{
 "title": "Rapid Threat Intel",
 "description": "High-impact threat intelligence and IOCs, researched and ready to deploy",
 "repository": "https://github.com/daniyyell-dev/rapid-threat-intel",
 "documentation": "https://github.com/daniyyell-dev/rapid-threat-intel/blob/main/docs/dashboard.md",
 "licence": "MIT",
 "last_updated": "2026-11-11 10:21",
 "threat_count": 15,
 "indicator_count": 495,
 "block_now_count": 263,
 "combined_files": [
  {
   "name": "block_now.txt",
   "label": "All block-now indicators",
   "note": "every threat, grouped",
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now.txt",
   "download": "block_now.txt"
  },
  {
   "name": "block_now_ipv4.txt",
   "label": "IPv4 block list",
   "note": null,
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_ipv4.txt",
   "download": "block_now_ipv4.txt"
  },
  {
   "name": "block_now_domain.txt",
   "label": "Domain block list",
   "note": null,
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_domain.txt",
   "download": "block_now_domain.txt"
  },
  {
   "name": "block_now_url.txt",
   "label": "URL block list",
   "note": null,
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_url.txt",
   "download": "block_now_url.txt"
  },
  {
   "name": "block_now_sha256.txt",
   "label": "SHA256 block list",
   "note": null,
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_sha256.txt",
   "download": "block_now_sha256.txt"
  },
  {
   "name": "block_now_sha1.txt",
   "label": "SHA1 block list",
   "note": null,
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/block_now_sha1.txt",
   "download": "block_now_sha1.txt"
  },
  {
   "name": "defender_xdr_indicators.csv",
   "label": "Defender XDR import",
   "note": "all threats",
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/defender_xdr_indicators.csv",
   "download": "defender_xdr_indicators.csv"
  },
  {
   "name": "iocs.csv",
   "label": "All indicators (CSV)",
   "note": "with descriptions",
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/iocs.csv",
   "download": "iocs.csv"
  },
  {
   "name": "live_feed_hunt.kql",
   "label": "Live-feed hunting query (KQL)",
   "note": "loads the lists itself",
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/live_feed_hunt.kql",
   "download": "live_feed_hunt.kql"
  },
  {
   "name": "live_feed_hunt.spl",
   "label": "Live-feed hunting query (Splunk)",
   "note": "uses the splunk_rti_iocs.csv lookup",
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/live_feed_hunt.spl",
   "download": "live_feed_hunt.spl"
  },
  {
   "name": "live_feed.yaral",
   "label": "Live-feed rule (Google SecOps)",
   "note": "uses reference lists",
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/live_feed.yaral",
   "download": "live_feed.yaral"
  },
  {
   "name": "splunk_rti_iocs.csv",
   "label": "Splunk lookup",
   "note": "block-now indicators",
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/splunk_rti_iocs.csv",
   "download": "splunk_rti_iocs.csv"
  },
  {
   "name": "splunk_macros.conf",
   "label": "Splunk macros",
   "note": "for data not mapped to CIM",
   "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/all/splunk_macros.conf",
   "download": "splunk_macros.conf"
  }
 ],
 "threats": [
  {
   "id": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft",
   "folder": "threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft",
   "name": "Gentlemen Ransomware Affiliate Azazel: CI/CD Secret Theft, LEAKNED Extortion and MCP Command Execution",
   "short": "Gentlemen affiliate Azazel (LEAKNED)",
   "category": "Ransomware / data theft and extortion",
   "published": "2026-10-05",
   "entry_date": "2026-11-11 10:21",
   "last_updated": "2026-11-11",
   "seq": 15,
   "headline": "Gentlemen ransomware affiliate stealing CI/CD secrets and leaking victims on its own LEAKNED site",
   "summary": "CloudSEK traced an exposed open directory and storage server to Azazel, a Russian-speaking affiliate of The Gentlemen ransomware-as-a-service operation, and confirmed more than two dozen breached organisations in six countries across logistics, insurance, pharmaceuticals, medical devices, AI and government-linked services. Azazel used The Gentlemen's tooling and ransom note template but published victims on his own leak site, LEAKNED, and kept the proceeds; Bitdefender's November 2026 debrief reports more than 6 TB of stolen data. Most victims were reached through secrets harvested from GitLab CI/CD variables and repository history (database passwords, API tokens and SSH keys), and one AI platform was entered through a server-side URL fetch (SSRF). Data left through aws s3 sync, mc mirror, scp, pg_dump and HTTP POST to port 9999 on the C2 server, then moved to MEGA. After exfiltration Azazel killed a production PostgreSQL process and deleted its data directory, and planted ransom notes on eight surfaces, including /etc/motd, the SSH banner and ATTENTION_SENSITIVE_INFORMATION.txt in the root and ubuntu home directories. He also ran commands through exec_in_session, a Model Context Protocol (MCP) tool served on 127.0.0.1:35367, and scanned the internet for exposed MCP servers.",
   "caveat": null,
   "targets": {
    "countries": [],
    "regions": [],
    "sectors": [
     "Logistics",
     "Insurance",
     "Pharmaceuticals",
     "Medical devices",
     "Technology",
     "Government"
    ],
    "note": "CloudSEK confirmed more than two dozen breached organisations in six countries but does not name the countries. Sectors are those CloudSEK lists; the government entry is a platform hosting a government-linked financial registry.",
    "source": {
     "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "name": "CloudSEK"
    }
   },
   "mitre": [
    {
     "id": "T1552.001",
     "name": "Credentials In Files",
     "url": "https://attack.mitre.org/techniques/T1552/001/"
    },
    {
     "id": "T1213.003",
     "name": "Code Repositories",
     "url": "https://attack.mitre.org/techniques/T1213/003/"
    },
    {
     "id": "T1190",
     "name": "Exploit Public-Facing Application",
     "url": "https://attack.mitre.org/techniques/T1190/"
    },
    {
     "id": "T1021.004",
     "name": "SSH",
     "url": "https://attack.mitre.org/techniques/T1021/004/"
    },
    {
     "id": "T1059.004",
     "name": "Unix Shell",
     "url": "https://attack.mitre.org/techniques/T1059/004/"
    },
    {
     "id": "T1110.002",
     "name": "Password Cracking",
     "url": "https://attack.mitre.org/techniques/T1110/002/"
    },
    {
     "id": "T1567.002",
     "name": "Exfiltration to Cloud Storage",
     "url": "https://attack.mitre.org/techniques/T1567/002/"
    },
    {
     "id": "T1485",
     "name": "Data Destruction",
     "url": "https://attack.mitre.org/techniques/T1485/"
    },
    {
     "id": "T1491.001",
     "name": "Internal Defacement",
     "url": "https://attack.mitre.org/techniques/T1491/001/"
    }
   ],
   "recommended_actions": [
    "Block 23.236.169.183, 162.220.163.26 and 66.179.30.155 at the perimeter and in Defender XDR, and search 90 days of firewall, NetFlow and GitLab access logs for them, including SSH and outbound HTTP to port 9999.",
    "Rotate every secret held in GitLab CI/CD variables and in repository history (database passwords, API tokens, SSH keys and cloud keys), make variables masked and protected, and review CI/CD variable reads and API token use from unexpected addresses.",
    "Search Linux servers for ATTENTION_SENSITIVE_INFORMATION.txt in the root and ubuntu home directories, and for changes to /etc/motd, the sshd_config Banner setting, the PostgreSQL cluster_name and the pgAdmin login template; also check GitLab for README edits or issues opened with a pipeline token.",
    "Alert on mc mirror, aws s3 sync, pg_dump or mega-cmd-server runs to destinations you do not own, keep any MCP server bound to loopback with an approved client allowlist, and alert on MCP clients named internet-census-mcp-scanner."
   ],
   "sources": [
    {
     "url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "name": "CloudSEK"
    },
    {
     "url": "https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-november-2026",
     "label": "Bitdefender – Threat Debrief November 2026",
     "name": "Bitdefender"
    }
   ],
   "indicator_count": 9,
   "block_now_count": 3,
   "hunt_count": 6,
   "hunt_counts": {
    "alert": 5,
    "monitor": 1
   },
   "indicator_counts": {
    "ipv4": 5,
    "other": 2,
    "domain": 1,
    "filename": 1
   },
   "ioas": [
    {
     "artefact": "mc mirror (MinIO Client) copying a bucket to a remote destination you do not own",
     "log_source": "Linux process events, MinIO audit logs",
     "why": "Azazel mirrored a victim's object storage to his staging server continuously with retry logic; CloudSEK published a Sigma rule for it.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_name": "CloudSEK",
     "title": "Object storage mirrored out with the MinIO client",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "Bulk reads of GitLab CI/CD variables, project exports or repository clones by a token from an unfamiliar address",
     "log_source": "GitLab audit events and API logs",
     "why": "Every non-AI victim was reached through secrets harvested from GitLab CI/CD variables and repository history using glato, nord-stream, gitlab-secrets, gitlab-watchman and gitleaks.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_name": "CloudSEK",
     "title": "Bulk reads of GitLab CI/CD secrets",
     "queries": []
    },
    {
     "artefact": "Ransom notes written to /etc/motd, the sshd_config Banner, the PostgreSQL cluster_name, the pgAdmin login template, a GitLab README or a new GitLab issue",
     "log_source": "Linux file integrity monitoring, GitLab audit events, PostgreSQL logs",
     "why": "Azazel's va.py checked notes on eight surfaces across six hosts, including ATTENTION_SENSITIVE_INFORMATION.txt in the root and ubuntu home directories.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_name": "CloudSEK",
     "title": "Ransom notes planted on server surfaces",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "PostgreSQL process killed and its data directory deleted shortly after large pg_dump or scp transfers",
     "log_source": "Linux process events, PostgreSQL logs",
     "why": "After exfiltrating a government-linked financial registry, Azazel ran a script that killed the live PostgreSQL process and deleted the production data directory.",
     "action": "alert",
     "has_query": false,
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_name": "CloudSEK",
     "title": "PostgreSQL killed and wiped after exfiltration",
     "queries": []
    },
    {
     "artefact": "MCP server listening beyond loopback, or MCP initialize requests from clients named internet-census-mcp-scanner or hermes",
     "log_source": "MCP server logs, reverse proxy logs, network listeners",
     "why": "Azazel ran commands through an MCP exec_in_session tool and scanned the internet for exposed MCP ports.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_name": "CloudSEK",
     "title": "Exposed MCP server or MCP scanner clients",
     "queries": [
      "SPL"
     ]
    },
    {
     "artefact": "Large uploads from servers to MEGA (mega-cmd-server) or HTTP POSTs to port 9999 on unfamiliar hosts",
     "log_source": "Firewall, proxy and NetFlow logs, EDR network events",
     "why": "Stolen data went from victims to the C2 box by HTTP POST to port 9999, then to MEGA via mega-cmd-server.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_name": "CloudSEK",
     "title": "Large uploads to MEGA or to port 9999",
     "queries": [
      "SPL"
     ]
    }
   ],
   "ioa_count": 6,
   "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.",
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/block_now.txt",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/defender_xdr_indicators.csv",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.kql",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.spl",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt_raw.spl",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.yaral",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/iocs.csv",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft",
   "indicators": [
    {
     "value": "23.236.169.183",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Azazel's victim-facing command-and-control server: Penelope reverse shell sessions, an HTTP upload listener on port 9999 receiving stolen data, and the open directory on port 8000 that exposed the operation.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    },
    {
     "value": "162.220.163.26",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Azazel's staging server, nicknamed forgitlab, which held operational scripts, per-victim working directories and live exfiltration jobs, including a continuous mirror of one victim's object storage.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    },
    {
     "value": "66.179.30.155",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Azazel's novostnik server, which hosts the LEAKNED leak site front end and a long-term archive of stolen data.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    },
    {
     "value": "141.95.252.30",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Address that CloudSEK lists as a beacon check-in for Azazel's operation. It also serves a public website on a general hosting provider, so alert on it rather than block.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    },
    {
     "value": "66.203.124.135",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "MEGA API server that Azazel used as the final destination for stolen data through mega-cmd-server. It is legitimate MEGA infrastructure, so do not block it unless your organisation bans MEGA; alert on uploads from servers.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    },
    {
     "value": "forgitlab.com",
     "type": "domain",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Domain name Azazel used for his staging server, chosen to look like GitLab infrastructure. It does not resolve today, so treat any hit as historical or as a sign it has been re-registered.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    },
    {
     "value": "ATTENTION_SENSITIVE_INFORMATION.txt",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Ransom note Azazel planted in the root and ubuntu home directories on compromised Linux servers, alongside notes in /etc/motd, the SSH banner, the PostgreSQL cluster_name and the pgAdmin login page.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    },
    {
     "value": "internet-census-mcp-scanner",
     "type": "other",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Client fingerprint Azazel's scanner used when probing the internet for exposed MCP servers. Search MCP server and reverse-proxy logs for it.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    },
    {
     "value": "hermes",
     "type": "other",
     "confidence": "low",
     "recommended_action": "monitor",
     "description": "MCP client identity Azazel used to call his exec_in_session command tool. The name is also used by legitimate software, so treat a hit only as a lead.",
     "source_url": "https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files",
     "source_label": "CloudSEK – Caught in 4K: The Gentlemen Files",
     "source_name": "CloudSEK"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.kql",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.spl",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt_raw.spl",
      "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft/hunt.yaral",
     "download": "Gentlemen-Affiliate-Azazel-LEAKNED-CICD-Secret-Theft_hunt.yaral"
    }
   ]
  },
  {
   "id": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover",
   "folder": "threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover",
   "name": "Xen Orchestra Authentication Bypass (VSA-2026-062) Exploited to Take Over XCP-ng Hosts",
   "short": "Xen Orchestra VSA-2026-062 exploitation",
   "category": "Exploitation / hypervisor management",
   "published": "2026-11-10",
   "entry_date": "2026-11-11 10:05",
   "last_updated": "2026-11-11",
   "seq": 14,
   "headline": "Cookie-based auth bypass in the Xen Orchestra console exploited to take over XCP-ng hosts as root",
   "summary": "Vates reports active exploitation of VSA-2026-062, a critical authentication bypass in Xen Orchestra, the web console that manages XCP-ng virtualisation pools. A request carrying the cookie authenticationToken=j:{} (or its URL-encoded form, j:%7B%7D) makes Xen Orchestra treat the value as an empty object, return the first stored token and log the sender in as that token's owner, usually an administrator; the /rest/v0/users/me/authentication_tokens route then hands back reusable login tokens. From there an attacker can run code on managed pools and take over XCP-ng hosts as root. The threat actor operated initially from 91.211.251.112:8001 and a Tor onion service on port 3333, ran a VM named pivot2, configured VMs with a file-backed serial port and planted /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6 on hosts. Xen Orchestra does not log the bypass. Six of the eight addresses Vates lists for blocking are public Tor relays, including a Tor directory authority, so they are marked alert rather than block. The flaw has no CVE yet; it is fixed in Xen Orchestra 6.9.2 (stable) and 6.10.1 (latest), and was discovered by TDC NET Security.",
   "caveat": null,
   "targets": {
    "countries": [],
    "regions": [],
    "sectors": [],
    "note": "Vates confirms active exploitation of internet-reachable Xen Orchestra instances but does not name countries, sectors or victims.",
    "source": {
     "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "label": "Vates – VSA-2026-062: Empty-object login token",
     "name": "Vates"
    }
   },
   "mitre": [
    {
     "id": "T1190",
     "name": "Exploit Public-Facing Application",
     "url": "https://attack.mitre.org/techniques/T1190/"
    },
    {
     "id": "T1550.001",
     "name": "Application Access Token",
     "url": "https://attack.mitre.org/techniques/T1550/001/"
    },
    {
     "id": "T1564.006",
     "name": "Run Virtual Instance",
     "url": "https://attack.mitre.org/techniques/T1564/006/"
    },
    {
     "id": "T1053.003",
     "name": "Cron",
     "url": "https://attack.mitre.org/techniques/T1053/003/"
    },
    {
     "id": "T1090.003",
     "name": "Multi-hop Proxy",
     "url": "https://attack.mitre.org/techniques/T1090/003/"
    },
    {
     "id": "T1571",
     "name": "Non-Standard Port",
     "url": "https://attack.mitre.org/techniques/T1571/"
    }
   ],
   "recommended_actions": [
    "Update Xen Orchestra to 6.9.2 (stable) or 6.10.1 (latest), or xo-server to 5.211.2 or 5.213.1, and keep the console on a dedicated management network that is not reachable from the internet.",
    "Block 91.211.251.112 and 193.148.56.72 in both directions, block Tor from management networks, and search 30 days of firewall and proxy logs for these addresses and the six Tor relays.",
    "Add a WAF or reverse-proxy rule for authenticationToken=j:{} and authenticationToken=j:%7B%7D, and search proxy and web server logs for both patterns, because Xen Orchestra does not log the bypass.",
    "On every XCP-ng host, look for a VM named pivot2, VMs with hvm_serial: file, '-serial file:' in /var/log/xensource.log*, and /etc/cron.d/zz-ustar*, /.ustar5, /.ustar6 and /etc/ld.so.preload. If compromised, reinstall and rotate every Vates VMS secret, including backup remotes, the pool secret, root and user passwords, OTP secrets and mail settings."
