOne\"", "relationship_type": "published-by"}, {"colour": "#14ff00", "local": false, "name": "misp-galaxy:threat-actor=\"Callisto\"", "relationship_type": "attributed-to"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": ""}], "info": "OSINT - PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation", "date": "2025-11-10", "analysis": 0, "threat_level_id": 4, "timestamp": 1762795586}, "fbf8c6e8-5e74-493f-9699-ec352bcc179c": {"Orgc": {"name": "Ransom-ISAC", "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#302c04", "local": false, "name": "DPRK", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"north korea\"", "relationship_type": "attributed-to"}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "XCTDH Crypto Heist Part 3 - Yashraj Solanki", "date": "2025-11-18", "analysis": 0, "threat_level_id": 4, "timestamp": 1763467869}, "d8317f65-83e6-46ce-b71d-ab452cff7bb1": {"Orgc": {"name": "Ransom-ISAC", "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"}, "Tag": [{"colour": "#BFD806", "local": false, "name": "Shai-Hulud", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Supply Chain Compromise - T1195\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Sha1-Hulud - November 2025", "date": "2025-11-26", "analysis": 0, "threat_level_id": 4, "timestamp": 1764261370}, "fca42bfe-983a-4442-bfb5-5190de9bab09": {"Orgc": {"name": "Ransom-ISAC", "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"}, "Tag": [{"colour": "#109a42", "local": true, "name": "recorded-future:threat-actor=Scattered LAPSUS$ Hunters", "relationship_type": ""}, {"colour": "#ffd890", "local": false, "name": " Ransomware", "relationship_type": ""}, {"colour": "#ff0000", "local": false, "name": "Scattered Spider", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Active Scanning - T1595\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1527\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"scattered lapsus$ hunters\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Salesforce Gainsight Security Advisory - Nov 2025", "date": "2025-11-26", "analysis": 0, "threat_level_id": 4, "timestamp": 1764261431}, "87e34242-cf13-466b-ad52-6e5feb07be4e": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "uses"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Telegram phishing and related activities", "date": "2025-12-08", "analysis": 0, "threat_level_id": 4, "timestamp": 1765185910}, "449f1f02-54d1-4af7-9bd8-beaba99e6d0c": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#cc06d1", "local": false, "name": "misp-galaxy:producer=\"GeminiProduction_CMA\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#640600", "local": false, "name": "acs-marking:privilege_action=\"CISAUSES\"", "relationship_type": ""}, {"colour": "#680600", "local": false, "name": "acs-marking:classification=\"U\"", "relationship_type": ""}, {"colour": "#950900", "local": false, "name": "acs-marking:formal_determination=\"INFORMATION-DIRECTLY-RELATED-TO-CYBERSECURITY-THREAT\"", "relationship_type": ""}, {"colour": "#f029a0", "local": false, "name": "misp-galaxy:stix-2.1-acs-marking=\"736f6810-1f28-5a7d-81b3-f7a498fb7cc8\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "attributed-to"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UTA0178\"", "relationship_type": "attributed-to"}], "info": "BRICKSTORM Backdoor  - MAR-251165.c1.v1", "date": "2025-12-13", "analysis": 2, "threat_level_id": 4, "timestamp": 1765616210}, "9c2ec5f6-afa1-4753-891b-d130b4539648": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"CIRCL\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Other Network Medium - T1438\"", "relationship_type": ""}], "info": "Kunai Analysis Report - Malware Sample Abusing Open Recursive DNS for Exfiltration", "date": "2025-12-15", "analysis": 2, "threat_level_id": 4, "timestamp": 1788367680}, "e94861b3-fefa-4bd2-8113-fa20adeff51d": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#42c6f5", "local": false, "name": "misp-galaxy:country=\"belarus\"", "relationship_type": "attributed-to"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "OSINT - ResidentBat: A new spyware family used by Belarusian KGB", "date": "2025-12-17", "analysis": 2, "threat_level_id": 4, "timestamp": 1765976935}, "5e5bc49f-4007-4921-bfdb-a289e4ef9fde": {"Orgc": {"name": "Ransom-ISAC", "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"}, "Tag": [{"colour": "#0088cc", "local": true, "name": "misp-galaxy:country=\"north korea\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Dependencies and Development Tools - T1195.001\"", "relationship_type": ""}, {"colour": "#053a00", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": ""}, {"colour": "#0088cc", "local": true, "name": "misp-galaxy:target-information=\"North Korea\"", "relationship_type": ""}, {"colour": "#302c04", "local": false, "name": "DPRK", "relationship_type": ""}, {"colour": "#274855", "local": false, "name": "DevPopper", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "XCTDH Crypto Heist Part 4 - Nick Smart and Andrii Sovershennyi", "date": "2025-12-18", "analysis": 0, "threat_level_id": 4, "timestamp": 1766087924}, "99dcce94-8ffe-46a1-97dd-f730519b627e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#bf8e0e", "local": false, "name": "KRVTZ-NET:information-gathering=\"scanner\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ IDS alerts for 2026-01-18", "date": "2026-01-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1768752382}, "65573682-db4d-4731-ae02-2875bc0f1445": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#bf8e0e", "local": false, "name": "KRVTZ-NET:information-gathering=\"scanner\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ IDS alerts for 2026-01-19", "date": "2026-01-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1768861002}, "634c13e8-6852-4624-b02e-b6e74b454a1f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#bf8e0e", "local": false, "name": "KRVTZ-NET:information-gathering=\"scanner\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ IDS alerts for 2026-01-21", "date": "2026-01-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1769039003}, "224cbbd9-d554-4afd-912f-80f318ca280c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#bf8e0e", "local": false, "name": "KRVTZ-NET:information-gathering=\"scanner\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ IDS alerts for 2026-01-23", "date": "2026-01-23", "analysis": 1, "threat_level_id": 3, "timestamp": 1769150197}, "f302f63b-43e3-4a59-aeac-ff1a9ae002c3": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#bf8e0e", "local": false, "name": "KRVTZ-NET:information-gathering=\"scanner\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ IDS alerts for 2026-01-24", "date": "2026-01-24", "analysis": 1, "threat_level_id": 3, "timestamp": 1769298684}, "cf92f9cb-6841-47fe-8d57-9c4caa25c89a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#bf8e0e", "local": false, "name": "KRVTZ-NET:information-gathering=\"scanner\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ IDS alerts for 2026-01-25", "date": "2026-01-25", "analysis": 1, "threat_level_id": 3, "timestamp": 1769380043}, "b7b5de0a-f299-4f8a-91fe-e1a24a2e5d1b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-01-26", "date": "2026-01-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1769471001}, "2c5011bb-8dce-4acc-bc40-f78d0671017f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-01-27", "date": "2026-01-27", "analysis": 1, "threat_level_id": 3, "timestamp": 1769556565}, "6e7e093f-b6be-4fa9-a16d-baf022cd286d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-01-28", "date": "2026-01-28", "analysis": 1, "threat_level_id": 3, "timestamp": 1769634343}, "dc95a8f8-8065-4e0a-afd9-e00a25b84c93": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-01-29", "date": "2026-01-29", "analysis": 1, "threat_level_id": 3, "timestamp": 1769720162}, "69399bdb-b06e-4f2f-b904-0096fa4e7717": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-01-30", "date": "2026-01-30", "analysis": 1, "threat_level_id": 3, "timestamp": 1769806046}, "68fb3161-a747-400c-89a9-32e3c16c353a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-01-31", "date": "2026-01-31", "analysis": 1, "threat_level_id": 3, "timestamp": 1769903755}, "48f1499f-4919-497d-b770-4055b0b71795": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-01", "date": "2026-02-01", "analysis": 1, "threat_level_id": 3, "timestamp": 1769983548}, "2066ce96-461f-4474-a8c9-dc41b8cc4e40": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-02", "date": "2026-02-02", "analysis": 1, "threat_level_id": 3, "timestamp": 1770071795}, "2044a092-7874-4bb1-9664-9bf93c4ed88d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-03", "date": "2026-02-03", "analysis": 1, "threat_level_id": 3, "timestamp": 1770161903}, "dbc619e5-1b69-44c6-81d0-7fb79390bde4": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:microsoft-activity-group=\"STRONTIUM\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-mobile-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-pre-attack-intrusion-set=\"APT28 - G0007\"", "relationship_type": ""}, {"colour": "#12e000", "local": false, "name": "misp-galaxy:threat-actor=\"Sofacy\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "\"Hanger Bulletin\": UAC-0001 (APT28) carries out cyberattacks against Ukraine and EU countries using the exploit CVE-2026-21509 (CERT-UA#19542)", "date": "2026-02-01", "analysis": 0, "threat_level_id": 4, "timestamp": 1770211390}, "f7c90110-c01f-4d3c-81ac-a92e4fb45e2b": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#809daf", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Use Alternate Authentication Material - T1550\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Infrastructure - T1584\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"One-Way Communication - T1102.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Disrupting the World's Largest Residential Proxy Network", "date": "2026-01-29", "analysis": 0, "threat_level_id": 4, "timestamp": 1770211493}, "a857e9fe-d03f-4a78-a9f7-19c0d3ec31f8": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-04", "date": "2026-02-04", "analysis": 1, "threat_level_id": 3, "timestamp": 1770249413}, "c7e9edd3-375b-4058-828b-c9773fc5af6b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-05", "date": "2026-02-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1770335105}, "bd9674e9-efc6-40ca-a1bf-1186337eb168": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-06", "date": "2026-02-06", "analysis": 1, "threat_level_id": 3, "timestamp": 1770407491}, "3379ed68-0a78-4526-874d-4f2a586e14c8": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-07", "date": "2026-02-07", "analysis": 1, "threat_level_id": 3, "timestamp": 1770507827}, "bb82ecf6-227a-4842-a3d1-3a9bcea62c36": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-08", "date": "2026-02-08", "analysis": 1, "threat_level_id": 3, "timestamp": 1770594961}, "98ab93e1-24e2-4e29-82e3-a4c616761583": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-09", "date": "2026-02-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1770675009}, "a0a758a9-ded1-4729-83d9-d2f9e690763e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-10", "date": "2026-02-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1770762498}, "5a83e93a-f6bf-458b-86fc-c224f185e7d2": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Threat Actors Exploiting Ivanti EPMM Vulnerabilities", "date": "2023-08-01", "analysis": 2, "threat_level_id": 4, "timestamp": 1770738395}, "2f438afa-9403-4704-8acc-e22b10849912": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-11", "date": "2026-02-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1770852346}, "a69af19a-8672-4a6f-955e-13d05a6500e0": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-12", "date": "2026-02-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1770927958}, "62ee9654-4c05-4872-a4ac-9a2a7a51bc2c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-13", "date": "2026-02-13", "analysis": 1, "threat_level_id": 3, "timestamp": 1771020836}, "4b924950-2db4-4c18-a6c8-0e1cabafe046": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-14", "date": "2026-02-14", "analysis": 1, "threat_level_id": 3, "timestamp": 1771113244}, "624a5d25-1f81-4919-b066-8ff3a71c7099": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-15", "date": "2026-02-15", "analysis": 1, "threat_level_id": 3, "timestamp": 1771180975}, "643e29d8-3c36-401c-b083-dbb94917c521": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-16", "date": "2026-02-16", "analysis": 1, "threat_level_id": 3, "timestamp": 1771286135}, "eea9862d-1281-44d9-8657-f9e1ff0838f8": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-17", "date": "2026-02-17", "analysis": 1, "threat_level_id": 3, "timestamp": 1771372076}, "0090ebf7-461f-480e-96eb-c3715fa15b5f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-18", "date": "2026-02-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1771446157}, "09642568-6dd1-47f3-8064-7ef4e3b57fc4": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-18", "date": "2026-02-18", "analysis": 2, "threat_level_id": 2, "timestamp": 1771458272}, "dba3bd37-197f-456f-a925-f712bb70dda5": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-19", "date": "2026-02-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1771542397}, "4fe4a80e-39cb-43f1-9e95-9ce5ddd98907": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-19", "date": "2026-02-19", "analysis": 1, "threat_level_id": 2, "timestamp": 1771519018}, "a7d3600c-be93-4b46-8b2e-6957e3297c1a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-20", "date": "2026-02-20", "analysis": 1, "threat_level_id": 3, "timestamp": 1771615090}, "86c24d8c-d787-4278-a266-bbe16f6aba56": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-20", "date": "2026-02-20", "analysis": 1, "threat_level_id": 2, "timestamp": 1771628406}, "08e5c8f3-3b24-4224-8253-2401d873e387": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-21", "date": "2026-02-21", "analysis": 1, "threat_level_id": 2, "timestamp": 1771714808}, "f2f64213-862d-458c-9ec4-23188c2b8846": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-21", "date": "2026-02-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1771716019}, "62fda2ec-e5d4-4428-afb6-1f0d3a55ec12": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-22", "date": "2026-02-22", "analysis": 1, "threat_level_id": 2, "timestamp": 1771783457}, "fd861729-2897-4cd2-a2d4-c7918f649e75": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-22", "date": "2026-02-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1771803216}, "357a3a25-95f9-41b7-8870-9cc54d260d69": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-23", "date": "2026-02-23", "analysis": 1, "threat_level_id": 2, "timestamp": 1776351763}, "ba6eb2c8-966a-4aa9-891a-491968e19b68": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-23", "date": "2026-02-23", "analysis": 1, "threat_level_id": 3, "timestamp": 1771871400}, "b0a9ddc2-de1c-49cb-a8b5-2cd8803e7c35": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-24", "date": "2026-02-24", "analysis": 1, "threat_level_id": 2, "timestamp": 1771966807}, "b343e55a-539a-44df-97dd-c72ca2497416": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-24", "date": "2026-02-24", "analysis": 1, "threat_level_id": 3, "timestamp": 1771943632}, "6af94a64-39c8-4066-a702-7ad7b9cc5cdd": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-25", "date": "2026-02-25", "analysis": 1, "threat_level_id": 2, "timestamp": 1772056877}, "cd0ed0b8-91fb-412b-ba3f-d73618b29cea": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-25", "date": "2026-02-25", "analysis": 1, "threat_level_id": 3, "timestamp": 1772034791}, "9291457f-54be-4e1d-b239-3562e18112d7": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-26", "date": "2026-02-26", "analysis": 1, "threat_level_id": 2, "timestamp": 1772125211}, "63e77936-f8bb-4fb2-af2a-3e00b0dd92e6": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-26", "date": "2026-02-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1772090832}, "9a8e444f-c5a6-4e6f-b99b-03ee771a1c03": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-27", "date": "2026-02-27", "analysis": 1, "threat_level_id": 