   ],
   "sources": [
    {
     "url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "label": "Vates – VSA-2026-062: Empty-object login token",
     "name": "Vates"
    },
    {
     "url": "https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html",
     "label": "The Hacker News – Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access",
     "name": "The Hacker News"
    }
   ],
   "indicator_count": 17,
   "block_now_count": 2,
   "hunt_count": 15,
   "hunt_counts": {
    "alert": 14,
    "monitor": 1
   },
   "indicator_counts": {
    "ipv4": 8,
    "other": 5,
    "filename": 4
   },
   "ioas": [
    {
     "artefact": "HTTP requests to Xen Orchestra with the cookie authenticationToken=j:{} or authenticationToken=j:%7B%7D",
     "log_source": "Reverse-proxy, WAF or packet capture in front of Xen Orchestra",
     "why": "This is the bypass itself, and Xen Orchestra does not log it. Other encodings can evade a naive regex.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_name": "Vates",
     "title": "Auth-bypass cookie sent to Xen Orchestra",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "Requests to /rest/v0/users/me/authentication_tokens from unfamiliar addresses",
     "log_source": "Reverse-proxy and web logs",
     "why": "After the bypass this route returns reusable login tokens.",
     "action": "hunt",
     "has_query": true,
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_name": "Vates",
     "title": "Login-token harvesting requests",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "A VM named pivot2, VMs with hvm_serial: file, or '-serial file:' in /var/log/xensource.log",
     "log_source": "XCP-ng hosts (xe vm-list, xensource.log), syslog",
     "why": "Vates lists these as signs of the attacker's foothold VM on compromised pools.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_name": "Vates",
     "title": "Attacker foothold VM on XCP-ng",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "Files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6, or a new /etc/ld.so.preload",
     "log_source": "XCP-ng host file checks, EDR file events",
     "why": "Persistence files planted by this actor on XCP-ng hosts.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_name": "Vates",
     "title": "Persistence files on XCP-ng hosts",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    }
   ],
   "ioa_count": 4,
   "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.",
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/block_now.txt",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/defender_xdr_indicators.csv",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.kql",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.spl",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt_raw.spl",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.yaral",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/iocs.csv",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover",
   "indicators": [
    {
     "value": "91.211.251.112",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Initial command-and-control server of the threat actor exploiting Xen Orchestra VSA-2026-062, reached on port 8001; Vates recommends blocking it in both directions.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "193.148.56.72",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Threat actor address on the Vates block list for the Xen Orchestra VSA-2026-062 campaign; block it in both directions.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "37.221.208.216",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "45.66.35.11",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Tor directory authority (dizum) that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign. Every Tor client contacts directory authorities, so a hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "64.65.0.120",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "64.65.62.160",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "89.47.51.90",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "92.60.37.247",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Public Tor relay that Vates lists for blocking in the Xen Orchestra VSA-2026-062 campaign, whose C2 runs over Tor. A hit shows Tor use, not an attacker-owned server; alert on it and block Tor as a whole on management networks.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion",
     "type": "other",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Tor onion service the threat actor used for command and control on port 3333. It cannot be blocked by DNS; block Tor traffic from management networks instead.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "authenticationToken=j:{}",
     "type": "other",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Exploit cookie for VSA-2026-062: Xen Orchestra parses it as an empty object and logs the sender in as the owner of the first stored token. Search proxy, WAF and web server logs, as Xen Orchestra does not log it.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "authenticationToken=j:%7B%7D",
     "type": "other",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "URL-encoded form of the VSA-2026-062 exploit cookie. Search proxy, WAF and web server logs for it.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "pivot2",
     "type": "other",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Name of the VM the threat actor ran on compromised Xen Orchestra and XCP-ng pools.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "hvm_serial: file",
     "type": "other",
     "confidence": "med",
     "recommended_action": "monitor",
     "description": "VM platform setting that sends a VM's serial port to a file on the XCP-ng host; Vates lists VMs configured this way as a sign of this campaign.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "/etc/cron.d/zz-ustar",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Cron file the threat actor planted on XCP-ng hosts.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "/etc/cron.d/zz-ustar2",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Second cron file the threat actor planted on XCP-ng hosts.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "/.ustar5",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "File the threat actor dropped in the root directory of XCP-ng hosts.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    },
    {
     "value": "/.ustar6",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Second file the threat actor dropped in the root directory of XCP-ng hosts.",
     "source_url": "https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/",
     "source_label": "Vates – VSA-2026-062: Empty-object login token",
     "source_name": "Vates"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.kql",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.spl",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt_raw.spl",
      "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover/hunt.yaral",
     "download": "Xen-Orchestra-VSA-2026-062-Auth-Bypass-XCP-ng-Takeover_hunt.yaral"
    }
   ]
  },
  {
   "id": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware",
   "folder": "threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware",
   "name": "GhostFrame: ESXi Hypervisor Implant Linked to Settra Ransomware (TAG-218)",
   "short": "GhostFrame ESXi implant (TAG-218)",
   "category": "Ransomware / hypervisor",
   "published": "2026-11-10",
   "entry_date": "2026-11-11 07:54",
   "last_updated": "2026-11-11",
   "seq": 13,
   "headline": "ESXi hypervisor implant used by a Settra-linked group after VPN appliance intrusions in the US and Europe",
   "summary": "Recorded Future's Insikt Group reports GhostFrame, a previously undocumented command-and-control and post-exploitation framework for compromised VMware ESXi hosts, used by TAG-218, a group whose activity overlaps with Settra ransomware. Between late August and October 2026 TAG-218 servers targeted VPN appliances in the US and Europe, mainly SonicWall, Palo Alto Networks and Fortinet, and four of the targeted organisations later appeared on the Settra leak site. GhostFrame needs existing root access on the hypervisor: its implant, vmhostd-core, runs from a datastore, persists through /etc/rc.local.d/local.sh, keeps disabling the ESXi firewall and unsigned-binary protection, and masquerades as vmhostd. Operators can list, power off and snapshot VMs, relay VNC sessions, tunnel the ESXi Host Client, pivot with the gfsox SOCKS5 proxy, and harvest Windows credentials from VM memory, disks and datastores with sdkmon and VMkatz. The implant tries six C2 ports at once (53, 2222, 3389, 4444, 8443 and 9443), which gives a distinctive network pattern.",
   "caveat": null,
   "targets": {
    "countries": [
     {
      "code": "US",
      "name": "United States"
     }
    ],
    "regions": [
     "Europe"
    ],
    "sectors": [],
    "note": "VPN appliances of organisations in the US and Europe targeted between late August and October 2026; sectors not stated.",
    "source": {
     "url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware",
     "name": "Recorded Future"
    }
   },
   "mitre": [
    {
     "id": "T1133",
     "name": "External Remote Services",
     "url": "https://attack.mitre.org/techniques/T1133/"
    },
    {
     "id": "T1190",
     "name": "Exploit Public-Facing Application",
     "url": "https://attack.mitre.org/techniques/T1190/"
    },
    {
     "id": "T1037",
     "name": "Boot or Logon Initialization Scripts",
     "url": "https://attack.mitre.org/techniques/T1037/"
    },
    {
     "id": "T1562.004",
     "name": "Disable or Modify System Firewall",
     "url": "https://attack.mitre.org/techniques/T1562/004/"
    },
    {
     "id": "T1036",
     "name": "Masquerading",
     "url": "https://attack.mitre.org/techniques/T1036/"
    },
    {
     "id": "T1090",
     "name": "Proxy",
     "url": "https://attack.mitre.org/techniques/T1090/"
    },
    {
     "id": "T1003",
     "name": "OS Credential Dumping",
     "url": "https://attack.mitre.org/techniques/T1003/"
    },
    {
     "id": "T1219",
     "name": "Remote Access Software",
     "url": "https://attack.mitre.org/techniques/T1219/"
    },
    {
     "id": "T1486",
     "name": "Data Encrypted for Impact",
     "url": "https://attack.mitre.org/techniques/T1486/"
    }
   ],
   "recommended_actions": [
    "Block the two GhostFrame C2 addresses and the MeshCentral server, and search 30 days of firewall and proxy logs for connections from ESXi management addresses and VPN appliances to them.",
    "Alert when one host opens near-simultaneous connections to the same external IP on ports 53, 2222, 3389, 4444, 8443 and 9443.",
    "On every ESXi host, check /etc/rc.local.d/local.sh and /opt for vmhostd-core, confirm the firewall is enabled and execInstalledOnly is set, and look for unexpected snapshots or VNC enabled on VMs.",
    "Patch and review SonicWall, Palo Alto Networks and Fortinet VPN appliances, keep ESXi management off the internet and rotate credentials for accounts on VMs hosted on an affected hypervisor."
   ],
   "sources": [
    {
     "url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware",
     "name": "Recorded Future"
    }
   ],
   "indicator_count": 4,
   "block_now_count": 4,
   "hunt_count": 0,
   "hunt_counts": {},
   "indicator_counts": {
    "ipv4": 3,
    "sha256": 1
   },
   "ioas": [
    {
     "artefact": "One host opening near-simultaneous TCP connections to the same external IP on ports 53, 2222, 3389, 4444, 8443 and 9443, retried every 5 to 12 seconds",
     "log_source": "Firewall, NetFlow or EDR network events from ESXi management addresses",
     "why": "GhostFrame tries all six ports at once and keeps the first that answers. The pattern survives C2 rotation.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "source_name": "Recorded Future",
     "title": "One host trying six C2 ports at once",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "Changes to /etc/rc.local.d/local.sh, a file at /opt/vmhostd-core, or a process named vmhostd (not vmware-hostd)",
     "log_source": "ESXi shell.log and syslog, host file checks",
     "why": "GhostFrame persists by copying itself to /opt/vmhostd-core and editing local.sh, then disguises its process name as vmhostd.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "source_name": "Recorded Future",
     "title": "GhostFrame persistence on ESXi",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "The ESXi firewall being disabled (esxcli network firewall set --enabled false) or execInstalledOnly set to 0, again and again",
     "log_source": "ESXi shell.log, hostd.log and syslog",
     "why": "The implant re-disables both controls about every five seconds. Re-enabling them is not enough; find the persistence.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "source_name": "Recorded Future",
     "title": "ESXi firewall disabled again and again",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "VNC enabled on VMs, unexpected snapshots or power changes, and the ESXi Host Client reached through an unusual tunnel",
     "log_source": "ESXi and vCenter events",
     "why": "GhostFrame operators snapshot VMs to harvest credentials with VMkatz and relay VNC sessions to the guests.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "source_name": "Recorded Future",
     "title": "VNC, snapshot and tunnel activity on ESXi",
     "queries": []
    }
   ],
   "ioa_count": 4,
   "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.",
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/block_now.txt",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/defender_xdr_indicators.csv",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.kql",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.spl",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt_raw.spl",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.yaral",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/iocs.csv",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware",
   "indicators": [
    {
     "value": "45.158.196.81",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GhostFrame C2 server used by TAG-218 to control implants on compromised VMware ESXi hosts.",
     "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "source_label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware",
     "source_name": "Recorded Future"
    },
    {
     "value": "45.158.196.141",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Second GhostFrame C2 server tied to TAG-218 infrastructure that receives ESXi implant connections.",
     "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "source_label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware",
     "source_name": "Recorded Future"
    },
    {
     "value": "193.5.65.114",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "MeshCentral remote management server used by TAG-218 for persistence, previously tied to Settra ransomware intrusions; a victim Fortinet VPN appliance beaconed to it on 12 Oct 2026.",
     "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "source_label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware",
     "source_name": "Recorded Future"
    },
    {
     "value": "a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA-256 of the GhostFrame implant analysed by Insikt Group (ELF binary deployed on ESXi as vmhostd-core).",
     "source_url": "https://www.recordedfuture.com/blog/ghostframe-esxi-implant-settra-ransomware",
     "source_label": "Recorded Future Insikt Group – GhostFrame: A new ESXi Implant Linked to Settra Ransomware",
     "source_name": "Recorded Future"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.kql",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.spl",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt_raw.spl",
      "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware/hunt.yaral",
     "download": "GhostFrame-ESXi-Hypervisor-Implant-Settra-Ransomware_hunt.yaral"
    }
   ]
  },
  {
   "id": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector",
   "folder": "threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector",
   "name": "Storm-3358 ARTEX Agentic Intrusions Against the Financial Sector",
   "short": "Storm-3358 ARTEX financial intrusions",
   "category": "Financially motivated intrusion / financial sector",
   "published": "2026-11-06",
   "entry_date": "2026-11-11 03:52",
   "last_updated": "2026-11-11",
   "seq": 12,
   "headline": "Agentic AI framework used to exploit web apps at banks and drop WISP, vshell and AdaptixC2 RATs",
   "summary": "Microsoft Threat Intelligence reports that Storm-3358, a financially motivated, Cambodia-based intrusion cluster, began targeting financial organisations in October 2026 with ARTEX, an open-source agentic penetration testing framework. Most targets are financial organisations in Southeast Asia, with a smaller number of large financial organisations globally. The ARTEX agents scan internet-facing systems at machine speed, exploit anonymous file upload and server-side request forgery (SSRF) flaws in web applications, then use curl and netcat to pull down the open-source WISP, vshell and AdaptixC2 remote access trojans for persistence and lateral movement. Microsoft listed the ARTEX servers and C2 nodes below as active on 6 November 2026; the actor rotates infrastructure, so behaviour-based hunting matters as much as blocking.",
   "caveat": null,
   "targets": {
    "countries": [],
    "regions": [
     "Southeast Asia",
     "Global"
    ],
    "sectors": [
     "Financial services"
    ],
    "note": "Primarily financial organisations in Southeast Asia, plus a smaller number of large financial organisations globally.",
    "source": {
     "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "name": "Microsoft"
    }
   },
   "mitre": [
    {
     "id": "T1595",
     "name": "Active Scanning",
     "url": "https://attack.mitre.org/techniques/T1595/"
    },
    {
     "id": "T1190",
     "name": "Exploit Public-Facing Application",
     "url": "https://attack.mitre.org/techniques/T1190/"
    },
    {
     "id": "T1505.003",
     "name": "Web Shell",
     "url": "https://attack.mitre.org/techniques/T1505/003/"
    },
    {
     "id": "T1105",
     "name": "Ingress Tool Transfer",
     "url": "https://attack.mitre.org/techniques/T1105/"
    },
    {
     "id": "T1059.004",
     "name": "Unix Shell",
     "url": "https://attack.mitre.org/techniques/T1059/004/"
    },
    {
     "id": "T1053.003",
     "name": "Cron",
     "url": "https://attack.mitre.org/techniques/T1053/003/"
    },
    {
     "id": "T1110",
     "name": "Brute Force",
     "url": "https://attack.mitre.org/techniques/T1110/"
    },
    {
     "id": "T1219",
     "name": "Remote Access Software",
     "url": "https://attack.mitre.org/techniques/T1219/"
    }
   ],
   "recommended_actions": [
    "Block the ARTEX server and C2 addresses at the perimeter and in Defender XDR, and search 30 days of firewall, proxy and web server logs for them.",
    "Inventory internet-facing upload endpoints and server-side URL fetch features (document portals, onboarding and KYC forms, webhooks, PDF and image processors); require authentication on uploads and restrict outbound destinations.",
    "Hunt for web server processes spawning a shell, curl, wget or nc, new binaries run from temp or world-writable paths, and new cron entries on web hosts.",
    "Watch for bursts of rapid, retried requests with default tool user agents (Nmap, curl, python-requests, headless Chromium) against public web applications."