3, "timestamp": 1772208724}, "9e0caac4-8305-4eef-89de-4f96622aef35": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-02-28", "date": "2026-02-28", "analysis": 1, "threat_level_id": 2, "timestamp": 1772319798}, "9aca983c-4cf1-4f4a-a6d7-2eb75b21c1db": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-02-28", "date": "2026-02-28", "analysis": 1, "threat_level_id": 3, "timestamp": 1772257651}, "f03c756e-d0d0-484c-a8b9-85ab0dc2a2eb": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-01", "date": "2026-03-01", "analysis": 1, "threat_level_id": 2, "timestamp": 1772398808}, "af1f38df-baea-44ce-a058-a9417950ff76": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-01", "date": "2026-03-01", "analysis": 1, "threat_level_id": 3, "timestamp": 1772340982}, "fa6aa843-efeb-47d1-aeb4-37679b1ae471": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-02", "date": "2026-03-02", "analysis": 1, "threat_level_id": 2, "timestamp": 1772488806}, "4bdef18a-9879-4e17-b3ff-cb8ed88ef7ef": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-02", "date": "2026-03-02", "analysis": 1, "threat_level_id": 3, "timestamp": 1772494743}, "a1ddf106-025e-438c-947d-202ded0ee395": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#054300", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Generation Algorithms - T1568.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Name or Location - T1036.005\"", "relationship_type": ""}, {"colour": "#065100", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify System Firewall - T1562.004\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "Fake 7-Zip downloads are turning home PCs into proxy nodes", "date": "2026-02-12", "analysis": 0, "threat_level_id": 4, "timestamp": 1772440113}, "f88ee265-c1d6-4642-824a-986dae80c7b6": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"datacarry\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Civil Aviation\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Education\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Finance\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Health\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Insurance\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Legal\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Pharmacy\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Sport\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Technology\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Tourism\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": ""}, {"colour": "#065000", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": ""}, {"colour": "#909609", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"belgium\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"denmark\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"france\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"greece\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"italy\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"lithuania\"", "relationship_type": "targets"}, {"colour": "#c05590", "local": false, "name": "misp-galaxy:country=\"south africa\"", "relationship_type": "targets"}, {"colour": "#23f697", "local": false, "name": "misp-galaxy:country=\"spain\"", "relationship_type": "targets"}, {"colour": "#c6e2d5", "local": false, "name": "misp-galaxy:country=\"sweden\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"switzerland\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"turkey\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united kingdom\"", "relationship_type": "targets"}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}], "info": "PFCloud \u00b7 Bulletproof Hosting \u00b7 Datacarry Ransomware", "date": "2026-02-18", "analysis": 0, "threat_level_id": 4, "timestamp": 1772455068}, "6d3070b9-a5c3-4553-8941-341f3594ad6d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-03", "date": "2026-03-03", "analysis": 1, "threat_level_id": 2, "timestamp": 1772571633}, "f5aa21c5-f9e1-4c6d-a67c-69b1b16585a3": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-03", "date": "2026-03-03", "analysis": 1, "threat_level_id": 3, "timestamp": 1772582109}, "1a7bb6df-0e3f-4ae3-9329-bfe19436ba3e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-04", "date": "2026-03-04", "analysis": 1, "threat_level_id": 2, "timestamp": 1772654406}, "e8512dd1-7ba4-4bd6-9f65-8f4080963481": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-04", "date": "2026-03-04", "analysis": 1, "threat_level_id": 3, "timestamp": 1772611874}, "8fc3c0c8-f8e9-497d-9109-a6ec8c562f07": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-05", "date": "2026-03-05", "analysis": 1, "threat_level_id": 2, "timestamp": 1781600870}, "579f51f8-43f6-4663-87ef-1fbd81b01783": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-05", "date": "2026-03-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1772755033}, "aed7456d-ab11-46a3-90af-5819628f7a0c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-06", "date": "2026-03-06", "analysis": 1, "threat_level_id": 2, "timestamp": 1772838036}, "512f6af2-9a7f-486f-b70b-d5eed26baa05": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-06", "date": "2026-03-06", "analysis": 1, "threat_level_id": 3, "timestamp": 1772829001}, "1a4c6b9d-cb3e-47b7-881a-67cd97bd146d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-07", "date": "2026-03-07", "analysis": 1, "threat_level_id": 2, "timestamp": 1772920806}, "87a2315c-9fa4-4086-937c-cda9d4c37070": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-07", "date": "2026-03-07", "analysis": 1, "threat_level_id": 3, "timestamp": 1772914090}, "59b761e9-9482-40c2-86f4-3afbca62f405": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-08", "date": "2026-03-08", "analysis": 1, "threat_level_id": 2, "timestamp": 1773007207}, "55fa811a-1e71-4c53-8452-b4271ee8f437": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-08", "date": "2026-03-08", "analysis": 1, "threat_level_id": 3, "timestamp": 1772960772}, "149601cb-8422-4639-8140-03e3b692598b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-09", "date": "2026-03-09", "analysis": 1, "threat_level_id": 2, "timestamp": 1773082810}, "55ad908f-0ce1-4273-bc64-0c1fdf7a4c58": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-09", "date": "2026-03-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1773091497}, "398d73ec-12fc-45d0-97d4-34dc6b9eed69": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-10", "date": "2026-03-10", "analysis": 1, "threat_level_id": 2, "timestamp": 1773180008}, "84583090-1208-4396-8799-145bbe0017a2": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-10", "date": "2026-03-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1773183479}, "cd114f15-0701-4df4-aec4-7d4aedece4b6": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-11", "date": "2026-03-11", "analysis": 1, "threat_level_id": 2, "timestamp": 1773262815}, "90f5a047-a666-42c7-8c2e-221783840c90": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-11", "date": "2026-03-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1773266844}, "50a92044-100a-483c-91fa-21439acde32f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-12", "date": "2026-03-12", "analysis": 1, "threat_level_id": 2, "timestamp": 1773342006}, "e23fbd54-096a-4de1-8288-e17eb68f04c9": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-12", "date": "2026-03-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1773356202}, "63adc937-9506-463f-9d28-ec2e3ac56093": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-13", "date": "2026-03-13", "analysis": 1, "threat_level_id": 2, "timestamp": 1773442814}, "d6292c9e-e1c1-4697-8a72-3d50562a29bb": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-13", "date": "2026-03-13", "analysis": 1, "threat_level_id": 3, "timestamp": 1773435140}, "2bd1fa00-6450-479c-9387-3a7fcb5e15a9": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0087e8", "local": false, "name": "osint:certainty=\"50\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"KadNap\"", "relationship_type": ""}], "info": "KadNap botnet IOC (mainly Asus router)", "date": "2026-03-13", "analysis": 