   ],
   "sources": [
    {
     "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "name": "Microsoft"
    }
   ],
   "indicator_count": 8,
   "block_now_count": 8,
   "hunt_count": 0,
   "hunt_counts": {},
   "indicator_counts": {
    "ipv4": 8
   },
   "ioas": [
    {
     "artefact": "A web server process starting curl, wget, nc, ncat, netcat or a shell",
     "log_source": "EDR process events on internet-facing web servers",
     "why": "Microsoft saw ARTEX agents use curl and netcat to download the WISP, vshell and AdaptixC2 RATs after exploiting upload and SSRF flaws.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_name": "Microsoft",
     "title": "Web server starting a downloader or shell",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "Bursts of many varied requests from one source in minutes, with default tool user agents (Nmap, curl, wget, Python HTTP clients, headless Chromium or Playwright)",
     "log_source": "Web server, WAF and reverse-proxy logs",
     "why": "Microsoft describes agentic scanning as a wide variety of requests in a short time, with retries at machine speed. The agent changes user agents quickly, so use this to alert, not to block.",
     "action": "hunt",
     "has_query": true,
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_name": "Microsoft",
     "title": "Rapid scanning with default scanner user agents",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "New cron jobs, and new binaries run from temporary or world-writable folders, on web hosts",
     "log_source": "EDR process and file events",
     "why": "Microsoft lists suspicious cron job creation and processes launched from world-writable directories among the detections for this activity.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_name": "Microsoft",
     "title": "New cron jobs and temp-folder binaries on web hosts",
     "queries": [
      "SPL"
     ]
    }
   ],
   "ioa_count": 3,
   "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.",
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/block_now.txt",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/defender_xdr_indicators.csv",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.kql",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.spl",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt_raw.spl",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.yaral",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/iocs.csv",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector",
   "indicators": [
    {
     "value": "199.19.95.66",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "WISP remote access trojan C2 node used by Storm-3358 against financial organisations, first seen 2 Nov 2026.",
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "source_name": "Microsoft"
    },
    {
     "value": "199.19.95.67",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "WISP remote access trojan C2 node used by Storm-3358 against financial organisations, first seen 2 Nov 2026.",
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "source_name": "Microsoft"
    },
    {
     "value": "199.19.95.68",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "WISP remote access trojan C2 node used by Storm-3358 against financial organisations, first seen 2 Nov 2026.",
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "source_name": "Microsoft"
    },
    {
     "value": "91.92.240.238",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "ARTEX agentic attack framework server that scanned and exploited internet-facing web applications, first seen 4 Nov 2026.",
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "source_name": "Microsoft"
    },
    {
     "value": "85.11.168.45",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "ARTEX agentic attack framework server that scanned and exploited internet-facing web applications, first seen 4 Nov 2026.",
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "source_name": "Microsoft"
    },
    {
     "value": "85.11.167.52",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Storm-3358 command-and-control server, first seen 4 Nov 2026.",
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "source_name": "Microsoft"
    },
    {
     "value": "178.16.54.129",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "ARTEX agentic attack framework server, first seen 19 Oct 2026.",
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "source_name": "Microsoft"
    },
    {
     "value": "31.77.229.35",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "ARTEX agentic attack framework server, first seen 28 Oct 2026.",
     "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "source_label": "Microsoft Threat Intelligence – ARTEX abuse expands as cybercriminals target financial sector",
     "source_name": "Microsoft"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.kql",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.spl",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt_raw.spl",
      "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-11/Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector/hunt.yaral",
     "download": "Storm-3358-ARTEX-Agentic-Intrusions-Financial-Sector_hunt.yaral"
    }
   ]
  },
  {
   "id": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant",
   "folder": "threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant",
   "name": "AhsayCBS Backup Server Exploitation: Webshells, Cryptominer and Python Implant",
   "short": "AhsayCBS backup server exploitation",
   "category": "Exploitation / backup server",
   "published": "2026-11-09",
   "entry_date": "2026-11-10 21:52",
   "last_updated": "2026-11-10",
   "seq": 11,
   "headline": "Backup server auth bypass and RCE used to plant webshells, a cryptominer and a Python implant",
   "summary": "Attackers are chaining CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do) against internet-facing AhsayCBS backup servers, which managed service providers and backup resellers use to hold customer backups. Huntress found three compromised servers in one environment between 8 and 11 October 2026, with five families of JSP webshells in webapps\\cbs and webapps\\rps, an XMRig miner run every minute by a SYSTEM scheduled task, gost and chisel tunnels, Defender exclusions, and a sandbox-evading Python implant that loads an in-memory DLL and talks to its C2 over HTTPS with DNS-over-HTTPS lookups. Fixed versions are AhsayCBS 10.3.4.45 (v10) and 9.15.2.70 (v7 to v9); patching does not remove planted files.",
   "caveat": null,
   "targets": {
    "countries": [],
    "regions": [],
    "sectors": [],
    "note": "Huntress describes one impacted organisation and backup servers as the target, without naming a country or sector.",
    "source": {
     "url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "name": "Huntress"
    }
   },
   "mitre": [
    {
     "id": "T1190",
     "name": "Exploit Public-Facing Application",
     "url": "https://attack.mitre.org/techniques/T1190/"
    },
    {
     "id": "T1505.003",
     "name": "Web Shell",
     "url": "https://attack.mitre.org/techniques/T1505/003/"
    },
    {
     "id": "T1059.003",
     "name": "Windows Command Shell",
     "url": "https://attack.mitre.org/techniques/T1059/003/"
    },
    {
     "id": "T1059.006",
     "name": "Python",
     "url": "https://attack.mitre.org/techniques/T1059/006/"
    },
    {
     "id": "T1053.005",
     "name": "Scheduled Task",
     "url": "https://attack.mitre.org/techniques/T1053/005/"
    },
    {
     "id": "T1547.001",
     "name": "Registry Run Keys / Startup Folder",
     "url": "https://attack.mitre.org/techniques/T1547/001/"
    },
    {
     "id": "T1562.001",
     "name": "Disable or Modify Tools",
     "url": "https://attack.mitre.org/techniques/T1562/001/"
    },
    {
     "id": "T1572",
     "name": "Protocol Tunneling",
     "url": "https://attack.mitre.org/techniques/T1572/"
    },
    {
     "id": "T1496",
     "name": "Resource Hijacking",
     "url": "https://attack.mitre.org/techniques/T1496/"
    }
   ],
   "recommended_actions": [
    "Patch AhsayCBS to 10.3.4.45 or 9.15.2.70 and take the management interface off the internet where possible.",
    "Block the C2 domain, URL and the file hashes marked block; alert on the mining pool and the gost and chisel hashes.",
    "Look for unexpected .jsp files under webapps\\cbs and webapps\\rps, requests to UpdateReceivers.do, a SYSTEM task named kvm, a local account named wdguest and Defender exclusions you did not add.",
    "If compromised, re-image from a trusted backup and rotate every credential stored in or reachable from the server, including those saved in AhsayCBS."
   ],
   "sources": [
    {
     "url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "name": "Huntress"
    }
   ],
   "indicator_count": 25,
   "block_now_count": 16,
   "hunt_count": 9,
   "hunt_counts": {
    "alert": 9
   },
   "indicator_counts": {
    "sha256": 16,
    "filename": 4,
    "domain": 2,
    "ipv4": 1,
    "url": 1,
    "xmr_address": 1
   },
   "ioas": [],
   "ioa_count": 0,
   "ioa_note": null,
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/block_now.txt",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/defender_xdr_indicators.csv",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.kql",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.spl",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt_raw.spl",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.yaral",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/iocs.csv",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant",
   "indicators": [
    {
     "value": "8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the XMRig cryptominer dropped as C:\\Windows\\SysWOW64\\kvm-agent\\kvm-agent.exe on exploited AhsayCBS servers.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the configuration file for the kvm-agent.exe XMRig miner.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the scheduled task XML that relaunches the miner as SYSTEM every minute with a backdated start time.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the Python loader run from an embedded Python install under the SYSTEM profile.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the decoded marshal-object payload extracted from the main.py loader.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the embedded blob holding the bootstrap, x64 DLL and reflective loader of the Python implant.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the x64 DLL implant extracted from the Python loader, which contacts creepexplosiondarknight[.]com.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the reflective loader component extracted from the Python loader payload.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the JSP loader in webapps\\rps that reads an encrypted payload from PNG pixel data and runs it in memory.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the JSP webshell in webapps\\rps with signed requests, command execution and chunked file transfer.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the keyed JSP webshell that runs commands and returns Base64-encoded output.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "7a13e59d816d68a071a8648e62a7c3c7f929a61c618a2133ab6f511da24f979d",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the JSP webshell using the fixed secret nobody.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "875d0986ddaa51bfb5e03b06df1213cc3bb7966588d6153bdda57f2e3671e986",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the unauthenticated st_*.jsp webshell planted under the AhsayCBS web directories.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "818bb464271a539c96bcbbfea1db7d5a722512041ed8ed10d3f6c7f366190044",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the earlier JSP webshell variant with cmd, del and rm parameters.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "6f6b66cbdc4a5aa5685d0017abd3f65843a28bcc2bb4e5b78d6d12a844a51aa8",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "SHA256 of the gost tunnelling tool staged in a .st<id> folder as wust<id>a.exe or wust<id>b.exe.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "ca5f8e5247f1a044b8be45ef03187726b9af3ac30fd93fb5bb54144e34ed3738",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "SHA256 of the chisel tunnelling tool staged in a .st<id> folder as wust<id>a.exe or wust<id>b.exe.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "creepexplosiondarknight.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Command-and-control domain of the Python-based implant deployed after AhsayCBS exploitation.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "https://creepexplosiondarknight.com/d",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "C2 URL hard-coded in the Python implant's x64 DLL.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "pool-fr.supportxmr.com",
     "type": "domain",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Public Monero mining pool the kvm-agent.exe miner connected to on port 443.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "104.243.43.115",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Mining pool address the kvm-agent.exe miner connected to on port 443.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "83YFdNe2X8KhKnAERfr2hmN8L3tCKatsheuViWhF6qp2ZA4R8rRkBCgMknEycYqasNbX7C5BSrTp97zHUsUHJoZrR6f5SeX",
     "type": "xmr_address",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Monero wallet configured in the kvm-agent.exe miner (pool password zero).",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "kvm-agent.exe",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Miner file name, found in C:\\Windows\\SysWOW64\\kvm-agent\\.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "nsmind.jsp",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Webshell file name planted in webapps\\rps.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "AhsayCBS.jsp",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "JSP loader file name planted in webapps\\rps; check the hash, as the name mimics the product.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    },
    {
     "value": "a2b59a4bb296604b.jsp",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Keyed webshell file name planted under the AhsayCBS web directories.",
     "source_url": "https://www.huntress.com/blog/ahsaycbs-webshells",
     "source_label": "Huntress – Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant",
     "source_name": "Huntress"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.kql",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.spl",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt_raw.spl",
      "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant/hunt.yaral",
     "download": "AhsayCBS-Backup-Server-Exploitation-Webshells-Python-Implant_hunt.yaral"
    }
   ]
  },
  {
   "id": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage",
   "folder": "threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage",
   "name": "CopperDragon: China-Nexus Sparrow Framework Targeting Government and Telecoms",
   "short": "CopperDragon Sparrow framework",
   "category": "APT / espionage",
   "published": "2026-11-10",
   "entry_date": "2026-11-10 17:59",
   "last_updated": "2026-11-10",
   "seq": 10,
   "headline": "China-nexus Sparrow malware supplier behind espionage against government and telecoms in 21 countries",
   "summary": "Check Point Research tracks CopperDragon as a possible supplier of malware and infrastructure, the Sparrow framework, to several China-nexus groups including activity previously reported as FamousSparrow (linked to Salt Typhoon), Earth Estries, TropicTrooper and UAT-9244. A year-long investigation found activity in 21 countries across Europe, Asia and Latin America against government, telecommunications, military, research and critical infrastructure organisations, split into three clusters. SilentDelivery compromises legitimate websites in countries including Germany, France and the Czech Republic and shows selected visitors a fake Chrome certificate error that installs the SquadC backdoor or SparrowDoor. OceanGate exploits internet-facing Linux servers, mainly in India, deploys AnnobinDoor, SparrowShell with a modified Reptile rootkit and trojanised SSH, then moves into Windows. DarkWire targets telecoms and government, mainly in Latin America, with the in-memory CopperDoor and DNS-tunnelling CopperDNS backdoors and LSASS credential theft tools.",
   "caveat": "The report covers about a year of activity and gives no per-address dates, so some IPs may no longer be in use by the operators.",
   "targets": {
    "countries": [
     {
      "code": "CZ",
      "name": "Czech Republic"
     },
     {
      "code": "DE",
      "name": "Germany"
     },
     {
      "code": "FR",
      "name": "France"
     },
     {
      "code": "TW",
      "name": "Taiwan"
     },
     {
      "code": "NP",
      "name": "Nepal"
     },
     {
      "code": "HK",
      "name": "Hong Kong"
     },
     {
      "code": "ID",
      "name": "Indonesia"
     },
     {
      "code": "IN",
      "name": "India"
     }
    ],
    "regions": [
     "Latin America",
     "Europe",
     "Asia"
    ],
    "sectors": [
     "Telecommunications",
     "Government",
     "Military and defence",
     "Research",
     "Critical infrastructure"
    ],
    "note": "Activity in 21 countries across Latin America, Europe and Asia; only the countries named by Check Point are listed. India is the main OceanGate focus; DarkWire is concentrated in Latin America.",
    "source": {
     "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "name": "Check Point Research"
    }
   },
   "mitre": [
    {
     "id": "T1189",
     "name": "Drive-by Compromise",
     "url": "https://attack.mitre.org/techniques/T1189/"
    },
    {
     "id": "T1190",
     "name": "Exploit Public-Facing Application",
     "url": "https://attack.mitre.org/techniques/T1190/"
    },
    {
     "id": "T1574.002",
     "name": "DLL Side-Loading",
     "url": "https://attack.mitre.org/techniques/T1574/002/"
    },
    {
     "id": "T1556",
     "name": "Modify Authentication Process",
     "url": "https://attack.mitre.org/techniques/T1556/"
    },
    {
     "id": "T1003.001",
     "name": "LSASS Memory",
     "url": "https://attack.mitre.org/techniques/T1003/001/"
    },
    {
     "id": "T1071.004",
     "name": "DNS",
     "url": "https://attack.mitre.org/techniques/T1071/004/"
    },
    {
     "id": "T1090",
     "name": "Proxy",
     "url": "https://attack.mitre.org/techniques/T1090/"
    },
    {
     "id": "T1014",
     "name": "Rootkit",
     "url": "https://attack.mitre.org/techniques/T1014/"
    }
   ],
   "recommended_actions": [
    "Block the domains, the C2 IPs marked block and the file hashes; alert on the cloud-hosted IPs rather than blocking them.",
    "Hunt for CertFixer.msi downloads and fake certificate-repair prompts, and for signed applications loading the listed DLL names from unusual folders.",
    "On internet-facing Linux servers, verify the ssh and sshd binaries against package checksums and look for containerd-demo, xfs_rudp and aplk.",
    "Alert on new LSA security packages, LSASS dumps and hidden local administrator accounts, and on unusual DNS MX query volumes to rare domains."
   ],
   "sources": [
    {
     "url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "name": "Check Point Research"
    },
    {
     "url": "https://blog.checkpoint.com/security/copperdragon-uncovering-a-global-china-nexus-cyber-espionage-framework/",
     "label": "Check Point – CopperDragon: Uncovering a Global China-Nexus Cyber Espionage Framework",
     "name": "Check Point"
    }
   ],
   "indicator_count": 158,
   "block_now_count": 116,
   "hunt_count": 42,
   "hunt_counts": {
    "alert": 42
   },
   "indicator_counts": {
    "ipv4": 93,
    "sha256": 51,
    "domain": 14
   },
   "ioas": [],
   "ioa_count": 0,
   "ioa_note": null,
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/block_now.txt",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/defender_xdr_indicators.csv",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.kql",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.spl",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt_raw.spl",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.yaral",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/iocs.csv",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage",
   "indicators": [
    {
     "value": "715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "e9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "f44159bec1d4d3f340652cd3c6e250dcf2bdb266e5400d3e267f0466d290dda0",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "f51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Installer (CertFixer.msi) sample, a fake certificate-repair installer that drops the SquadC backdoor, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbb",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Loader (MSVCR110.dll) sample, a DLL that decrypts and loads the SquadC backdoor in memory, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "054c0ffb08eb7830de1ff2356af4d2ed696f01111a8c2e78e3a4ddc940287e48",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Loader (dtfbase.dll) sample, a DLL that decrypts and loads the SquadC backdoor in memory, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "b60404c1299e69df029d9817dcf69f9fe325ecc990e16bc7758f56ce5714184b",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Loader (WTSAPI32.dll) sample, a DLL that decrypts and loads the SquadC backdoor in memory, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "f23e5391656b178bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SquadC Loader (MSVCR110.dll) sample, a DLL that decrypts and loads the SquadC backdoor in memory, from the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "microsfot.vip",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "microscoft.vip",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "aistei.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "astorialaza.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "135.136.135.54",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.141.235.123",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "109.205.195.131",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "158.255.213.189",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "165.154.227.16",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "45.197.12.11",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "91.210.164.5",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon SilentDelivery watering-hole cluster (Europe and Asia); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "1cd0c608418cca80149ef3077e54969f24cd7ef3f22707cb280fa4b378ffa76b",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperList (filst2.exe) sample, a tool that collects system information and file metadata for staging, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "40880b6fce6f83df4e902cd29d7abb303ffa3f37c429c382f2aaeea34f7be074",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperAdu (adu.exe) sample, a tool that creates a hidden administrator account and enables SMB and remote admin access, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "9fa421adb5c5dac3b2fc1165b0dddd596e82cfd3b08347a91d63f9e88d8718d0",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLsa (g.exe) sample, a malicious LSA security support provider that intercepts credentials at logon, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "3637f4f804cffc3b25222d542e7cb544ee48074ed2e46607e31f9410c17bf223",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the Copperlogger loader (STI.DLL) sample, a DLL loader for the CopperLogger in-memory keylogger, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "1b365975f9ad8a4748b2bbfb36de3be171aeadeb59d497192a8b4d9560b37173",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the Copperlogger sample, an in-memory keylogger capturing keystrokes, clipboard and window context, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "d1da8e2389f48d1d1c0e127f3417e3d3e0dbf54691e22d6d0c863d28b9e7a812",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SparrowDoor loader (hha.dll) sample, a DLL loader for the SparrowDoor backdoor, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "dbdaa8a52246b1e3f9285820db2f976b8ab513926ed972c968fae1c8aeb77056",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SparrowDoor variant sample, an in-memory SparrowDoor backdoor variant, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "46407cc35c48d19c6b1990a03ebdd19321005ce08d5a98acd168fda55a92d946",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the AnnobinDoor (containerd-demo) sample, a Go-based UPX-packed Linux backdoor with shell, SOCKS proxy and SSH tunnelling, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "3e4eef1a641d6060f6144ceba6757df6085d475eedb8b9e61b5feb84e9fb989e",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "SHA256 of the FRP (frpc) sample, an FRP reverse proxy client used for tunnelling, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "cc3544ac194a4ab5f3a60dbedd270192bc01afd2a365b3b136b35d40d8dd3ff0",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the trojanised ssh (ssh) sample, a modified OpenSSH client that captures passwords and key passphrases, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "ea25b021f90dbd1c53cd3490274c5c92856d4f815d85f3ec68600facab2c952f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the trojanised ssh (ssh) sample, a modified OpenSSH client that captures passwords and key passphrases, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "fa28bc5dfc2c37c3104961f5ca80f590259a27743a8aa327c606fb51452b840f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the trojanised sshd (sshd) sample, a modified OpenSSH server that captures incoming login credentials, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "2ea96ea398e9254706ff2761b86302372c149ef090536ad76231e51d7c810a2a",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SparrowShell (xfs_rudp) sample, a Linux SparrowDoor backdoor with remote commands, persistence and pivoting, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SparrowShell (aplk) sample, a Linux SparrowDoor backdoor with remote commands, persistence and pivoting, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SparrowShell Plugin (2000) sample, a SparrowShell plugin module, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SparrowShell Plugin (3000) sample, a SparrowShell plugin module, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the SparrowShell Plugin (4000) sample, a SparrowShell plugin module, from the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "windowsdefender.it.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "windowsupdates.us",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "microupdate.me",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "windefender.net",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.117",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.116",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.125",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.197",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.27",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.75",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.186",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.162",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.215.216.123",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "149.104.90.200",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "151.242.188.220",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "180.149.44.43",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "180.149.44.115",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "194.213.18.178",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "2.56.222.28",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "2.56.222.49",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.185.57.152",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "217.69.13.77",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.54.71.107",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.54.71.56",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.54.71.160",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "45.80.208.195",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "45.80.208.232",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "45.80.208.66",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "45.86.230.60",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "45.90.58.202",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "47.81.8.145",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "89.223.91.91",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "89.44.193.140",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "160.16.83.208",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "153.127.55.77",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "134.255.211.224",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "207.189.10.188",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "91.227.77.172",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "165.154.226.247",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "165.154.243.24",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.60.209.227",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.118.179",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.123.242",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "64.190.113.170",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "154.223.21.194",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "154.205.154.82",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "154.205.154.70",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "37.122.150.133",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.60.195.184",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "103.9.77.116",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "87.236.37.185",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "92.118.127.23",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "130.94.91.53",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "45.39.103.5",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon OceanGate cluster (Asia, mainly India; Linux-to-Windows intrusions); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "4cafda69af3179ceb4a1f5ed864c501279796254709c86ca236be1cf74a8643f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (ncpmif32.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "48dcc07d9f87129e937f5ca2ad5ba56975600efb8a7280a170b2aeeff503f595",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (ncpmif32.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "a47279e4ee703092263e7030c43c61533146c00689e7cb8f2080f18e57d5cf7f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (libjpeg-62.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "d4e4a3f55b875673cfdb6d0687cc3f8890585210806b03082d11fb4fa40b57de",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (libvlccore.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "3317789219e9b3e48fbb8f7af23359a37539597fc4d84649086aec71a21553ee",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (libvlc.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "c049e5e03a04cf54f8aa089c65861342d3fb4aa8d6a2b1c9484637c46ddc3882",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (winfsp.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "f01a73f651f8113bf9672dbe4c50c63ed365a41e4187aaf0a5ab34cd21154046",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (winfsp.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "9332f9cd283d69e9a2a2bb71575054cc71c14b6496ac55f7ff43efdcb6d97a01",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (winfsp-x64.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "12b6d5ca7aca7134032721b6feb8e4d5ad75c886fbf8a5889d3d36971a083681",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (libeay32.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "125525a38abc45e855f848d499582a8100f1428938d4bd3d3eba957072e64e7a",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (libeay32.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "4b1fea3265492ad1d272428447fb5919bbe3184131b12a0ae84caf3bc442718e",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLoader (zCrashReport64.dll) sample, a DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy or CopperLsass, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "4e50f53b5294a6dbd601fc20a607ae85725162b596119f4867311ef0b3f75a6a",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the Shellcode loader (CopperLoader shellcode version) (DukeQt.dll) sample, a shellcode version of the CopperLoader DLL loader, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "f42461c386834d61780da13760a130ed2ea620627b5eebf97b56237058ea380d",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperSplity (zCrashReport64.dll) sample, a CopperSplit loader with service persistence and a payload keyed to the computer name, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "b7060cf7955a1f1caac2bc3d0918c9b1d9daa315c5d82b329acd3bbddb413948",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperSplity (tempdir.dll) sample, a CopperSplit loader with service persistence and a payload keyed to the computer name, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "cb714decdcabe30008546e6fb71bb28e390c9bd186bf2549aaa8fe5b999200a5",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperSplity Helper (asinteg.dll) sample, a helper DLL for the CopperSplit loader, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "de6a3140797f7c00a48b2068127965c3994f92867466259e69c861880e6ec2d8",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperDoor sample, an in-memory modular CopperDoor backdoor with EDR-evasion techniques, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "d08e09a17df22fb39838dcc9e99756830ef5175bc9e03d615adf979dc85ed052",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperDoor sample, an in-memory modular CopperDoor backdoor with EDR-evasion techniques, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "417664cc34360d8519adc7a019408cf8f37f59c95a44e50092d73e38b7889a21",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperDns sample, a CopperDoor variant tunnelling C2 through DNS MX queries, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "fd0861a8269f2bb2fe0adfb4b4610d9675e68474503598f83e87c29b88906f99",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLsass – RPC Lsass injector sample, an in-memory CopperLsass component that injects into LSASS over RPC, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "916a16a4a1eb7393b17574835312725e5cb146995a3cbcdf42fa8b9bebaa51b1",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLsass – Lsass MiniDump (slave.dll) sample, a CopperLsass component that dumps and encrypts LSASS memory, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "675a44c679dea8d40b3885c37168929f976e3a0ecacc7e02c6b07936ac58a9fc",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperLsass – Helper (dep.dll) sample, a CopperLsass helper DLL, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "3a1b7ec461d656524e612b228ce969bfa612c799fb7117bb066352ff776d88da",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the CopperProxy sample, an in-memory SOCKS5 proxy for relaying and internal pivoting, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "ee8c148518c5a416fc7d9b33246e9c98d955f2379aa9c82225e045322c97a043",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the PyProxy (sqlmap.exe) sample, a UDP proxy utility deployed during DarkWire operations, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "4f9d9a6cba88832fcb7cfb845472b63ff15cb9b417f4f02cb8086552c19ceffc",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "SHA256 of the SoftEther (vmtoolsd.exe) sample, a SoftEther VPN binary renamed to look like VMware Tools, used for operator access, from the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "seosnskorea.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "amelicen.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "jamvybez.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "artfingo.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "faceorkut.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "aauctioneer.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Domain listed by Check Point Research as infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America).",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.54.57.12",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.54.45.155",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.60.206.85",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.60.209.65",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.60.242.182",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.60.241.65",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.60.214.237",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "149.104.87.222",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "156.244.2.26",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "149.104.12.128",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "181.41.201.244",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "38.60.241.193",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "149.104.87.228",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "77.111.101.153",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "77.111.101.227",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "77.111.101.11",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.110.120",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.71.215",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.73.14",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.111.30",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.119.130",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.90.160",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.85.243",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.107.140",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.115.152",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "64.176.10.7",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "64.176.6.27",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "45.76.215.17",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "185.93.173.30",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "188.214.157.51",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "108.61.161.250",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "167.179.109.141",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.106.177",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.113.122",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.121.254",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    },
    {
     "value": "216.238.120.8",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "IP address listed by Check Point Research as C2 or staging infrastructure of the CopperDragon DarkWire cluster (telecoms and government, mainly Latin America); the report gives no per-address dates, so it may be older activity.",
     "source_url": "https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/",
     "source_label": "Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe",
     "source_name": "Check Point Research"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.kql",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.spl",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt_raw.spl",
      "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/CopperDragon-Sparrow-Framework-China-Nexus-Espionage/hunt.yaral",
     "download": "CopperDragon-Sparrow-Framework-China-Nexus-Espionage_hunt.yaral"
    }
   ]
  },
  {
   "id": "NotC2-AWS-Native-AI-C2-Proof-of-Concept",
   "folder": "threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept",
   "name": "NotC2: AWS-Native AI C2 Proof of Concept",
   "short": "NotC2 AWS-native AI C2 PoC",
   "category": "Cloud / C2",
   "published": "2026-11-06",
   "entry_date": "2026-11-10 15:14",
   "last_updated": "2026-11-10",
   "seq": 9,
   "headline": "Proof-of-concept C2 built on AWS SQS, Lambda, SNS and Bedrock, with no network IOCs to block",
   "summary": "NotC2 is a proof-of-concept command-and-control framework published by Varonis Threat Labs on 6 November 2026. It assumes the attacker already holds AWS credentials and runs the whole C2 loop on native AWS services: commands arrive through Amazon SQS, a Lambda function executes them, Amazon Bedrock translates natural-language prompts into AWS API calls through a generic tool named execute_aws_operation, and results leave through Amazon SNS to an external HTTPS endpoint. There is no conventional C2 server to block. Varonis has not reported in-the-wild use and published no network indicators. Detection depends on CloudTrail and related AWS logs: new SQS-to-Lambda event source mappings, unexpected Bedrock InvokeModel or Converse calls from Lambda roles, and SNS subscriptions to external endpoints.",
   "caveat": "This is a researcher-published proof of concept. Varonis has not reported in-the-wild use and published no network indicators to block. Hunt in AWS CloudTrail for the behaviours below.",
   "targets": {
    "countries": [],
    "regions": [],
    "sectors": [],
    "note": "Researcher proof of concept with no reported victims.",
    "source": {
     "url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "label": "Varonis – NotC2: How We Built an AI-Powered C2 Channel With AWS Services",
     "name": "Varonis"
    }
   },
   "mitre": [
    {
     "id": "T1078.004",
     "name": "Valid Accounts: Cloud Accounts",
     "url": "https://attack.mitre.org/techniques/T1078/004/"
    },
    {
     "id": "T1059.009",
     "name": "Cloud API",
     "url": "https://attack.mitre.org/techniques/T1059/009/"
    },
    {
     "id": "T1102",
     "name": "Web Service",
     "url": "https://attack.mitre.org/techniques/T1102/"
    },
    {
     "id": "T1567",
     "name": "Exfiltration Over Web Service",
     "url": "https://attack.mitre.org/techniques/T1567/"
    }
   ],
   "recommended_actions": [
    "Hunt CloudTrail for new or unexpected SQS-to-Lambda event source mappings (CreateEventSourceMapping), especially on queues or functions that are new or unused.",
    "Alert on Bedrock InvokeModel or Converse calls from a Lambda execution role that has not previously used Bedrock, particularly if the same role also starts calling unrelated AWS APIs.",
    "Investigate SNS HTTP or HTTPS subscriptions to external endpoints created by a Lambda execution role, and restrict who can create or modify those subscriptions to approved destinations.",
    "Enforce IAM least privilege so compromised identities cannot create queues and functions, pass powerful roles, invoke Bedrock or attach external SNS subscribers; enable CloudTrail data events and Bedrock model-invocation logging to correlate the full loop."