2, "threat_level_id": 3, "timestamp": 1773398318}, "4bd4cda9-58b5-4b5a-a047-96bbc62113f5": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-14", "date": "2026-03-14", "analysis": 1, "threat_level_id": 2, "timestamp": 1773529299}, "14501f7e-9084-4cba-8229-66baead78066": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-14", "date": "2026-03-14", "analysis": 1, "threat_level_id": 3, "timestamp": 1773529608}, "878f5b33-0fcf-4191-8295-4bcddeb6437a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-15", "date": "2026-03-15", "analysis": 1, "threat_level_id": 2, "timestamp": 1773608408}, "ce16d00f-4641-4e62-a2ec-e3758563d0d8": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-15", "date": "2026-03-15", "analysis": 1, "threat_level_id": 3, "timestamp": 1773615049}, "debce8d5-cb0e-4413-9917-816a04a1373b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-16", "date": "2026-03-16", "analysis": 1, "threat_level_id": 2, "timestamp": 1773694808}, "5aa113c1-5752-430d-b67d-d5887d2d4b54": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-16", "date": "2026-03-16", "analysis": 1, "threat_level_id": 3, "timestamp": 1773698157}, "a1e436cc-7d82-4c1f-8e18-912cb5b1dc7d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-17", "date": "2026-03-17", "analysis": 1, "threat_level_id": 2, "timestamp": 1773777611}, "7858221a-56da-42be-aa09-0421e6e5c04c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-17", "date": "2026-03-17", "analysis": 1, "threat_level_id": 3, "timestamp": 1773780945}, "136a6440-ade6-4da3-aea0-d80e65d7af94": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-18", "date": "2026-03-18", "analysis": 1, "threat_level_id": 2, "timestamp": 1773871207}, "21c6f416-d1c2-4a84-8ebb-c189b4bf5c5d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-18", "date": "2026-03-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1773875425}, "494223a4-ec5f-415c-b59f-bc03ad2e713a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-19", "date": "2026-03-19", "analysis": 1, "threat_level_id": 2, "timestamp": 1773950411}, "fae52194-82fe-4f1b-9569-81228fb53d04": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-19", "date": "2026-03-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1773951312}, "150c533e-552d-4e7f-8894-9d9ecf852a72": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-20", "date": "2026-03-20", "analysis": 1, "threat_level_id": 2, "timestamp": 1774047613}, "48116205-bffa-4db1-b520-1062c73d5973": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-20", "date": "2026-03-20", "analysis": 1, "threat_level_id": 3, "timestamp": 1774028429}, "b8ef1b56-3e16-4f06-9c11-d1e0a7586332": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-21", "date": "2026-03-21", "analysis": 1, "threat_level_id": 2, "timestamp": 1774130403}, "a6519a9a-fe46-4462-bd71-8264f4d1acdc": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-21", "date": "2026-03-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1774102474}, "21303d8f-49bc-4516-9fc4-39d829d7c08e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-22", "date": "2026-03-22", "analysis": 1, "threat_level_id": 2, "timestamp": 1774209604}, "c363da9b-daf2-4390-9810-f1ae58ba170b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-22", "date": "2026-03-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1774192488}, "d6ee1a04-c309-40b8-a454-852150a1baf9": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-23", "date": "2026-03-23", "analysis": 1, "threat_level_id": 2, "timestamp": 1774299615}, "c3345562-2945-459e-bbb9-9bbec7e35e32": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-23", "date": "2026-03-23", "analysis": 1, "threat_level_id": 3, "timestamp": 1774304806}, "d1412427-b81f-4ad5-be0f-bb404d448aeb": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-24", "date": "2026-03-24", "analysis": 1, "threat_level_id": 2, "timestamp": 1774386004}, "41427363-7464-4678-b0cf-be384fb8a7bb": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-24", "date": "2026-03-24", "analysis": 1, "threat_level_id": 3, "timestamp": 1774395883}, "c3a6a834-b558-4d12-85a5-eacbdb26d643": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-25", "date": "2026-03-25", "analysis": 1, "threat_level_id": 2, "timestamp": 1774468806}, "eafb322b-a441-41e0-935c-f53441f8a804": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-25", "date": "2026-03-25", "analysis": 1, "threat_level_id": 3, "timestamp": 1774475233}, "6fdcdd1d-9fcd-4a3a-996f-ffa09c16065a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-26", "date": "2026-03-26", "analysis": 1, "threat_level_id": 2, "timestamp": 1774558817}, "dfb24218-0b28-4a3f-9947-2b4bf68f7768": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-26", "date": "2026-03-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1774556226}, "bbd0d66e-6b80-4b31-8708-a8826ce91d07": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-27", "date": "2026-03-27", "analysis": 1, "threat_level_id": 2, "timestamp": 1782540498}, "bdd34a3d-476b-4ded-9ab7-14efd69cbf2b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-27", "date": "2026-03-27", "analysis": 1, "threat_level_id": 3, "timestamp": 1774630153}, "ee03b6e0-c469-44df-8426-42e513ab682d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-28", "date": "2026-03-28", "analysis": 1, "threat_level_id": 2, "timestamp": 1774738807}, "8922ef99-4522-483e-853b-5b10d447e16f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-28", "date": "2026-03-28", "analysis": 1, "threat_level_id": 3, "timestamp": 1774741314}, "dbd5afe9-55bd-43da-8721-56c54d89b351": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-03-29", "date": "2026-03-29", "analysis": 1, "threat_level_id": 2, "timestamp": 1774810804}, "52b2eb89-f08a-4dc8-8993-ef4042e00add": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-29", "date": "2026-03-29", "analysis": 1, "threat_level_id": 3, "timestamp": 1774819754}, "dedc7d36-0fcf-4653-ab81-2f9880a00f26": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-30", "date": "2026-03-30", "analysis": 1, "threat_level_id": 3, "timestamp": 1774902675}, "8474278c-7d9a-4246-b029-979a9243cc01": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-03-31", "date": "2026-03-31", "analysis": 1, "threat_level_id": 3, "timestamp": 1774935196}, "0751fd85-ecbb-4204-8d19-2b662950290c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-02", "date": "2026-04-02", "analysis": 1, "threat_level_id": 2, "timestamp": 1775152849}, "7c9cc102-0241-4810-91fc-34953d8be409": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-03", "date": "2026-04-02", "analysis": 1, "threat_level_id": 2, "timestamp": 1775228409}, "d94d0ee5-923f-4ee2-a9bb-6daff7c10daf": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-03", "date": "2026-04-03", "analysis": 1, "threat_level_id": 3, "timestamp": 1775255906}, "d7cd0f75-3f3e-4c1e-8ee6-bdaf92aeffba": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-04", "date": "2026-04-03", "analysis": 1, "threat_level_id": 2, "timestamp": 1775336411}, "7fd49ba7-d26a-4c27-9073-c44dff263e9c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-04", "date": "2026-04-04", "analysis": 1, "threat_level_id": 3, "timestamp": 1775341670}, "4fe01c50-d249-4c4e-a5c7-624aaa0c173b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-05", "date": "2026-04-04", "analysis": 1, "threat_level_id": 2, "timestamp": 1775419203}, "cfd35589-baba-4335-92d7-ee5bc0f773a9": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-05", "date": "2026-04-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1775429952}, "e16fa7b3-35d5-44a6-8274-439e29874a95": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-06", "date": "2026-04-06", "analysis": 1, "threat_level_id": 3, "timestamp": 1775505707}, "e4635f7f-a3e2-4b68-932b-44411b27ae88": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-07", "date": "2026-04-06", "analysis": 1, "threat_level_id": 2, "timestamp": 1775592011}, "0833fc76-616b-4182-9069-ca67c5b62de6": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-07", "date": "2026-04-07", "analysis": 1, "threat_level_id": 3, "timestamp": 1775581255}, "d4f73963-1064-40a8-ba8d-b64f253d0f5f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-08", "date": "2026-04-08", "analysis": 