   ],
   "sources": [
    {
     "url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "label": "Varonis – NotC2: How We Built an AI-Powered C2 Channel With AWS Services",
     "name": "Varonis"
    }
   ],
   "indicator_count": 2,
   "block_now_count": 0,
   "hunt_count": 2,
   "hunt_counts": {
    "monitor": 2
   },
   "indicator_counts": {
    "other": 2
   },
   "ioas": [
    {
     "artefact": "SNS Subscribe with protocol http or https, made by a Lambda execution role (assumed-role session, often with exec-env/AWS_Lambda in the user agent)",
     "log_source": "CloudTrail management events (sns.amazonaws.com), or CloudAppEvents with the AWS connector",
     "why": "This is how NotC2 sends command output to the operator's server. Lambda functions rarely create new external subscriptions at runtime.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "SNS subscription to an external HTTP(S) endpoint by a Lambda role",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "SNS ConfirmSubscription for a new external HTTP or HTTPS endpoint",
     "log_source": "CloudTrail management events (sns.amazonaws.com)",
     "why": "NotC2 only receives results once the operator's endpoint confirms the subscription. The source address of the confirmation can point to the receiving server, so record it as a lead.",
     "action": "hunt",
     "has_query": true,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "SNS subscription confirmed for a new external endpoint",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "SNS CreateTopic called by a Lambda execution role",
     "log_source": "CloudTrail management events (sns.amazonaws.com)",
     "why": "The NotC2 function creates or resolves its results topic at runtime (create_topic). Application functions usually publish to topics that already exist.",
     "action": "hunt",
     "has_query": true,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "SNS topic created by a Lambda role",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "New SQS-to-Lambda event source mapping (CreateEventSourceMapping with an SQS queue ARN)",
     "log_source": "CloudTrail management events (lambda.amazonaws.com)",
     "why": "The mapping is what makes each queued command run the function automatically. New mappings on new or unused queues and functions are unusual outside deployments.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "New SQS-to-Lambda trigger",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "One identity calling sqs:CreateQueue, lambda:CreateFunction and lambda:CreateEventSourceMapping within an hour",
     "log_source": "CloudTrail management events",
     "why": "These are the minimum deployment steps Varonis lists for NotC2 when a suitable Lambda role already exists (iam:PassRole is a permission check, not a separate event).",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "Queue, function and trigger created by one identity within an hour",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "SQS queue named NotC2-Commands, or queue, function or topic names containing NotC2",
     "log_source": "CloudTrail management events (sqs CreateQueue requestParameters.queueName), AWS CLI command lines on endpoints",
     "why": "NotC2-Commands is the command queue name in Varonis's published screenshots (created with aws sqs create-queue --queue-name NotC2-Commands). The name is trivial to change, so a miss means little.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "AWS resources named NotC2",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "Bedrock InvokeModel, Converse or ConverseStream from a Lambda execution role that has not used Bedrock in the previous 30 days",
     "log_source": "CloudTrail management events (bedrock.amazonaws.com)",
     "why": "Bedrock is NotC2's command interpreter. Varonis calls out a sudden rise in Converse or InvokeModel calls from a Lambda role, especially one new to Bedrock.",
     "action": "hunt",
     "has_query": true,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "First Bedrock use by a Lambda role",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "The same Lambda role calling Bedrock and broad discovery APIs (ec2 DescribeInstances, dynamodb ListTables, rds DescribeDBInstances, lambda ListFunctions, s3 ListBuckets) in the same hour",
     "log_source": "CloudTrail management events",
     "why": "Varonis shows NotC2 using Bedrock to enumerate EC2, DynamoDB, databases and Lambda functions; Bedrock use plus unrelated APIs from one role strengthens the signal.",
     "action": "hunt",
     "has_query": true,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "Lambda role calling Bedrock and discovery APIs together",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "A Bedrock tool definition named execute_aws_operation, or prompts starting with \"ai:\"",
     "log_source": "Bedrock model invocation logs (CloudWatch Logs or S3); not in CloudTrail",
     "why": "NotC2 passes every AWS action through one generic tool, execute_aws_operation, with service, operation, parameters and region fields. Only model invocation logging records the request body.",
     "action": "alert",
     "has_query": false,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "Bedrock function named execute_aws_operation",
     "queries": [
      "SPL"
     ]
    },
    {
     "artefact": "Lambda log lines \"SNS message body:\" followed by Command:, Target:, Exit Code:, Output: and Error: fields, or functions configured with SNS_TOPIC_ARN or SNS_TOPIC_NAME",
     "log_source": "Lambda CloudWatch Logs and function configuration",
     "why": "These strings appear in the NotC2 code shown in Varonis's screenshots (the results message format and the topic lookup). Default names are easy to change, so treat a match as a strong lead and a miss as no proof.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "Lambda logs relaying commands through SNS",
     "queries": [
      "SPL"
     ]
    },
    {
     "artefact": "An SQS message from an unexpected source, then a Lambda run, Bedrock calls, other AWS API calls and an SNS publish to an external subscriber within minutes, all on the same queue, function and topic",
     "log_source": "CloudTrail data events (SQS, Lambda, SNS), SNS delivery-status logs, Bedrock invocation logs",
     "why": "Each event is normal on its own; Varonis says the sequence is the C2 loop. Data events are not logged by default and must be enabled first.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_name": "Varonis",
     "title": "Full SQS to Lambda to Bedrock to SNS command chain",
     "queries": []
    }
   ],
   "ioa_count": 11,
   "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.",
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/block_now.txt",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_block_now.txt"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.kql",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.spl",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt_raw.spl",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.yaral",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/iocs.csv",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept",
   "indicators": [
    {
     "value": "NotC2",
     "type": "other",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Name of the Varonis proof-of-concept C2 framework built on Amazon SQS, Lambda, SNS and Bedrock. No network indicators were published; hunt CloudTrail for the documented behaviours.",
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_label": "Varonis – NotC2: How We Built an AI-Powered C2 Channel With AWS Services",
     "source_name": "Varonis"
    },
    {
     "value": "execute_aws_operation",
     "type": "other",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Generic Bedrock tool specification used by NotC2 to turn a natural-language prompt into an AWS service, operation and parameters.",
     "source_url": "https://www.varonis.com/blog/notc2-ai-powered-c2-channel",
     "source_label": "Varonis – NotC2: How We Built an AI-Powered C2 Channel With AWS Services",
     "source_name": "Varonis"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.kql",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.spl",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt_raw.spl",
      "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/NotC2-AWS-Native-AI-C2-Proof-of-Concept/hunt.yaral",
     "download": "NotC2-AWS-Native-AI-C2-Proof-of-Concept_hunt.yaral"
    }
   ]
  },
  {
   "id": "Phexia-macOS-ClickFix-Stealer-Polygon-C2",
   "folder": "threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2",
   "name": "Phexia: macOS ClickFix Stealer with Polygon C2",
   "short": "Phexia macOS ClickFix stealer",
   "category": "Malware / macOS",
   "published": "2026-11-04",
   "entry_date": "2026-11-10 15:14",
   "last_updated": "2026-11-10",
   "seq": 8,
   "headline": "macOS ClickFix backdoor and stealer that resolves C2 from a Polygon smart contract",
   "summary": "Phexia is a modular macOS backdoor and infostealer sold to several criminal groups and delivered through ClickFix lures that get the victim to paste a curl-to-bash command into Terminal. WithSecure has tracked infections since late 2025, with a growing number of cases in 2026. From May 2026 the latest builds have fetched their C2 hostname from a Polygon smart contract (EtherHiding) rather than a hardcoded domain, so taking a C2 domain down does not stop new lookups. Once running, the backdoor steals the login password, keychain material, and browser and password-manager data, and has been used to deploy the XMRig Monero miner. A second contract appeared in a build installed on 27 October 2026. Older C2 domains can remain in use after the contract changes, and reinfection can leave more than one build active on the same Mac.",
   "caveat": null,
   "targets": {
    "countries": [],
    "regions": [],
    "sectors": [],
    "note": "WithSecure describes macOS users reached through ClickFix lures, without naming countries or sectors.",
    "source": {
     "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "name": "WithSecure"
    }
   },
   "mitre": [
    {
     "id": "T1204.004",
     "name": "Malicious Copy and Paste",
     "url": "https://attack.mitre.org/techniques/T1204/004/"
    },
    {
     "id": "T1059.002",
     "name": "AppleScript",
     "url": "https://attack.mitre.org/techniques/T1059/002/"
    },
    {
     "id": "T1543.001",
     "name": "Launch Agent",
     "url": "https://attack.mitre.org/techniques/T1543/001/"
    },
    {
     "id": "T1102.001",
     "name": "Dead Drop Resolver",
     "url": "https://attack.mitre.org/techniques/T1102/001/"
    },
    {
     "id": "T1555.001",
     "name": "Keychain",
     "url": "https://attack.mitre.org/techniques/T1555/001/"
    },
    {
     "id": "T1041",
     "name": "Exfiltration Over C2 Channel",
     "url": "https://attack.mitre.org/techniques/T1041/"
    },
    {
     "id": "T1496.001",
     "name": "Compute Hijacking",
     "url": "https://attack.mitre.org/techniques/T1496/001/"
    }
   ],
   "recommended_actions": [
    "Block the C2 and delivery domains and the stolen-data upload address 62.60.226.50; do not block the public Polygon RPC endpoints or the mining pools, which are legitimate services.",
    "Hunt DeviceProcessEvents for a Terminal-spawned curl piped to bash, osascript droppers, dscl . authonly password checks, security find-generic-password keychain reads, and eth_call lookups of the published Polygon contracts.",
    "Inspect ~/Library/LaunchAgents for com.<16 lowercase letters> and com.Apple.<16 lowercase letters> plists whose arguments pipe base64 into osascript; unload each confirmed job before deleting it, and look for more than one build.",
    "On a confirmed infection, collect ~/.passphrase, ~/.txid and the staging folders, then from a trusted device reset affected passwords, revoke sessions and tokens, and check for XMRig under /tmp/rigupdater or /tmp/applecomlistupdate."
   ],
   "sources": [
    {
     "url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "name": "WithSecure"
    }
   ],
   "indicator_count": 48,
   "block_now_count": 25,
   "hunt_count": 23,
   "hunt_counts": {
    "monitor": 13,
    "alert": 10
   },
   "indicator_counts": {
    "domain": 24,
    "filename": 12,
    "other": 4,
    "eth_address": 2,
    "url": 2,
    "xmr_address": 2,
    "function_selector": 1,
    "ipv4": 1
   },
   "ioas": [],
   "ioa_count": 0,
   "ioa_note": null,
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/block_now.txt",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/defender_xdr_indicators.csv",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.kql",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.spl",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt_raw.spl",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.yaral",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/iocs.csv",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2",
   "indicators": [
    {
     "value": "hf98x4d.site",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 14 Jun 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "apdhlhs3.xyz",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 6 Jul 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "j9af4sr.guru",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 16 Jul 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "67sixcebeh.surf",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 27 Jul 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "stv4ec5.shop",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 4 Aug 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "vg5sgxv.lol",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 25 Aug 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "d9mjs.sbs",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 7 Sep 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "jse8x92s.me",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 11 Sep 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "couhe79.xyz",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 2 Oct 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "xzttyt.xyz",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 12 Oct 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "secdarvin2026.icu",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 20 Oct 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "oreshnik.top",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 22 Oct 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "svo-zv.pro",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 24 Oct 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "dhsbdgs.icu",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Phexia C2 domain first seen in WithSecure telemetry on 27 Oct 2026. This hostname was resolved from the second Polygon contract.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "hackersteersman.digital",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "coeuzgoq.bahisbiz.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "kefavkd.nextbahis.sex",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "d9j.everunningshoes.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "nox.usa-synadentix.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "zwa8.meritbethizligir.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "355uz90z.bolnhurstrally.site",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "7ulk.irvinaurus.fit",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host from which the ClickFix-pasted command downloaded a first-stage shell script (update.sh, script.sh, clear-cache.sh or Terminal.sh).",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "https://coeuzgoq.bahisbiz.com//update.sh",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Exact first-stage URL, including the double slash, downloaded on 6 Jul 2026; WithSecure says it matches public reporting from that day.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "62.60.226.50",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Second upload server used to exfiltrate stolen-data archives over unencrypted HTTP to /upload.php.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "http://62.60.226.50/upload.php",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Plain-HTTP upload URL on 62.60.226.50 that received the same /tmp/*.zip stolen-data archive as the C2 upload.php.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0",
     "type": "eth_address",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Polygon smart contract used as the Phexia C2 dead-drop from June to October 2026; queried with selector 0x2686ecea (getServerURL()). Hunt for eth_call; do not block.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "0x3445fB8Df432320251f611e691fe6B0C6664C960",
     "type": "eth_address",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Second Polygon C2 dead-drop contract, queried by a build installed on 27 Oct 2026; resolved to dhsbdgs.icu. Hunt for eth_call; do not block.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "0x2686ecea",
     "type": "function_selector",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "ABI function selector for getServerURL(), sent as eth_call data against the published Polygon contracts to retrieve the C2 hostname.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "polygon.drpc.org",
     "type": "other",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Legitimate public Polygon RPC endpoint used by the Phexia loader for eth_call C2 resolution. Treat as suspicious only when contacted by non-browser processes such as osascript; do not block.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "polygon.publicnode.com",
     "type": "other",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Legitimate public Polygon RPC endpoint used by the Phexia loader for eth_call C2 resolution. Treat as suspicious only when contacted by non-browser processes such as osascript; do not block.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "polygon-mainnet.gateway.tatum.io",
     "type": "other",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Legitimate public Polygon RPC endpoint used by the Phexia loader for eth_call C2 resolution. Treat as suspicious only when contacted by non-browser processes such as osascript; do not block.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "tenderly.rpc.polygon.community",
     "type": "other",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Legitimate public Polygon RPC endpoint used by the Phexia loader for eth_call C2 resolution. Treat as suspicious only when contacted by non-browser processes such as osascript; do not block.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "pool.hashvault.sh",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Legitimate HashVault Monero pool (TLS port 443) used by XMRig deployed through Phexia ledger and shell tasking from 20 Oct 2026. Alert; do not block the pool for all traffic.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "pool.supportxmr.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Legitimate SupportXMR Monero pool (port 3333) used by XMRig deployed through Phexia from 26 Oct 2026. Alert; do not block the pool for all traffic.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "4ApYm7Cp1QKHYd34eWHTLMR9JwGxEiPkP5GYNbD7UaGUBsAE31oRt8zbCiz7yV6BbHa5mZUGYxeMRbihPXxo9o3vNWJxx2L",
     "type": "xmr_address",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Monero wallet used by XMRig first observed on 20 Oct 2026 via pool.hashvault.sh, and still used on 26 Oct 2026 after the switch to pool.supportxmr.com.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "82hSZSZNcbCdWd3ESkMDnC5cegaJnFhcG8PUBkMPof5mEdMDCF8cLcE1QuW4h82ggwi4qtfnRwMEgZPKQEnogkvmLFuRLFv",
     "type": "xmr_address",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Second Monero wallet used by XMRig, first observed on 26 Oct 2026 via pool.supportxmr.com.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "update.sh",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "monitor",
     "description": "Often used name of the first-stage shell script downloaded by the pasted Terminal command. Common script name: hunt it only in a Terminal curl-to-bash chain, do not block by name.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "script.sh",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "monitor",
     "description": "First-stage shell script name also observed; earlier infections used this form, including a May pre-Polygon sample. Common script name: hunt it only in a Terminal curl-to-bash chain, do not block by name.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "clear-cache.sh",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "monitor",
     "description": "First-stage shell script name also observed on delivery hosts. Common script name: hunt it only in a Terminal curl-to-bash chain, do not block by name.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "Terminal.sh",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "monitor",
     "description": "First-stage shell script name also observed on delivery hosts. Common script name: hunt it only in a Terminal curl-to-bash chain, do not block by name.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "~/Library/LaunchAgents/com.<16 lowercase letters>.plist",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "LaunchAgent persistence used by June to mid-September 2026 builds; the ProgramArguments decode base64 and pipe the loader to osascript.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "~/Library/LaunchAgents/com.Apple.<16 lowercase letters>.plist",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "LaunchAgent persistence used by October 2026 builds, impersonating an Apple component with a capitalised com.Apple. prefix.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "~/.passphrase",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Hidden file where the backdoor stores the captured login password in plaintext after a successful dscl . authonly check.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "~/.txid",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Hidden file holding the Phexia build identifier used in C2 POST bodies.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "~/tempFolderC/",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Staging directory created by a separate AppleScript that copies Safari Cookies.binarycookies via Finder.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "/tmp/updstat.txt",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "File that captures the result of the plain-HTTP stolen-data upload to 62.60.226.50.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "/tmp/rigupdater/",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Working directory used by XMRig when it was first deployed through Phexia tasking on 20 Oct 2026.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    },
    {
     "value": "/tmp/applecomlistupdate/",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Working directory used by XMRig from 26 Oct 2026, renamed to masquerade as an Apple component.",
     "source_url": "https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/",
     "source_label": "WithSecure – Inside Phexia: A macOS malware delivered through ClickFix",
     "source_name": "WithSecure"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.kql",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.spl",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt_raw.spl",
      "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Phexia-macOS-ClickFix-Stealer-Polygon-C2/hunt.yaral",
     "download": "Phexia-macOS-ClickFix-Stealer-Polygon-C2_hunt.yaral"
    }
   ]
  },
  {
   "id": "Turla-Cereal-Exchange-Espionage-Toolset",
   "folder": "threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset",
   "name": "Turla Cereal: Exchange Server Espionage Toolset",
   "short": "Turla Cereal Exchange toolset",
   "category": "APT / espionage",
   "published": "2026-11-10",
   "entry_date": "2026-11-10 13:43",
   "last_updated": "2026-11-10",
   "seq": 7,
   "headline": "Russia-aligned Turla .NET toolset turning Exchange servers into passive backdoors",
   "summary": "ESET attributes Cereal, a previously undocumented modular .NET toolset, with high confidence to the Russia-aligned APT group Turla. It was found on Microsoft Exchange servers of governmental organisations in Kazakhstan (November 2025) and Romania, where an email collection module injected into legitimate Exchange processes taps the mail transport pipeline and was configured to pick out email sent to or from NATO and the EU. There is no external C2: the CerealNeuron passive backdoor turns the victim's own Exchange server into the C2 through HttpListener URL prefixes, and the loaders abuse DLL search-order hijacking and the .NET native image cache.",
   "caveat": null,
   "targets": {
    "countries": [
     {
      "code": "KZ",
      "name": "Kazakhstan"
     },
     {
      "code": "RO",
      "name": "Romania"
     }
    ],
    "regions": [],
    "sectors": [
     "Government"
    ],
    "note": "Two national governmental organisations; the Romanian implant filtered email to or from NATO and EU addresses.",
    "source": {
     "url": "https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/",
     "label": "welivesecurity.com",
     "name": "WeLiveSecurity"
    }
   },
   "mitre": [
    {
     "id": "T1114",
     "name": "Email Collection",
     "url": "https://attack.mitre.org/techniques/T1114/"
    },
    {
     "id": "T1505",
     "name": "Server Software Component",
     "url": "https://attack.mitre.org/techniques/T1505/"
    },
    {
     "id": "T1574.001",
     "name": "DLL Search Order Hijacking",
     "url": "https://attack.mitre.org/techniques/T1574/001/"
    },
    {
     "id": "T1055",
     "name": "Process Injection",
     "url": "https://attack.mitre.org/techniques/T1055/"
    },
    {
     "id": "T1620",
     "name": "Reflective Code Loading",
     "url": "https://attack.mitre.org/techniques/T1620/"
    }
   ],
   "recommended_actions": [
    "Hash-sweep every Exchange server for the SHA1 values in iocs.csv (or run hunt.kql); test file blocks on one server first because the loaders use Exchange and WMI file names.",
    "Hunt IIS and HTTP.sys logs for the CerealNeuron URL prefixes; ESET found no external C2 IPs to block.",
    "Check System32\\wbem for ncobjapi.dll and wbemcomn.dll copies whose hashes do not match Microsoft's.",
    "If found, rebuild the Exchange server and review transport rules and mail flow for exfiltration."