1, "threat_level_id": 3, "timestamp": 1775661402}, "71dd1c3a-650d-4941-a6c8-3de925ff4b0a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-09", "date": "2026-04-08", "analysis": 1, "threat_level_id": 2, "timestamp": 1775746818}, "026b6c1d-c2ca-41fa-8348-5f1c7dcd1ac1": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-09", "date": "2026-04-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1775768845}, "b544b646-11bb-49fc-9b5e-7b9afb8c276f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-10", "date": "2026-04-09", "analysis": 1, "threat_level_id": 2, "timestamp": 1775844007}, "d1f3f5db-8c74-4d18-8a9e-6af7137bc92c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-10", "date": "2026-04-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1775835550}, "08d290e0-3409-4766-843b-042d364b2187": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-11", "date": "2026-04-10", "analysis": 1, "threat_level_id": 2, "timestamp": 1775944812}, "749f284d-1c60-44fe-a46e-4dbbecd4c9f1": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-11", "date": "2026-04-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1775943282}, "2cd4314d-02e5-440d-9c30-374dc6ebec21": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-12", "date": "2026-04-11", "analysis": 1, "threat_level_id": 2, "timestamp": 1776027619}, "78407fea-a3a8-4ecf-b340-d1c5a3afade9": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-12", "date": "2026-04-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1776032869}, "a9ea16b8-6c9c-4e74-b57f-90fae43f6485": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-13", "date": "2026-04-12", "analysis": 1, "threat_level_id": 2, "timestamp": 1776111036}, "684e874a-e143-4927-a9ac-b8cddfc06861": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-13", "date": "2026-04-13", "analysis": 1, "threat_level_id": 3, "timestamp": 1776083287}, "9ffc0252-dcd2-4cab-96ec-b93c6f888ae4": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-14", "date": "2026-04-13", "analysis": 1, "threat_level_id": 2, "timestamp": 1776196824}, "258b6ca9-17fb-4cf0-b5b0-332ce65f0ce0": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-14", "date": "2026-04-14", "analysis": 1, "threat_level_id": 3, "timestamp": 1776188992}, "e1b629a9-1476-4830-a5ee-83b601e05ff3": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-15", "date": "2026-04-14", "analysis": 1, "threat_level_id": 2, "timestamp": 1776286851}, "ca0fca19-acbf-4442-9463-2a64455b763a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-15", "date": "2026-04-15", "analysis": 1, "threat_level_id": 3, "timestamp": 1776230304}, "40b63ce6-f62b-43ba-a695-7e02006db7c8": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-16", "date": "2026-04-15", "analysis": 1, "threat_level_id": 2, "timestamp": 1776369608}, "a53dc34b-20e4-47a5-ba4f-6df457de4077": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-16", "date": "2026-04-16", "analysis": 1, "threat_level_id": 3, "timestamp": 1776361984}, "e01c3382-0750-4036-9299-c508d322df77": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-17", "date": "2026-04-16", "analysis": 1, "threat_level_id": 2, "timestamp": 1776463203}, "52e19573-cf07-4e06-bf85-7d14b4b230bd": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-17", "date": "2026-04-17", "analysis": 1, "threat_level_id": 3, "timestamp": 1776442034}, "19cf13ab-8026-42da-82d0-5a856e1d479a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-18", "date": "2026-04-17", "analysis": 1, "threat_level_id": 2, "timestamp": 1776550090}, "610ab7a5-3aa4-4076-9a1e-c40ca05d1096": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-18", "date": "2026-04-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1776551902}, "56ae8c9e-093c-4aa1-b82b-bedd4d7535c2": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-19", "date": "2026-04-18", "analysis": 1, "threat_level_id": 2, "timestamp": 1776628985}, "dea5f4a1-4379-490f-af54-a23635ce1fbd": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-19", "date": "2026-04-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1776636367}, "edd72f39-6e90-4bde-aae0-387e18cbc015": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-20", "date": "2026-04-19", "analysis": 1, "threat_level_id": 2, "timestamp": 1776715206}, "07cbee90-85e6-4b82-85d3-cf7afc0ec3d7": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-20", "date": "2026-04-20", "analysis": 1, "threat_level_id": 3, "timestamp": 1776709438}, "7f785788-f3a8-423a-8cf9-ec8480772460": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-21", "date": "2026-04-20", "analysis": 1, "threat_level_id": 2, "timestamp": 1776805207}, "f557b7b4-ac80-4aa3-8250-913559a23027": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-21", "date": "2026-04-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1776811111}, "ac521fad-b190-4293-9247-222762644fb7": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-22", "date": "2026-04-21", "analysis": 1, "threat_level_id": 2, "timestamp": 1776895228}, "d75bfa4f-06c8-4cb0-a857-f93bf5f000f9": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-22", "date": "2026-04-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1776893483}, "465b76fb-42e4-4a02-b5fd-95d4a0e0cb5a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-23", "date": "2026-04-22", "analysis": 1, "threat_level_id": 2, "timestamp": 1776981609}, "6061a3af-10dd-41f5-a360-81e0e819473f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-23", "date": "2026-04-23", "analysis": 1, "threat_level_id": 3, "timestamp": 1776967644}, "71a0be23-b18e-4fb0-91fe-69a0ff3b53e3": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-24", "date": "2026-04-23", "analysis": 1, "threat_level_id": 2, "timestamp": 1782540432}, "66576149-c3e4-4fdd-ac70-efb204c5d5f6": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-24", "date": "2026-04-24", "analysis": 1, "threat_level_id": 3, "timestamp": 1777065346}, "41c6badd-b26b-40f1-bee9-8ac50593d892": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-25", "date": "2026-04-24", "analysis": 1, "threat_level_id": 2, "timestamp": 1777154405}, "23defe04-475b-4888-9033-d3fcf9d262e0": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-25", "date": "2026-04-25", "analysis": 1, "threat_level_id": 3, "timestamp": 1777157031}, "7fb56db4-d93d-4e94-84d0-ff0c41d703dc": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-26", "date": "2026-04-25", "analysis": 1, "threat_level_id": 2, "timestamp": 1777240804}, "1b6ec04b-4030-4a12-b1b3-b483874dff6b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-26", "date": "2026-04-26", "analysis": 1, "threat_level_id": 3, "timestamp": 1777241988}, "33f918d7-18b1-4726-8e7d-0bf424b7dd63": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-27", "date": "2026-04-26", "analysis": 1, "threat_level_id": 2, "timestamp": 1777320002}, "3c8177db-2006-4a46-82a4-2653c6a866b7": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-27", "date": "2026-04-27", "analysis": 1, "threat_level_id": 3, "timestamp": 1777321455}, "b386637f-dd0a-4e97-ba8e-911ad76270d5": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-28", "date": "2026-04-27", "analysis": 1, "threat_level_id": 2, "timestamp": 1777413607}, "234a16f3-81b8-4d63-bfec-3918de7d64a3": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-28", "date": "2026-04-28", "analysis": 1, "threat_level_id": 3, "timestamp": 1777385249}, "ce22ab1e-7841-448d-8420-2fb8986d03b2": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-29", "date": "2026-04-28", "analysis": 1, "threat_level_id": 2, "timestamp": 1777489236}, "e28d0d7f-1857-4a10-b2a8-440755c1a522": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-29", "date": "2026-04-29", "analysis": 1, "threat_level_id": 3, "timestamp": 1777497244}, "51c47e73-03bc-444b-91f4-1293c8a3a082": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-04-30", "date": "2026-04-29", "analysis": 1, "threat_level_id": 2, "timestamp": 1777582813}, "096a3ffb-66fc-42cc-8038-cbeb2acdee6f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-04-30", "date": "2026-04-30", "analysis": 1, "threat_level_id": 3, "timestamp": 1777572900}, "f9186f67-0632-4896-865a-6d5892a87f84": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-01", "date": "2026-04-30", "analysis": 1, "threat_level_id": 2, "timestamp": 1777672814}, "563ffbb5-30f9-48d0-ab91-a0e795b2f434": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-01", "date": "2026-05-01", "analysis": 1, "threat_level_id": 3, "timestamp": 1777668743}, "4c9bb553-9aa3-41b3-ae8b-ffdd075ae910": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-02", "date": "2026-05-01", "analysis": 1, "threat_level_id": 2, "timestamp": 1777755608}, "9a3f60f4-addd-48ed-b450-5ca6cf4c4c0f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-02", "date": "2026-05-02", "analysis": 1, "threat_level_id": 3, "timestamp": 1777762463}, "a6ef797d-7223-409b-88bd-30bd3fafed2c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-03", "date": "2026-05-02", "analysis": 1, "threat_level_id": 2, "timestamp": 1777845907}, "66b89ee8-d7ca-43e4-a8a2-384296da4415": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-03", "date": "2026-05-03", "analysis": 1, "threat_level_id": 3, "timestamp": 1777848315}, "905c13e3-96bb-44a4-9e41-1ff9e2fd63bf": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-04", "date": "2026-05-03", "analysis": 1, "threat_level_id": 2, "timestamp": 1779208502}, "d1e8e75d-81de-4b4b-857f-a52b33a23ea7": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-04", "date": "2026-05-04", "analysis": 1, "threat_level_id": 3, "timestamp": 1777934322}, "4db752e8-4cf1-429b-afd6-209df464146c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-05", "date": "2026-05-04", "analysis": 1, "threat_level_id": 2, "timestamp": 1778014809}, "7994001e-b68e-4740-991a-27a703eef241": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-05", "date": "2026-05-05", "analysis": 1, "threat_level_id": 3, "timestamp": 1777970423}, "18fe8d57-6f89-4001-9500-7b26c0f50c8b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-06", "date": "2026-05-05", "analysis": 1, "threat_level_id": 2, "timestamp": 1778104809}, "6202358f-37d4-4f3b-8a89-faec9ceeb909": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-07", "date": "2026-05-06", "analysis": 1, "threat_level_id": 2, "timestamp": 1778191206}, "cfc1b9bc-c831-4397-981c-30ab074b7f98": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-07", "date": "2026-05-07", "analysis": 1, "threat_level_id": 3, "timestamp": 1778193056}, "63f01919-4cf7-4dfd-a11f-3b4bcf2a5ab1": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-08", "date": "2026-05-07", "analysis": 1, "threat_level_id": 2, "timestamp": 1778277686}, "7340f95b-bdcb-4bc1-826e-954acdfe755a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-08", "date": "2026-05-08", "analysis": 1, "threat_level_id": 3, "timestamp": 1778272181}, "b7e3734d-8081-44f7-9867-29a1d7ab1b98": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-09", "date": "2026-05-08", "analysis": 1, "threat_level_id": 2, "timestamp": 1778356853}, "1f8e5bfc-802a-416d-a769-2581dcefad74": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-09", "date": "2026-05-09", "analysis": 1, "threat_level_id": 3, "timestamp": 1778365788}, "64de6b82-8870-44ff-8fa5-18d75f2ee5ad": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-10", "date": "2026-05-09", "analysis": 1, "threat_level_id": 2, "timestamp": 1778443203}, "cfe40aca-79f9-4945-94c2-9a7f732cc14a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-10", "date": "2026-05-10", "analysis": 1, "threat_level_id": 3, "timestamp": 1778452212}, "a3a7047b-015c-48ef-a1f5-03d8fc75d725": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-11", "date": "2026-05-11", "analysis": 1, "threat_level_id": 3, "timestamp": 1778456774}, "9c8f9b1a-c54e-44c3-b2ae-ff204ef2b09a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-12", "date": "2026-05-12", "analysis": 1, "threat_level_id": 3, "timestamp": 1778626535}, "504dd707-68e4-4636-9c36-94ad505e666c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-13", "date": "2026-05-13", "analysis": 1, "threat_level_id": 3, "timestamp": 1778708843}, "aa4fa6cc-5136-4256-bff7-dd5b82110114": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-14", "date": "2026-05-14", "analysis": 1, "threat_level_id": 3, "timestamp": 1778751235}, "a56de1cb-027a-4b49-be18-e0cff3ba8118": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-15", "date": "2026-05-14", "analysis": 1, "threat_level_id": 2, "timestamp": 1778878817}, "4f31c24b-8337-45f1-b3d9-c342dac5b5b4": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-15", "date": "2026-05-15", "analysis": 1, "threat_level_id": 3, "timestamp": 1778876349}, "c54b54f3-6385-4bba-8199-572afe1202a8": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-16", "date": "2026-05-15", "analysis": 1, "threat_level_id": 2, "timestamp": 1778968807}, "07c75420-0a1d-4db8-9785-67ad6c55efe7": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-16", "date": "2026-05-16", "analysis": 1, "threat_level_id": 3, "timestamp": 1778967227}, "6b353c07-62b4-4e43-8c4b-44bf0e52f2fe": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-17", "date": "2026-05-16", "analysis": 1, "threat_level_id": 2, "timestamp": 1779044406}, "e254b51f-abab-43cf-b069-d1cdd0646bbb": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-17", "date": "2026-05-17", "analysis": 1, "threat_level_id": 3, "timestamp": 1779054729}, "50844ee8-3e79-4e60-a7c4-a98f68856e9b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-18", "date": "2026-05-17", "analysis": 1, "threat_level_id": 2, "timestamp": 1779138003}, "53cc7d43-7ad8-4652-b2d8-13c7648b3050": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-18", "date": "2026-05-18", "analysis": 1, "threat_level_id": 3, "timestamp": 1779142371}, "d86076f8-7b9d-45eb-ad26-5f6f64282a9b": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-19", "date": "2026-05-18", "analysis": 1, "threat_level_id": 2, "timestamp": 1779228007}, "d5a1fc6c-990a-4fc4-84f8-fb5bc35116a1": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-19", "date": "2026-05-19", "analysis": 1, "threat_level_id": 3, "timestamp": 1779229146}, "10c39115-7be2-45d1-884f-8125733c1b92": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-20", "date": "2026-05-19", "analysis": 1, "threat_level_id": 2, "timestamp": 1779314408}, "bcd222e6-4fd6-4cdd-81d2-1434cd4603ff": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-20", "date": "2026-05-20", "analysis": 1, "threat_level_id": 3, "timestamp": 1779316402}, "f448167c-10a0-4757-b348-873d680bfdf9": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-21", "date": "2026-05-20", "analysis": 1, "threat_level_id": 2, "timestamp": 1779393605}, "14bc5133-b7b6-46b8-9953-d849b5cb340c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-21", "date": "2026-05-21", "analysis": 1, "threat_level_id": 3, "timestamp": 1779401901}, "f90aad37-a87e-430c-a410-3dca0a5a9dd4": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-22", "date": "2026-05-21", "analysis": 1, "threat_level_id": 2, "timestamp": 1779487219}, "ffe55eab-e7eb-4db5-9850-3df828ada392": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-22", "date": "2026-05-22", "analysis": 1, "threat_level_id": 3, "timestamp": 1779490171}, "c124c2a5-e3d7-4edf-bb8f-3de9bc35834a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-23", "date": "2026-05-22", "analysis": 1, "threat_level_id": 2, "timestamp": 1779573612}, "59c34b85-6f36-4f39-959c-b2bb8d09112a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-23", "date": "2026-05-23", "analysis": 1, "threat_level_id": 3, "timestamp": 1779572993}, "7855419c-51d9-4583-acd9-a6aa8e30d61e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-24", "date": "2026-05-23", "analysis": 1, "threat_level_id": 2, "timestamp": 1779656444}, "d8158bee-eadb-4219-b9b6-99e0bdf9564a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-05-24", "date": "2026-05-24", "analysis": 1, "threat_level_id": 3, "timestamp": 1779653586}, "ee072c55-80ac-4de0-a589-d9f179a82efd": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-25", "date": "2026-05-24", "analysis": 1, "threat_level_id": 2, "timestamp": 1779739274}, "7fd6bbec-320e-48c5-b09d-79519e533f11": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-26", "date": "2026-05-25", "analysis": 