   ],
   "sources": [
    {
     "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "label": "ESET – Turla Cereal white paper (PDF)",
     "name": "ESET"
    },
    {
     "url": "https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/",
     "label": "ESET WeLiveSecurity – Exchange for breakfast: Turla's Cereal tricks are not for kids",
     "name": "WeLiveSecurity"
    }
   ],
   "indicator_count": 26,
   "block_now_count": 18,
   "hunt_count": 8,
   "hunt_counts": {
    "alert": 8
   },
   "indicator_counts": {
    "sha1": 18,
    "url": 5,
    "filename": 3
   },
   "ioas": [],
   "ioa_count": 0,
   "ioa_note": null,
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/block_now.txt",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/defender_xdr_indicators.csv",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.kql",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.spl",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt_raw.spl",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.yaral",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/iocs.csv",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset",
   "indicators": [
    {
     "value": "4a3c263977417fb6977b0e598c9e3bc5924f390c",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as Microsoft.Exchange.Data.Transport.ni.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "7742c6b0aaf114335cef7ebab11290cb18a0b8b3",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as version.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "afe448dd95494cd14438f04f0c5f6b384664a3b7",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as version.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "4a65040646e354303f067d47aa1c953d467f65cb",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as Microsoft.Search.Platform.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "d1e17520a2435edcdcc47f582381416fbdf75f94",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as Microsoft.Ceres.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "7ab784d0049890d9844aee7f214ba173e3cc23be",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as wbemcomn.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "5d80118b1ee974936322475f740ab3aeff70b8f3",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as EdgeTransport.ni.exe, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "d51c58c2e95d4561848e0a5a8b9fb33c847c50a4",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as iph.dat, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "5b94fe76ec4feb0b5cb6ea3bca4c48d2fe22597b",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCA) written as ncobjapi.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "1408a8f62b09a5ad0dff279b2878d8f59f70a330",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as Microsoft.Exchange.Search.Mdb.ni.dll, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "3d1a534ce0d0c293f62ece556cbc6d0728213104",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealLoader (ESET detection MSIL/Agent.YCC) written as Microsoft.Exchange.EdgeSyncSvc.ni.exe, the Turla Cereal loader on compromised Exchange servers; test the block on one server first.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "ad85fbf2cc879d4325bce1e6fb5f12ab59e3d387",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealRunner (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "3ea03188dba8898d97e965732c1d6a68c5437edc",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealSprinter (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "3fba18af966deacf7ae09e4d4238952dd90a6d6f",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealHermit (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "eb9ba1da5363f5d04e2f98673595fce93f39a78e",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealIron (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "0b4e4a1ce7fee91bfc62b2a2ec572c325642bb60",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of CerealMoth (ESET detection MSIL/Agent.YBZ), a Turla Cereal module that runs in memory on compromised Exchange servers.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "a4e477ce257f2c635401ef554e05506c080967c0",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of the Turla Cereal x86 bootstrapper DLL (ESET detection Win32/Agent.AIOQ), run in memory on compromised Exchange servers.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "a5be8706032a0798fd63214a9f22efa6309355f5",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA1 of the Turla Cereal x64 bootstrapper DLL (ESET detection Win32/Agent.AIOQ), run in memory on compromised Exchange servers.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "iph.dat",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "CerealLoader payload file name listed in the ESET IOC table.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "C:\\Windows\\System32\\wbem\\ncobjapi.dll",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Path where CerealLoader is written and loaded by the WMI Provider Host; a legitimate file of the same name exists in System32, so check the hash.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "C:\\Windows\\System32\\wbem\\wbemcomn.dll",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "CerealLoader planted in System32\\wbem for search-order hijacking of WmiPrvSE.exe; the legitimate copy lives in C:\\Windows\\System32, not \\wbem.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "/owa/sdds/",
     "type": "url",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "HttpListener prefix https://*:443/owa/sdds/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "/AUTODISCOVER/MICROSOFT.EXCHANGE.PROXYSERVICE/",
     "type": "url",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "HttpListener prefix https://*:443/AUTODISCOVER/MICROSOFT.EXCHANGE.PROXYSERVICE/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "/AUTODISCOVER/INTEGRATED/API/",
     "type": "url",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "HttpListener prefix https://*:443/AUTODISCOVER/INTEGRATED/API/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "/AUTODISCOVER/PROXYSERVICE/",
     "type": "url",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "HttpListener prefix https://*:443/AUTODISCOVER/PROXYSERVICE/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    },
    {
     "value": "/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/",
     "type": "url",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "HttpListener prefix https://*:443/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/ registered by the CerealNeuron passive backdoor on the victim's own Exchange server; hunt in IIS/HTTP.sys logs, not an external URL to block.",
     "source_url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf",
     "source_label": "ESET – Turla Cereal white paper (PDF)",
     "source_name": "ESET"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.kql",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.spl",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt_raw.spl",
      "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Turla-Cereal-Exchange-Espionage-Toolset/hunt.yaral",
     "download": "Turla-Cereal-Exchange-Espionage-Toolset_hunt.yaral"
    }
   ]
  },
  {
   "id": "MSP-Process-GDAP-Breach-Entra-Token-Abuse",
   "folder": "threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse",
   "name": "MSP Process GDAP Breach: Entra Token Abuse in Partner Tenants",
   "short": "MSP Process GDAP breach",
   "category": "Supply chain / identity",
   "published": "2026-11-09",
   "entry_date": "2026-11-10 13:43",
   "last_updated": "2026-11-10",
   "seq": 6,
   "headline": "Stolen partner app secrets used for Graph token abuse in MSP customer tenants",
   "summary": "On 7 November 2026 MSP Process, a GDAP tooling vendor serving over 1,000 MSPs, told partners that an attacker had accessed one of its storage accounts (09:56–14:40 UTC) holding partners' Entra app client IDs and secrets, admin refresh tokens and GDAP relationship lists. The attacker used the stolen secrets to get Microsoft Graph tokens in partner and customer tenants with no user sign-in or MFA, and Huntress reported successful malicious token grants in 47 tenants. Password-spray and client-secret attempts from a residential proxy pool preceded the breach on 6–7 November. Any tenant connected to MSP Process should be treated as exposed.",
   "caveat": null,
   "targets": {
    "countries": [],
    "regions": [],
    "sectors": [
     "Managed service providers",
     "MSP customers"
    ],
    "note": "MSP Process serves over 1,000 MSPs; Huntress reported malicious token grants in 47 partner and customer tenants. No countries named.",
    "source": {
     "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "name": "The Stack"
    }
   },
   "mitre": [
    {
     "id": "T1199",
     "name": "Trusted Relationship",
     "url": "https://attack.mitre.org/techniques/T1199/"
    },
    {
     "id": "T1078.004",
     "name": "Valid Accounts: Cloud Accounts",
     "url": "https://attack.mitre.org/techniques/T1078/004/"
    },
    {
     "id": "T1550.001",
     "name": "Application Access Token",
     "url": "https://attack.mitre.org/techniques/T1550/001/"
    },
    {
     "id": "T1110.003",
     "name": "Password Spraying",
     "url": "https://attack.mitre.org/techniques/T1110/003/"
    }
   ],
   "recommended_actions": [
    "Rotate the client secret of every Entra app connected to MSP Process and revoke the admin refresh token used to connect it.",
    "Review Entra service-principal and non-interactive sign-ins for MSP Process app IDs from any IP other than 64.236.54.139.",
    "Audit app role assignments, new app secrets and GDAP security-group membership changes since 6 November 2026.",
    "Block 172.169.63.30 with a Conditional Access named location; most other IPs are shared Azure or proxy space, so alert rather than block."
   ],
   "sources": [
    {
     "url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant",
     "label": "Inforcer – When a GDAP vendor is breached, check your own tenant",
     "name": "Inforcer"
    },
    {
     "url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "name": "The Stack"
    }
   ],
   "indicator_count": 57,
   "block_now_count": 1,
   "hunt_count": 56,
   "hunt_counts": {
    "alert": 54,
    "block": 1,
    "monitor": 1
   },
   "indicator_counts": {
    "ipv4": 57
   },
   "ioas": [
    {
     "artefact": "Service principal sign-ins for the app connected to MSP Process from any address other than 64.236.54.139, from 09:56 UTC on 7 November 2026",
     "log_source": "Entra service principal sign-in logs, in the MSP's own tenant where the app is registered",
     "why": "MSP Process says to treat any other address as suspicious. The stolen secrets were used to get Microsoft Graph tokens without a user sign-in.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant",
     "source_name": "Inforcer",
     "title": "App sign-ins from outside the MSP Process address",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "One address using several partner app secrets within seconds, first failing (invalid client secret, missing service principal) and succeeding about an hour later",
     "log_source": "Entra service principal sign-in logs",
     "why": "Inforcer saw this scripted pattern from 172.169.63.30 between 10:28 and 11:31 UTC on 7 November. The address is shared Azure space, so the pattern matters more than the IP.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant",
     "source_name": "Inforcer",
     "title": "One address trying several partner app secrets",
     "queries": []
    },
    {
     "artefact": "Non-interactive user sign-ins with the connecting admin's refresh token from an address other than 64.236.54.139",
     "log_source": "Entra non-interactive user sign-in logs",
     "why": "Stolen refresh tokens show up here. Inforcer found the attempts failed where the token had expired through inactivity.",
     "action": "alert",
     "has_query": false,
     "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant",
     "source_name": "Inforcer",
     "title": "Admin refresh token used from another address",
     "queries": []
    },
    {
     "artefact": "New app credentials, app role assignments, new users or GDAP security-group membership changes initiated by the MSP Process app since 6 November 2026",
     "log_source": "Entra audit logs",
     "why": "The app permissions MSP Process asked for (AppRoleAssignment.ReadWrite.All, Application.ReadWrite.All, Directory.ReadWrite.All) allow exactly these changes.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant",
     "source_name": "Inforcer",
     "title": "Tenant changes made by the MSP Process app",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "Microsoft Graph requests made with the app's tokens from an address other than 64.236.54.139",
     "log_source": "Microsoft Graph activity logs (only if already enabled on 7 November)",
     "why": "Sign-in and audit logs cannot show what a token read; Graph activity logs can, and UniqueTokenIdentifier links a sign-in to its Graph requests.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant",
     "source_name": "Inforcer",
     "title": "Graph requests with the app's tokens from another address",
     "queries": []
    }
   ],
   "ioa_count": 5,
   "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.",
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/block_now.txt",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/defender_xdr_indicators.csv",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.kql",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.spl",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt_raw.spl",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.yaral",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/iocs.csv",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse",
   "indicators": [
    {
     "value": "172.169.63.30",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Azure IP that used several partners' stolen MSP Process app secrets to get Microsoft Graph tokens within seconds on 7 Nov 2026 (11:30–11:31 UTC), reported by Inforcer and Huntress.",
     "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant",
     "source_label": "Inforcer – When a GDAP vendor is breached, check your own tenant",
     "source_name": "Inforcer"
    },
    {
     "value": "64.236.54.139",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Legitimate MSP Process egress IP; do not block. Sign-ins by MSP Process app IDs from any other address are suspicious.",
     "source_url": "https://www.inforcer.com/insights/when-a-gdap-vendor-is-breached-check-your-own-tenant",
     "source_label": "Inforcer – When a GDAP vendor is breached, check your own tenant",
     "source_name": "Inforcer"
    },
    {
     "value": "172.169.207.227",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.169.187.35",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.169.63.29",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.169.63.35",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.169.29.166",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.169.58.181",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.169.206.55",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.168.41.166",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.168.117.170",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.168.253.63",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.112.134",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.112.237",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.112.251",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.112.221",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.112.120",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.112.111",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.113.15",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.113.23",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "64.236.113.32",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.230.237.27",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.230.237.16",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.230.237.18",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.230.237.21",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.230.237.13",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.230.237.9",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.228.167.149",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.228.167.121",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "52.154.255.0",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "40.89.240.243",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "40.89.240.113",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "40.83.16.22",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "13.89.111.197",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "20.84.171.92",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "130.131.144.244",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "135.233.107.143",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "172.215.180.155",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Microsoft Azure IP on the Huntress list of addresses behind malicious MSP Process app sign-ins (user agents node, Wget, Python-urllib/3.6, Mozilla/5.0); shared cloud space, so alert on Entra service-principal sign-ins rather than block.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "143.198.68.206",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "DigitalOcean host that tried a third-party password-reset app's client secret on 6 Nov 2026 at 22:04 (Python-urllib/3.6, curl/7.58.0), per Huntress.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "187.15.92.123",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "NordVPN exit IP used to obtain the first malicious token (curl/7.88.1); shared VPN exit, alert only.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "178.61.224.154",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "46.148.159.8",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "109.171.38.144",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "213.5.16.40",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "91.210.236.74",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "202.44.193.79",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "24.220.57.81",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "188.137.78.112",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "188.25.140.193",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "193.188.198.233",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "46.151.219.60",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "178.205.170.18",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "188.137.76.53",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "213.226.214.89",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "177.52.113.45",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "46.253.235.237",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    },
    {
     "value": "138.118.86.78",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Residential proxy IP used in the 6–7 Nov 2026 password spray and client-secret attempts against MSP Process apps (Python-urllib/3.11, curl/7.88.1); Huntress says none obtained a token.",
     "source_url": "https://www.thestack.technology/msp-software-firm-hacked-with-customer-entra-environments-now-getting-pwned/",
     "source_label": "The Stack – MSP software firm hacked, customer Entra environments getting pwned (Huntress IOCs)",
     "source_name": "The Stack"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.kql",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.spl",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt_raw.spl",
      "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/MSP-Process-GDAP-Breach-Entra-Token-Abuse/hunt.yaral",
     "download": "MSP-Process-GDAP-Breach-Entra-Token-Abuse_hunt.yaral"
    }
   ]
  },
  {
   "id": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack",
   "folder": "threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack",
   "name": "Ethersphere bee-js and Swarm Desktop Supply-Chain Attack (SleepyDuck / evjawbreaker)",
   "short": "bee-js / Swarm Desktop supply chain",
   "category": "Supply chain / npm",
   "published": "2026-11-09",
   "entry_date": "2026-11-10 13:43",
   "last_updated": "2026-11-10",
   "seq": 5,
   "headline": "Malicious npm and desktop releases dropping a backdoor with Ethereum-based C2",
   "summary": "On 9 November 2026 an attacker abused Ethersphere's own GitHub release workflow to publish a malicious @ethersphere/bee-js 13.3.0 to npm and a trojanised Swarm Desktop 0.56.2 release on GitHub. Both carry a small loader that fetches and runs JavaScript from api.frameworkmetrics.xyz; later stages find their C2 through an Ethereum smart-contract dead drop shared with the SleepyDuck / EtherDuck campaign, steal Swarm wallet keys, and install the evjawbreaker backdoor on Linux and macOS or a rogue ScreenConnect client on Windows. npm removed 13.3.0 about 75 minutes after publication; the last clean bee-js version is 13.2.0.",
   "caveat": null,
   "targets": {
    "countries": [],
    "regions": [],
    "sectors": [
     "Cryptocurrency and Web3"
    ],
    "note": "Swarm network node operators and developers who installed bee-js 13.3.0 or Swarm Desktop 0.56.2; the payload steals Swarm wallet keys. No countries named.",
    "source": {
     "url": "https://socket.dev/blog/bee-js-compromise",
     "label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "name": "Socket"
    }
   },
   "mitre": [
    {
     "id": "T1195.002",
     "name": "Compromise Software Supply Chain",
     "url": "https://attack.mitre.org/techniques/T1195/002/"
    },
    {
     "id": "T1102.001",
     "name": "Dead Drop Resolver",
     "url": "https://attack.mitre.org/techniques/T1102/001/"
    },
    {
     "id": "T1543.002",
     "name": "Systemd Service",
     "url": "https://attack.mitre.org/techniques/T1543/002/"
    },
    {
     "id": "T1543.001",
     "name": "Launch Agent",
     "url": "https://attack.mitre.org/techniques/T1543/001/"
    },
    {
     "id": "T1219",
     "name": "Remote Access Software",
     "url": "https://attack.mitre.org/techniques/T1219/"
    },
    {
     "id": "T1567.004",
     "name": "Exfiltration Over Webhook",
     "url": "https://attack.mitre.org/techniques/T1567/004/"
    }
   ],
   "recommended_actions": [
    "Search lockfiles and installed apps for @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2; pin bee-js to 13.2.0.",
    "Block the frameworkmetrics.xyz domains, the C2 IPs and the exact webhook.site and pastebin URLs.",
    "On affected hosts look for ~/.solidity/, the solidity-langsupport persistence units and the rogue ScreenConnect service, then rebuild.",
    "Move any Swarm or Ethereum wallet funds to new keys and rotate npm, GitHub and CI secrets present on the host."
   ],
   "sources": [
    {
     "url": "https://socket.dev/blog/bee-js-compromise",
     "label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "name": "Socket"
    },
    {
     "url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "name": "Corgea"
    },
    {
     "url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html",
     "label": "The Hacker News – Hackers compromise Ethersphere's bee-js",
     "name": "The Hacker News"
    }
   ],
   "indicator_count": 57,
   "block_now_count": 37,
   "hunt_count": 20,
   "hunt_counts": {
    "alert": 8,
    "block": 8,
    "monitor": 4
   },
   "indicator_counts": {
    "sha256": 25,
    "url": 9,
    "filename": 8,
    "ipv4": 8,
    "eth_address": 4,
    "domain": 2,
    "sha1": 1
   },
   "ioas": [],
   "ioa_count": 0,
   "ioa_note": null,
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/block_now.txt",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/defender_xdr_indicators.csv",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.kql",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.spl",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt_raw.spl",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.yaral",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/iocs.csv",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack",
   "indicators": [
    {
     "value": "frameworkmetrics.xyz",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Parent domain of the stage-1/2 loader C2 used by the trojanised bee-js 13.3.0 and Swarm Desktop 0.56.2.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "api.frameworkmetrics.xyz",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Loader C2 host contacted by the bee-js 13.3.0 and Swarm Desktop 0.56.2 loader to fetch and run JavaScript (requests carry header X-Ethersphere: 1).",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "https://api.frameworkmetrics.xyz/v1/analytics",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Loader C2 endpoint /v1/analytics used for payload delivery, assets or exfiltration; covered by the domain block.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "https://api.frameworkmetrics.xyz/v1/electron",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Loader C2 endpoint /v1/electron used for payload delivery, assets or exfiltration; covered by the domain block.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "https://api.frameworkmetrics.xyz/v1/assets/",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Loader C2 endpoint /v1/assets/ used for payload delivery, assets or exfiltration; covered by the domain block.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "https://api.frameworkmetrics.xyz/v1/swarm/report",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Loader C2 endpoint /v1/swarm/report used for payload delivery, assets or exfiltration; covered by the domain block.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "193.57.9.155",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Current evjawbreaker TLS C2 hub on port 4912, resolved through the Ethereum dead-drop contract.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "193.57.9.17",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "178.16.54.222",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "107.189.27.223",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "107.189.27.46",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "91.108.240.156",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "107.189.16.215",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "Historical evjawbreaker/SleepyDuck C2 hub on port 4912 tied to the same Ethereum contract; VPS hosting that may be reassigned.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "http://107.189.27.46:3000/app.js",
     "type": "url",
     "confidence": "med",
     "recommended_action": "block",
     "description": "Secondary payload URL parameter listed by Socket for the stage-2 loader.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "185.232.84.169",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Rogue ScreenConnect relay (port 8041) used by the Windows stage-3 ScreenConnect client.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "https://webhook.site/fdc222d5-2e6c-4122-801d-93099f3fe827",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "webhook.site collector that receives stolen data; block this exact URL only, because webhook.site itself is a legitimate shared service.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "https://webhook.site/46358b99-9cff-4f14-97bc-4a436086e826",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "webhook.site collector that receives stolen data; block this exact URL only, because webhook.site itself is a legitimate shared service.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "https://webhook.site/c05b53d9-c3b6-4a90-94dc-b86a0a4e905f",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "webhook.site collector that receives stolen data; block this exact URL only, because webhook.site itself is a legitimate shared service.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "https://pastebin.com/raw/q1p9qH2w",
     "type": "url",
     "confidence": "med",
     "recommended_action": "block",
     "description": "Pastebin raw paste listed by Socket as campaign infrastructure; block this URL only, not pastebin.com.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "d01fdf241aa9e0a1ba6ebc19f8f667af1bf652745021c5050126cb7036f7ce58",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the malicious bee-js-13.3.0.tgz npm tarball.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "ee2f762e9ed3fd89f106e0b80c2e923bf1aed9a280277d3d998a5902c4d9ec0f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of scripts/generate-version.cjs, the postinstall loader added to bee-js 13.3.0.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "f81315968e679b48f6bdff1c9b928bb223230d07f44d7948412c2250c2a14deb",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the trojanised dist/desktop/src/index.js inside app.asar, common to all Swarm Desktop 0.56.2 builds.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "92c6eb24f9910b3577d5939a8686f9bf6e52f1bdd5872bf96cab0132b4558025",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the trojanised Swarm Desktop 0.56.2 app.asar (Linux).",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "e49afac84dbb6d5a5d101f87754575024b078d67a7ab9e767ff0f7b5b4368069",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the trojanised Swarm Desktop 0.56.2 app.asar (macOS).",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "40a45d68aa49e9e6233c4eb6bb2eb2e92525deea5d17863f6910fc24b06ff20e",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the trojanised Swarm Desktop 0.56.2 app.asar (Windows).",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "14f23342f4292ede4546070e0e3e1cacd06fa781a2937ac374d2b47dbaf77666",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop_0.56.2_amd64.deb.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "23f2d944a0dfa60df493667428d9304cfc1961270b6c68f8d0f38df7fe0e2d31",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop_0.56.2_arm64.deb.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "aed930fbf5993df4ce9bb5951a4092da8a28a12fb45a81ad9715c7b029606fd0",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop-0.56.2-1.x86_64.rpm.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "e0304260dcf2f29d1b4690dc46e9ceb35d5554a79ea749cd913687288d6e228b",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop-0.56.2-1.arm64.rpm.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "94df8933a57cb9962a312a79c079fd0d43706a45066cda1f1b2322f403ad9217",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package Swarm.Desktop-0.56.2-arm64.dmg.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "718ae6ac77e119568dff50a6409996bd649c8e9daf7c8a5616856ff1909a916f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package Swarm.Desktop-darwin-arm64-0.56.2.zip.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "0ef1fbe5db17ec0ebd3bcac576f0f0f351a5ef5da67d5e45a9817e7a224acc5d",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package Swarm.Desktop-0.56.2.Setup.exe.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "ffd280b8ff519b647041b7453754bfd35d341bbd26bce02cb325c512c8976645",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package swarm-desktop-0.56.2-full.nupkg.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "6a37ce783e406f135ed8b60e0897e0e1146a9fa220c2e6c5ce4118fff967f395",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of trojanised Swarm Desktop 0.56.2 package Swarm.Desktop-win32-x64-0.56.2.zip.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "1f3a7afd2e43215f09f2a81063dc2796af556bae74aaf492fba2d66e5d65b14c",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the stage-2 script for Linux fetched from the loader C2.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "2496d74e6a913eba39c8537be31baeff9cf6ccdd8ee84a69475302815cfd4105",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the stage-2 script for macOS fetched from the loader C2.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "705b4aa2bc6fa35f8e6d448f3c6e193fac6027b9b5239e212e09732cc9fc0dba",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the stage-2 script for Windows fetched from the loader C2.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "735aba95e24f515a5cea4efea309f245952917d372b37b5fbea305986dbcd568",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the stage-2 decoy file served by the loader C2.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the stage-3 evjawbreaker backdoor for linux_amd64.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the stage-3 evjawbreaker backdoor for linux_arm64.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the stage-3 evjawbreaker macOS backdoor (vendors disagree on whether this is the amd64 or arm64 build).",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of the stage-3 evjawbreaker macOS backdoor (vendors disagree on whether this is the amd64 or arm64 build).",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of stage-3 invoke.ps1, the Windows PowerShell stage.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of stage-3 app.msi, the rogue ScreenConnect client installer for Windows.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "a205c8a5fed81e9a787645b2801f00be3db3348d",
     "type": "sha1",
     "confidence": "high",
     "recommended_action": "block",
     "description": "npm integrity SHA1 of the malicious @ethersphere/bee-js@13.3.0 tarball.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "@ethersphere/bee-js@13.3.0",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Malicious npm package version (GHSA-hh7j-5m3j-23pf) with a postinstall loader; the last clean version is 13.2.0.",
     "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html",
     "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js",
     "source_name": "The Hacker News"
    },
    {
     "value": "swarm-desktop 0.56.2",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Trojanised Swarm Desktop GitHub release and auto-update; check installed versions.",
     "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html",
     "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js",
     "source_name": "The Hacker News"
    },
    {
     "value": "~/.solidity/",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Linux/macOS implant directory holding the evjawbreaker binaries plus .run.py and .run.cjs.",
     "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html",
     "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js",
     "source_name": "The Hacker News"
    },
    {
     "value": "solidity-langsupport-runner.service",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "systemd user unit in ~/.config/systemd/user/ used for Linux persistence.",
     "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html",
     "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js",
     "source_name": "The Hacker News"
    },
    {
     "value": "com.solidity.langsupport.runner.plist",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "LaunchAgent in ~/Library/LaunchAgents used for macOS persistence.",
     "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html",
     "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js",
     "source_name": "The Hacker News"
    },
    {
     "value": "ScreenConnect Client (5cbe79c9c25524df)",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Windows service name of the rogue ScreenConnect client installed by stage 3.",
     "source_url": "https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html",
     "source_label": "The Hacker News – Hackers compromise Ethersphere's bee-js",
     "source_name": "The Hacker News"
    },
    {
     "value": "%TEMP%\\.stuffed-*",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Windows staging path used by the stage-2 loader.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "%LOCALAPPDATA%\\.<32-hex-guid>\\app.msi",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Drop location of the rogue ScreenConnect MSI on Windows.",
     "source_url": "https://corgea.com/research/ethersphere-bee-js-13-3-0-swarm-desktop-0-56-2-evjawbreaker-ethereum-c2-november-2026",
     "source_label": "Corgea – bee-js 13.3.0 and Swarm Desktop 0.56.2 hijacked to deploy evjawbreaker",
     "source_name": "Corgea"
    },
    {
     "value": "0xf8a900Db50b3331be6B768bA460BB59f3E40C344",
     "type": "eth_address",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Ethereum C2 dead-drop contract 1, shared with the SleepyDuck/EtherDuck campaign; hunt for eth_call to it from non-crypto hosts.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "0x6a82595EEea0f4FDFB3aE13A2687BcbBE626e94B",
     "type": "eth_address",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Ethereum C2 dead-drop contract 2; hunt for eth_call to it from non-crypto hosts.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "0xFd3fc58bcbd8ccc77b6000201438eDfc636E7cA7",
     "type": "eth_address",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Operator wallet 1 that controls the C2 dead-drop contract.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    },
    {
     "value": "0xA7B15A2B5F6992DC3BabB946375d6895fF1171BF",
     "type": "eth_address",
     "confidence": "high",
     "recommended_action": "monitor",
     "description": "Operator wallet 2 that controls the C2 dead-drop contract.",
     "source_url": "https://socket.dev/blog/bee-js-compromise",
     "source_label": "Socket – Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor",
     "source_name": "Socket"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.kql",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.spl",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt_raw.spl",
      "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack/hunt.yaral",
     "download": "Ethersphere-bee-js-Swarm-Desktop-Supply-Chain-Attack_hunt.yaral"
    }
   ]
  },
  {
   "id": "BYOD-Ransomware-Vanderbilt-University-Attack",
   "folder": "threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack",
   "name": "BYOD Ransomware and Extortion: Vanderbilt University Attack",
   "short": "BYOD ransomware",
   "category": "Ransomware",
   "published": "2026-11-09",
   "entry_date": "2026-11-10 13:43",
   "last_updated": "2026-11-10",
   "seq": 4,
   "headline": "New ransomware and extortion group claiming Vanderbilt University",
   "summary": "BYOD is a ransomware and extortion group that launched in 2026 and runs a Tor data leak site, where ransomware.live counted 17 listed victims on 10 November 2026. On 9 November 2026 it claimed an attack on Vanderbilt University, alleging encrypted databases and theft of student, employee and research data including over a million Social Security numbers. The ransom note README_BYOD_31.txt points to the leak site and a Session messenger ID for negotiation. Vanderbilt confirmed an active cybersecurity incident but has not confirmed the group's involvement. Staff told the Nashville Banner that a “system update” notice and a message about deleting old files appeared before the ransom warning, after which their files carried a .byod extension, and that Box sent notices of file deletions by administrators who had not touched the files.",
   "caveat": null,
   "targets": {
    "countries": [
     {
      "code": "US",
      "name": "United States"
     },
     {
      "code": "JP",
      "name": "Japan"
     },
     {
      "code": "GB",
      "name": "United Kingdom"
     },
     {
      "code": "SG",
      "name": "Singapore"
     },
     {
      "code": "MY",
      "name": "Malaysia"
     }
    ],
    "regions": [],
    "sectors": [
     "Education",
     "Technology",
     "Manufacturing",
     "Hospitality",
     "Healthcare"
    ],
    "note": "Based on the victims listed on BYOD's leak site, as tracked by ransomware.live on 11 Nov 2026 (United States: 7 victims; Japan, the United Kingdom, Singapore and Malaysia: 1 each).",
    "source": {
     "url": "https://www.ransomware.live/group/BYOD",
     "label": "ransomware.live – BYOD group profile",
     "name": "ransomware.live"
    }
   },
   "mitre": [
    {
     "id": "T1486",
     "name": "Data Encrypted for Impact",
     "url": "https://attack.mitre.org/techniques/T1486/"
    },
    {
     "id": "T1657",
     "name": "Financial Theft",
     "url": "https://attack.mitre.org/techniques/T1657/"
    }
   ],
   "recommended_actions": [
    "Hunt endpoints and file shares for README_BYOD_*.txt ransom notes.",
    "Alert on mail to or from byod@onionmail.org and on any proxy or tor2web access to the leak site.",
    "Alert on bursts of file renames to the .byod extension on endpoints and file shares, and on mass deletions or changes in OneDrive, Box or Dropbox by one account.",
    "The encryptor reached Vanderbilt machines looking like a system update, so review recent Group Policy, scheduled task and software deployment changes made from domain controllers or management servers.",
    "No network IOCs for the intrusion itself have been published yet; focus on general ransomware hardening and backup checks."