1, "threat_level_id": 2, "timestamp": 1779832911}, "9a4ef3c0-d447-4f61-b72c-46d3acbbb1d2": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-27", "date": "2026-05-26", "analysis": 1, "threat_level_id": 2, "timestamp": 1779912007}, "92b12a00-26ca-4092-a480-fece3ad6f9d5": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-28", "date": "2026-05-27", "analysis": 1, "threat_level_id": 2, "timestamp": 1780002027}, "a03acbf1-881f-4cb3-884b-360fa93e141e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-29", "date": "2026-05-28", "analysis": 1, "threat_level_id": 2, "timestamp": 1780092009}, "73a87b4e-9bc9-48c2-bf1d-bca9bc5827fc": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-30", "date": "2026-05-29", "analysis": 1, "threat_level_id": 2, "timestamp": 1780385776}, "48f67453-ca57-4770-8c63-dc82595f3e0e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-05-31", "date": "2026-05-30", "analysis": 1, "threat_level_id": 2, "timestamp": 1780257622}, "e23472df-ca0e-42e3-a1d8-903fef202593": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-01", "date": "2026-05-31", "analysis": 1, "threat_level_id": 2, "timestamp": 1780344011}, "10a94632-a0a1-4062-a3a5-95fe321ae045": {"Orgc": {"name": "CIRCL", "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"}, "Tag": [{"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:white", "relationship_type": ""}, {"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Phishing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:financial-fraud=\"Mobile Fraud\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"", "relationship_type": ""}, {"colour": "#0073de", "local": false, "name": "phishing:psychological-acceptability=\"high\"", "relationship_type": ""}, {"colour": "#002f5a", "local": false, "name": "phishing:techniques=\"sms-phishing\"", "relationship_type": ""}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"luxembourg\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Hospitality\"", "relationship_type": "targets"}, {"colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Hotels\"", "relationship_type": "targets"}], "info": "Phishing Campaign Targeting Hotel Customers in Luxembourg", "date": "2026-06-01", "analysis": 1, "threat_level_id": 3, "timestamp": 1780658606}, "87f831ba-5e47-4210-b79a-d733f70f4a00": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-02", "date": "2026-06-01", "analysis": 1, "threat_level_id": 2, "timestamp": 1780430409}, "f828f058-5a81-4142-a0b3-b47e28c71e2a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-03", "date": "2026-06-02", "analysis": 1, "threat_level_id": 2, "timestamp": 1781107849}, "503001ee-8340-416d-b1a7-a72e79b0ba8f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-04", "date": "2026-06-03", "analysis": 1, "threat_level_id": 2, "timestamp": 1780603206}, "e3b7f367-0435-43a2-b1d3-f4a696cfeaea": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-05", "date": "2026-06-04", "analysis": 1, "threat_level_id": 2, "timestamp": 1780693209}, "031fb9c1-32e9-4363-aa51-6f4df779cb14": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-06", "date": "2026-06-05", "analysis": 1, "threat_level_id": 2, "timestamp": 1784275239}, "04bacec9-88d5-4088-b1ba-f4c581df4bc1": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-07", "date": "2026-06-06", "analysis": 1, "threat_level_id": 2, "timestamp": 1780862403}, "4a45e589-c851-41a9-b4c0-249de14eceeb": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-08", "date": "2026-06-07", "analysis": 1, "threat_level_id": 2, "timestamp": 1780948804}, "70a24add-ca6c-48d7-8196-280b648237fd": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-09", "date": "2026-06-08", "analysis": 1, "threat_level_id": 2, "timestamp": 1781035210}, "a569ecc1-9e0d-413a-bb85-50ada5e643c2": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-10", "date": "2026-06-09", "analysis": 1, "threat_level_id": 2, "timestamp": 1781118003}, "10a9ab63-cbe7-4d03-82a5-2fbe04413b9f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-11", "date": "2026-06-10", "analysis": 1, "threat_level_id": 2, "timestamp": 1781197203}, "2267a44b-6738-41b3-a92a-de3db93fcd41": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-13", "date": "2026-06-12", "analysis": 1, "threat_level_id": 2, "timestamp": 1781388006}, "a2b4b75f-e399-40a6-91d4-ead8b421b93d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-14", "date": "2026-06-13", "analysis": 1, "threat_level_id": 2, "timestamp": 1781467211}, "5141a946-6109-4a37-821e-83eb8a281e2f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-15", "date": "2026-06-14", "analysis": 1, "threat_level_id": 2, "timestamp": 1781557206}, "869bde21-bfc1-48fa-a7ff-0fd0bef879f5": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-16", "date": "2026-06-15", "analysis": 1, "threat_level_id": 2, "timestamp": 1781640008}, "bd15b376-88d1-45c8-9f72-e4c95c9bb869": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-17", "date": "2026-06-16", "analysis": 1, "threat_level_id": 2, "timestamp": 1781722808}, "08ca6bf6-3e72-403a-9c10-172acd51fdc2": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-18", "date": "2026-06-17", "analysis": 1, "threat_level_id": 2, "timestamp": 1781812807}, "f4ce5e14-59d8-474c-aad7-4e8cea5ece81": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-19", "date": "2026-06-18", "analysis": 1, "threat_level_id": 2, "timestamp": 1781899205}, "ea3effb5-fd4b-4869-aaa9-b4dea47b8f05": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-20", "date": "2026-06-19", "analysis": 1, "threat_level_id": 2, "timestamp": 1782540404}, "52f2c65f-9b18-48d0-b314-389497c784a6": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-21", "date": "2026-06-20", "analysis": 1, "threat_level_id": 2, "timestamp": 1782540311}, "f20f881a-e354-4781-8b5d-44a0929e018f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-22", "date": "2026-06-21", "analysis": 1, "threat_level_id": 2, "timestamp": 1782540279}, "248327de-3f12-4976-a3d0-3a6a32f16b17": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-23", "date": "2026-06-22", "analysis": 1, "threat_level_id": 2, "timestamp": 1782205204}, "64f30208-0b74-45a1-80d5-656986bc15da": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-27", "date": "2026-06-27", "analysis": 1, "threat_level_id": 2, "timestamp": 1782590407}, "8f4fc48d-cb1c-43e9-b6d0-2b487cd0eb7d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-06-27", "date": "2026-06-27", "analysis": 1, "threat_level_id": 3, "timestamp": 1782601187}, "8ed956fe-c0f7-4c5b-a1c0-60ebf2472f79": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-28", "date": "2026-06-27", "analysis": 1, "threat_level_id": 2, "timestamp": 1782682916}, "6043ec63-03ec-4873-a142-d0cfc15df79c": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#50003a", "local": false, "name": "kill-chain:Reconnaissance", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#edbfa2", "local": false, "name": "type:OSINT', 'osint:lifetime=\"perpetual\"", "relationship_type": ""}], "info": "KRVTZ-NET IDS alerts for 2026-06-28", "date": "2026-06-28", "analysis": 1, "threat_level_id": 3, "timestamp": 1782662592}, "823a8f32-6afa-443a-9413-1e9fc114c8cc": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-29", "date": "2026-06-28", "analysis": 1, "threat_level_id": 2, "timestamp": 1782766807}, "413d6ff6-63bb-4251-940c-7e1fa522edee": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-06-30", "date": "2026-06-29", "analysis": 1, "threat_level_id": 2, "timestamp": 1782846010}, "3e67f8da-8429-4221-bd17-57600f7a6969": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-01", "date": "2026-06-30", "analysis": 1, "threat_level_id": 2, "timestamp": 1782939605}, "4bdca999-e02f-4d79-b011-cdb764776f3d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-02", "date": "2026-07-01", "analysis": 1, "threat_level_id": 2, "timestamp": 1783026011}, "30154841-a2c0-4cb9-900c-a874c1d31d36": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-03", "date": "2026-07-02", "analysis": 1, "threat_level_id": 2, "timestamp": 1783112456}, "9954f3b0-35a0-4f57-b637-9a43cee2940e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-04", "date": "2026-07-03", "analysis": 1, "threat_level_id": 2, "timestamp": 1783202456}, "2daa60a9-9a5d-4020-9d87-24514070fb90": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-05", "date": "2026-07-04", "analysis": 1, "threat_level_id": 2, "timestamp": 1783285204}, "f7b99d14-f07f-41b5-b9bf-13e59b152219": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-06", "date": "2026-07-05", "analysis": 1, "threat_level_id": 2, "timestamp": 1783371603}, "1b707c7f-3b81-4d91-bf4c-43199ac59886": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-07", "date": "2026-07-06", "analysis": 1, "threat_level_id": 2, "timestamp": 1783461603}, "08e34e6a-8b78-459d-b53d-c9724c6435cd": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-08", "date": "2026-07-07", "analysis": 1, "threat_level_id": 2, "timestamp": 1783533669}, "9fe21642-bde3-48a9-8865-7e7c6367b5b4": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-09", "date": "2026-07-08", "analysis": 1, "threat_level_id": 2, "timestamp": 1783630934}, "dd12c7a1-388e-4a7d-a6d9-7b60f2973985": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-11", "date": "2026-07-10", "analysis": 1, "threat_level_id": 2, "timestamp": 1783800068}, "d17ccdfc-4453-4176-a88b-9e71e060d66f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-12", "date": "2026-07-11", "analysis": 1, "threat_level_id": 2, "timestamp": 1783886546}, "66a2959d-d92d-44e7-9543-9d7fc8d99f8d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-13", "date": "2026-07-12", "analysis": 1, "threat_level_id": 2, "timestamp": 1783972832}, "e8810911-75c2-4125-a766-d7a897c23634": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-14", "date": "2026-07-13", "analysis": 1, "threat_level_id": 2, "timestamp": 1784055618}, "334351d3-2f2f-43cd-8db9-ce2d8b787364": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-15", "date": "2026-07-14", "analysis": 1, "threat_level_id": 2, "timestamp": 1784142007}, "79253ccc-5cde-48b2-95b6-2c6a2605bf0d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-16", "date": "2026-07-16", "analysis": 1, "threat_level_id": 2, "timestamp": 1784235640}, "9b6c7383-c1da-40d2-b7d7-0fa11e98369f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-17", "date": "2026-07-16", "analysis": 1, "threat_level_id": 2, "timestamp": 1784322006}, "c7d460ba-e4f5-4ed6-9714-9cda114a4c62": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-18", "date": "2026-07-17", "analysis": 1, "threat_level_id": 2, "timestamp": 1784412006}, "f9675093-4784-487d-ad9d-ae945c8a288e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-19", "date": "2026-07-18", "analysis": 1, "threat_level_id": 2, "timestamp": 1784469605}, "1e7a9c77-9dc8-457e-98b2-dbb406d46718": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-20", "date": "2026-07-19", "analysis": 1, "threat_level_id": 2, "timestamp": 1784574011}, "dfc9ef66-d6ff-4417-901f-801bb22384a3": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-21", "date": "2026-07-20", "analysis": 1, "threat_level_id": 2, "timestamp": 1784660423}, "d9b9dbfc-bafc-45e6-a432-83d76d6c2847": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-22", "date": "2026-07-21", "analysis": 1, "threat_level_id": 2, "timestamp": 1784746810}, "2c8e60a1-4fa6-4be4-b2e4-87966f87c3c1": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-23", "date": "2026-07-22", "analysis": 1, "threat_level_id": 2, "timestamp": 1784833207}, "7151fa00-6906-4647-9cb0-ccc84b29f277": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-24", "date": "2026-07-23", "analysis": 1, "threat_level_id": 2, "timestamp": 1784930411}, "fde8c224-d432-4ef4-bd2a-e6a7cbce079d": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-25", "date": "2026-07-24", "analysis": 1, "threat_level_id": 2, "timestamp": 1785013213}, "12e1fb42-310c-4e04-878a-d76bd485c85f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-26", "date": "2026-07-25", "analysis": 1, "threat_level_id": 2, "timestamp": 1785099613}, "909dfd53-79b9-46d4-9be9-b1ca6ca848fb": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-27", "date": "2026-07-26", "analysis": 1, "threat_level_id": 2, "timestamp": 1785178807}, "bcf9036e-b356-45a7-8191-dd4ffec7d159": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-28", "date": "2026-07-27", "analysis": 1, "threat_level_id": 2, "timestamp": 1785268820}, "9f824470-689b-4047-b487-03f572d4cb3f": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-29", "date": "2026-07-28", "analysis": 1, "threat_level_id": 2, "timestamp": 1785355208}, "4aa998aa-09cf-46cb-9c63-449bc0943968": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-30", "date": "2026-07-29", "analysis": 1, "threat_level_id": 2, "timestamp": 1785434408}, "6f427901-14e3-4493-b8f8-65e99ca76bd6": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-07-31", "date": "2026-07-30", "analysis": 1, "threat_level_id": 2, "timestamp": 1785531604}, "183b6a5f-ebc1-4575-ac91-87e2e13c3731": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-01", "date": "2026-07-31", "analysis": 1, "threat_level_id": 2, "timestamp": 1785618014}, "c2d3498b-60ea-4a1f-9a70-b3ff82056cb2": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-02", "date": "2026-08-01", "analysis": 1, "threat_level_id": 2, "timestamp": 1785704404}, "5ce193cb-d246-4291-8ef6-9187edc64582": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-03", "date": "2026-08-02", "analysis": 1, "threat_level_id": 2, "timestamp": 1785780015}, "e785d271-54e2-4c3e-8101-346cb042dd29": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-04", "date": "2026-08-03", "analysis": 1, "threat_level_id": 2, "timestamp": 1785877398}, "92b57f45-754e-4180-9032-1fee1714bf71": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-05", "date": "2026-08-04", "analysis": 1, "threat_level_id": 2, "timestamp": 1785952804}, "98fa60ea-d504-4e63-8766-d8c331f902e5": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-07", "date": "2026-08-06", "analysis": 1, "threat_level_id": 2, "timestamp": 1786132805}, "da6cf323-074f-4272-8ddd-8fddddac8690": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-08", "date": "2026-08-07", "analysis": 1, "threat_level_id": 2, "timestamp": 1786226406}, "118e66a6-103e-4d16-bf65-5ff0b6ecf532": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-09", "date": "2026-08-08", "analysis": 1, "threat_level_id": 2, "timestamp": 1786305615}, "0badeefd-70f0-46e6-87f4-a6f1454661f9": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-10", "date": "2026-08-09", "analysis": 1, "threat_level_id": 2, "timestamp": 1786388421}, "b10656a2-7551-45ed-a0b1-d97fe3ef2b81": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-11", "date": "2026-08-10", "analysis": 1, "threat_level_id": 2, "timestamp": 1786478412}, "58e3803b-3094-4457-a6f6-810d5bd94b6a": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-12", "date": "2026-08-11", "analysis": 1, "threat_level_id": 2, "timestamp": 1786564809}, "947d2ac1-3953-451f-8ae1-35e5c911978e": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-13", "date": "2026-08-12", "analysis": 1, "threat_level_id": 2, "timestamp": 1786651204}, "6cb37027-b16f-4d80-aa77-a0dfd2dfe872": {"Orgc": {"name": "Krawczyk Industries Limited", "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"}, "Tag": [{"colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": ""}, {"colour": "#d6f264", "local": false, "name": "MALWARE", "relationship_type": ""}, {"colour": "#00833c", "local": false, "name": "misp:threat-level=\"medium-risk\"", "relationship_type": ""}, {"colour": "#00ce5f", "local": false, "name": "misp:event-type=\"observation\"", "relationship_type": ""}, {"colour": "#009042", "local": false, "name": "misp:automation-level=\"unsupervised\"", "relationship_type": ""}, {"colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": ""}, {"colour": "#0071c3", "local": false, "name": "osint:lifetime=\"perpetual\"", "relationship_type": ""}, {"colour": "#0064ac", "local": false, "name": "osint:source-type=\"manual-collection\"", "relationship_type": ""}], "info": "Maltrail IOC for 2026-08-14", "date": "2026-08-13", "analysis": 1, "threat_level_id": 2, "timestamp": 1786701604}}