   ],
   "sources": [
    {
     "url": "https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/",
     "label": "BleepingComputer – Vanderbilt University hit in BYOD ransomware attack",
     "name": "BleepingComputer"
    },
    {
     "url": "https://www.ransomware.live/group/BYOD",
     "label": "ransomware.live – BYOD group profile",
     "name": "ransomware.live"
    },
    {
     "url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/",
     "label": "Nashville Banner – Cybersecurity breach impacts Vanderbilt University",
     "name": "Nashville Banner"
    }
   ],
   "indicator_count": 5,
   "block_now_count": 1,
   "hunt_count": 4,
   "hunt_counts": {
    "alert": 4
   },
   "indicator_counts": {
    "domain": 1,
    "email": 1,
    "filename": 1,
    "other": 1,
    "session_id": 1
   },
   "ioas": [
    {
     "artefact": "Ransom notes named README_BYOD_<number>.txt created on many hosts or shares in a short time",
     "log_source": "EDR file events, file server auditing",
     "why": "BleepingComputer saw the note README_BYOD_31.txt on a victim screen; a burst of these files means encryption is under way.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/",
     "source_name": "BleepingComputer",
     "title": "README_BYOD ransom notes",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "Many files renamed to the .byod extension on one device or share within minutes",
     "log_source": "EDR file events, file server auditing",
     "why": "Vanderbilt staff saw every file on their computers become .byod files after the ransom warning appeared.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/",
     "source_name": "Nashville Banner",
     "title": "Mass renames to the .byod extension",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "A \"system update\" notice and a message about deleting old files shortly before encryption",
     "log_source": "Group Policy and scheduled task changes, software deployment logs, EDR process events",
     "why": "Staff described a system update prompt, then a file deletion message, then the ransom warning; this points to delivery through an internal management channel (an inference, not confirmed by Vanderbilt).",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/",
     "source_name": "Nashville Banner",
     "title": "Fake system update shortly before encryption",
     "queries": []
    },
    {
     "artefact": "Cloud storage notices of file deletions by administrators who did not touch the files",
     "log_source": "Box admin events, OneDrive and SharePoint audit (FileDeleted, FileRenamed)",
     "why": "Vanderbilt faculty received Box notices that administrators had deleted files they had not accessed.",
     "action": "alert",
     "has_query": false,
     "source_url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/",
     "source_name": "Nashville Banner",
     "title": "Cloud file deletions by administrators who did not make them",
     "queries": []
    }
   ],
   "ioa_count": 4,
   "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.",
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/block_now.txt",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/defender_xdr_indicators.csv",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.kql",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.spl",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt_raw.spl",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.yaral",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/iocs.csv",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack",
   "indicators": [
    {
     "value": "README_BYOD_31.txt",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Ransom note file name seen at Vanderbilt University; hunt for README_BYOD_*.txt.",
     "source_url": "https://www.bleepingcomputer.com/news/security/vanderbilt-university-hit-in-byod-ransomware-attack-data-theft-claimed/",
     "source_label": "BleepingComputer – Vanderbilt University hit in BYOD ransomware attack",
     "source_name": "BleepingComputer"
    },
    {
     "value": "byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "BYOD Tor data leak site; only shows up in tor2web or proxy logs.",
     "source_url": "https://www.ransomware.live/group/BYOD",
     "source_label": "ransomware.live – BYOD group profile",
     "source_name": "ransomware.live"
    },
    {
     "value": "byod@onionmail.org",
     "type": "email",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "BYOD contact email address; hunt in mail flow and DLP.",
     "source_url": "https://www.ransomware.live/group/BYOD",
     "source_label": "ransomware.live – BYOD group profile",
     "source_name": "ransomware.live"
    },
    {
     "value": "05b18abb1c28e6ae8b12e2910197dba5e756c11c3a4046be50e0d356a815bc5d37",
     "type": "session_id",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "BYOD Session messenger ID used for negotiation; not a file hash, do not import as a file indicator.",
     "source_url": "https://www.ransomware.live/group/BYOD",
     "source_label": "ransomware.live – BYOD group profile",
     "source_name": "ransomware.live"
    },
    {
     "value": ".byod",
     "type": "other",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "File extension BYOD ransomware gave to encrypted files on Vanderbilt computers. Many renames to .byod on one device in a short time mean encryption is running.",
     "source_url": "https://nashvillebanner.com/2026/11/09/vanderbilt-university-cyberattack-byod/",
     "source_label": "Nashville Banner – Cybersecurity breach impacts Vanderbilt University",
     "source_name": "Nashville Banner"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.kql",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.spl",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt_raw.spl",
      "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/BYOD-Ransomware-Vanderbilt-University-Attack/hunt.yaral",
     "download": "BYOD-Ransomware-Vanderbilt-University-Attack_hunt.yaral"
    }
   ]
  },
  {
   "id": "SSHole-OpenSSH-CVE-2026-123158-Exploitation",
   "folder": "threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation",
   "name": "SSHole: OpenSSH CVE-2026-123158 Exploitation and TAC Agent Implant",
   "short": "SSHole OpenSSH CVE-2026-123158",
   "category": "Exploitation / Linux",
   "published": "2026-11-08",
   "entry_date": "2026-11-10 13:43",
   "last_updated": "2026-11-10",
   "seq": 3,
   "headline": "Password bypass on musl-based OpenSSH exploited to gain root and drop an implant",
   "summary": "CVE-2026-123158 (SSHole) lets accounts that should never accept a password, such as root or key-only users, log in with any password longer than 256 characters on OpenSSH before 10.6p2 built against musl libc without PAM, which includes Alpine Linux's default openssh-server and other musl systems such as OpenWrt, Buildroot and Yocto. OpenSSH fixed it in 10.6p2 on 5 November 2026, and exploit code appeared about four hours later. GreyNoise saw attackers gain root, run system and cloud-metadata reconnaissance, try to read /etc/shadow, add SSH keys and install the TAC Agent Python implant with C2 at tac.vpnla.org.",
   "caveat": "The main source is a live GreyNoise dashboard with no publication date; the published date used here is the SANS ISC diary date (8 November 2026).",
   "targets": {
    "countries": [],
    "regions": [
     "Global"
    ],
    "sectors": [],
    "note": "GreyNoise tracks it as a global exploitation event against exposed musl-based Linux systems; victim countries and sectors are not given.",
    "source": {
     "url": "https://sshole.events.greynoise.io/",
     "label": "GreyNoise – SSHole live activity report",
     "name": "GreyNoise"
    }
   },
   "mitre": [
    {
     "id": "T1133",
     "name": "External Remote Services",
     "url": "https://attack.mitre.org/techniques/T1133/"
    },
    {
     "id": "T1098.004",
     "name": "SSH Authorized Keys",
     "url": "https://attack.mitre.org/techniques/T1098/004/"
    },
    {
     "id": "T1552.005",
     "name": "Cloud Instance Metadata API",
     "url": "https://attack.mitre.org/techniques/T1552/005/"
    },
    {
     "id": "T1003.008",
     "name": "/etc/passwd and /etc/shadow",
     "url": "https://attack.mitre.org/techniques/T1003/008/"
    },
    {
     "id": "T1037.004",
     "name": "RC Scripts",
     "url": "https://attack.mitre.org/techniques/T1037/004/"
    }
   ],
   "recommended_actions": [
    "Upgrade OpenSSH to 10.6p2 or later and restart sshd; installing the package alone leaves the old daemon running.",
    "Until patched, disable SSH password authentication on musl-based hosts such as Alpine.",
    "Block the confirmed exploitation IPs inbound at the perimeter and the tac.vpnla.org domain outbound.",
    "Check authorized_keys for the two attacker keys and look for /opt/py3/tac_agent.py and /etc/init.d/tac-agent."
   ],
   "sources": [
    {
     "url": "https://sshole.events.greynoise.io/",
     "label": "GreyNoise – SSHole live activity report",
     "name": "GreyNoise"
    },
    {
     "url": "https://isc.sans.edu/diary/33498",
     "label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "name": "SANS ISC"
    }
   ],
   "indicator_count": 40,
   "block_now_count": 10,
   "hunt_count": 30,
   "hunt_counts": {
    "alert": 25,
    "block": 5
   },
   "indicator_counts": {
    "ipv4": 29,
    "filename": 6,
    "sha256": 2,
    "ssh_pubkey": 2,
    "domain": 1
   },
   "ioas": [],
   "ioa_count": 0,
   "ioa_note": null,
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/block_now.txt",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/defender_xdr_indicators.csv",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.kql",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.spl",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt_raw.spl",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.yaral",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/iocs.csv",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation",
   "indicators": [
    {
     "value": "20.255.63.133",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GreyNoise-confirmed SSHole exploitation source and GT10 cluster seed that ran the exploit and uploaded TAC Agent (Microsoft Azure AS8075, Hong Kong); ephemeral cloud IP, also block inbound SSH at the perimeter.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "20.2.81.241",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GreyNoise-confirmed SSHole exploitation source in the GT10 cluster, high confidence (Microsoft Azure AS8075, Hong Kong); ephemeral cloud IP, also block inbound SSH at the perimeter.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "209.248.50.17",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GreyNoise-confirmed SSHole exploitation source in the GT10 cluster that wrote /etc/init.d/tac-agent (SAKURA AS32135, Singapore); also block inbound SSH at the perimeter.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "47.80.65.43",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GreyNoise-confirmed SSHole exploitation source in the GT10 cluster, medium confidence (Alibaba AS45102, Philippines); ephemeral cloud IP, also block inbound SSH at the perimeter.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "202.155.94.33",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GreyNoise-confirmed SSHole exploitation source in the GT10 cluster, high confidence (PT Deneva AS138115, Indonesia); also block inbound SSH at the perimeter.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "152.175.65.88",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GreyNoise-confirmed SSHole exploitation source listed in the GT10 cluster panel, high confidence; also block inbound SSH at the perimeter.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "79.116.138.30",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GreyNoise Attacker 2: two SSHole intrusions on 7 and 10 Nov 2026 that planted an SSH key (DIGI Spain AS57269 residential ISP, may churn); also block inbound SSH at the perimeter.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "183.220.91.15",
     "type": "ipv4",
     "confidence": "high",
     "recommended_action": "block",
     "description": "GreyNoise Attacker 3: exploited SSHole on 7 Nov 2026 and spent about five hours on recon, cloud-metadata queries and /etc/shadow reads (China Mobile AS9808, may churn); also block inbound SSH at the perimeter.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "43.224.227.158",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "IP tagged by GreyNoise for CVE-2026-123158 authentication-bypass attempts; AROSSCLOUD (AS400619, Hong Kong).",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "89.116.89.18",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "IP tagged by GreyNoise for CVE-2026-123158 authentication-bypass attempts; Nearoute (AS51847, Japan), also named by Previdian.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "31.59.220.26",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "IP tagged by GreyNoise for CVE-2026-123158 authentication-bypass attempts; Throttle Ltd (AS198189, Netherlands).",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "213.86.169.133",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "IP tagged by GreyNoise for CVE-2026-123158 authentication-bypass attempts; COLT (AS8220, UK ISP); check it is not a partner or your own egress.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "152.233.50.185",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "92.255.57.7",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "195.178.110.78",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "109.94.173.13",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "87.241.132.12",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "52.119.124.122",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "185.2.148.137",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "220.77.237.35",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "82.74.132.129",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "220.70.219.98",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "154.80.128.173",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "121.190.39.238",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "121.163.224.97",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "58.151.184.226",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "62.210.173.100",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "183.99.38.238",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "112.162.23.132",
     "type": "ipv4",
     "confidence": "low",
     "recommended_action": "alert",
     "description": "Scanner seen by the SANS ISC Cowrie honeypot sending over-long SSHole passwords from 5 Nov 2026; many are residential ISPs, alert only.",
     "source_url": "https://isc.sans.edu/diary/33498",
     "source_label": "SANS ISC – Scans for Sshole vulnerability (CVE-2026-123158)",
     "source_name": "SANS ISC"
    },
    {
     "value": "tac.vpnla.org",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "TAC Agent C2 domain (https://tac.vpnla.org:8443, behind a Cloudflare Worker); block the domain, not its shared Cloudflare IP.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "55e6384f6d1648be9b48fb899e46623e9c05eb0df2cbf95f6701680d4e7cbc2a",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of /opt/py3/tac_agent.py, the TAC Agent v0.1.1 Python C2 implant (89,559 bytes) installed after root access.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "7cf69bd6573a90d7bd287810b5c3746841cee6a7f77cadd016f34a97fc7b2361",
     "type": "sha256",
     "confidence": "med",
     "recommended_action": "block",
     "description": "SHA256 of /etc/init.d/tac-agent, the 308-byte OpenRC persistence script; small text file that may vary per victim.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "/opt/py3/tac_agent.py",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "File path of the TAC Agent Python implant.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "/etc/init.d/tac-agent",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "OpenRC startup service that keeps TAC Agent running.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "/opt/py3/run_tac.sh",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Launcher script for TAC Agent.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "~/.config/tac/agent.json",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "TAC Agent config holding the agent_id and bearer token.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "/tmp/py3.tar.gz",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Python runtime archive dropped before installing TAC Agent.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "TAC-Agent/1.0",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "HTTP User-Agent string used by TAC Agent C2 traffic.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC+fr+jwfsBA8u1VnsHZL4Tz5zujgovCL6JgYzUYkfvR SSHHOLE-HIT",
     "type": "ssh_pubkey",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Attacker ed25519 public key added to authorized_keys (comment SSHHOLE-HIT); grep authorized_keys files and container images.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    },
    {
     "value": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFQrQmHWfW5QjOEZ4+Y5cz4yuF/dTlneMsoRlpe/jsTJ fleet-access",
     "type": "ssh_pubkey",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "Attacker ed25519 public key added to authorized_keys (comment fleet-access); grep authorized_keys files and container images.",
     "source_url": "https://sshole.events.greynoise.io/",
     "source_label": "GreyNoise – SSHole live activity report",
     "source_name": "GreyNoise"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.kql",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.spl",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt_raw.spl",
      "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/SSHole-OpenSSH-CVE-2026-123158-Exploitation/hunt.yaral",
     "download": "SSHole-OpenSSH-CVE-2026-123158-Exploitation_hunt.yaral"
    }
   ]
  },
  {
   "id": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign",
   "folder": "threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign",
   "name": "FreeSWITCH CVE-2026-116779 SIP Command Injection Cryptominer Campaign",
   "short": "FreeSWITCH CVE-2026-116779 miner",
   "category": "Exploitation / cryptomining",
   "published": "2026-11-05",
   "entry_date": "2026-11-10 13:43",
   "last_updated": "2026-11-10",
   "seq": 2,
   "headline": "SIP MESSAGE command injection used to install a cryptominer",
   "summary": "CVE-2026-116779 is a command injection in FreeSWITCH's mod_sofia: a SIP MESSAGE whose To user names the API chat proto is passed to the FreeSWITCH API, so a single accepted MESSAGE can run operating-system commands. FreeSWITCH 1.11.2 and earlier are vulnerable when inbound chat is enabled (the default on the stock profiles), and 1.11.3 (28 August 2026) gates the path behind enable-chat-api-proto. Operators on the FusionPBX forum reported exploitation that installed a ksmd cryptominer with cron and systemd persistence; those artefacts are community-reported leads, not vendor-confirmed IOCs.",
   "caveat": "The only source is a single research write-up and community forum reports, so these indicators are medium-confidence leads. Hunt with them; none are in the block-now list.",
   "targets": {
    "countries": [],
    "regions": [],
    "sectors": [
     "Telecommunications (VoIP)"
    ],
    "note": "Operators of FreeSWITCH and FusionPBX telephony servers; no countries named.",
    "source": {
     "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "name": "ZeroPath"
    }
   },
   "mitre": [
    {
     "id": "T1190",
     "name": "Exploit Public-Facing Application",
     "url": "https://attack.mitre.org/techniques/T1190/"
    },
    {
     "id": "T1059.004",
     "name": "Unix Shell",
     "url": "https://attack.mitre.org/techniques/T1059/004/"
    },
    {
     "id": "T1053.003",
     "name": "Cron",
     "url": "https://attack.mitre.org/techniques/T1053/003/"
    },
    {
     "id": "T1543.002",
     "name": "Systemd Service",
     "url": "https://attack.mitre.org/techniques/T1543/002/"
    },
    {
     "id": "T1496",
     "name": "Resource Hijacking",
     "url": "https://attack.mitre.org/techniques/T1496/"
    }
   ],
   "recommended_actions": [
    "Upgrade FreeSWITCH to 1.11.3 or later, or disable inbound chat or enforce MESSAGE authentication on SIP profiles.",
    "Remove the passwordless stock default user if it is still present.",
    "Check the www-data crontab and /var/tmp for .khp, ksmd and javab, and look for javab.service.",
    "Block the miner download hosts and IPs."
   ],
   "sources": [
    {
     "url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "name": "ZeroPath"
    }
   ],
   "indicator_count": 12,
   "block_now_count": 0,
   "hunt_count": 12,
   "hunt_counts": {
    "alert": 6,
    "block": 6
   },
   "indicator_counts": {
    "filename": 6,
    "domain": 3,
    "ipv4": 3
   },
   "ioas": [
    {
     "artefact": "SIP MESSAGE whose Request-URI or To user starts with api+ (any case), usually followed by a URL-encoded command such as system%20",
     "log_source": "IDS, packet capture or SBC logs on UDP and TCP 5060-5091",
     "why": "api+ selects the command-running chat proto. Match the selector, not shell keywords, because the command is percent-encoded. TLS hides it from network sensors.",
     "action": "alert",
     "has_query": false,
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_name": "ZeroPath",
     "title": "SIP MESSAGE carrying an api+ command",
     "queries": []
    },
    {
     "artefact": "FreeSWITCH log lines \"Processing text message\" with a destination containing api+, or on patched servers \"rejected a MESSAGE ... addressed to the 'api' chat proto\"",
     "log_source": "FreeSWITCH logs, or syslog forwarded to your SIEM",
     "why": "Unpatched servers log the exploit before running it; 1.11.3 and later log each blocked attempt with the source address and command.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_name": "ZeroPath",
     "title": "FreeSWITCH logs showing api+ text messages",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "The freeswitch process or its service account starting bash, sh, curl or cat, including bash /dev/tcp/<ip>/<port> callbacks",
     "log_source": "EDR process events or auditd",
     "why": "Commands run as the FreeSWITCH user, which rarely starts shells. The forum-recovered exploit used a bash /dev/tcp connectivity check.",
     "action": "alert",
     "has_query": true,
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_name": "ZeroPath",
     "title": "FreeSWITCH starting a shell or downloader",
     "queries": [
      "KQL",
      "SPL",
      "YARA-L"
     ]
    },
    {
     "artefact": "An every-minute www-data crontab entry running /var/tmp/.khp, files .khp, .khp_ts, .rguard, ksmd, idle or javab in /var/tmp, and a javab.service unit",
     "log_source": "Host checks (crontab -u www-data -l), EDR file events",
     "why": "Community-reported miner persistence from this campaign; the script also kills rival miners and deletes logs.",
     "action": "hunt",
     "has_query": true,
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_name": "ZeroPath",
     "title": "Miner persistence in /var/tmp and the www-data crontab",
     "queries": [
      "KQL",
      "SPL"
     ]
    },
    {
     "artefact": "enable-chat-api-proto set to true on a SIP profile",
     "log_source": "Configuration management or file integrity monitoring of sip_profiles",
     "why": "Setting it reopens the path that 1.11.3 closes by default.",
     "action": "alert",
     "has_query": false,
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_name": "ZeroPath",
     "title": "Chat API protocol enabled on a SIP profile",
     "queries": []
    },
    {
     "artefact": "Missing or truncated FreeSWITCH logs",
     "log_source": "Log retention and integrity checks",
     "why": "Attacker cron jobs were reported deleting logs, so gaps are a warning sign in themselves.",
     "action": "hunt",
     "has_query": false,
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_name": "ZeroPath",
     "title": "Missing or truncated FreeSWITCH logs",
     "queries": []
    }
   ],
   "ioa_count": 6,
   "ioa_note": "Behaviours are leads, not confirmed indicators, and can match legitimate activity. Compare any hit against your own baseline and environment before acting.",
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/block_now.txt",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/defender_xdr_indicators.csv",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.kql",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.spl",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt_raw.spl",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.yaral",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/iocs.csv",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign",
   "indicators": [
    {
     "value": "77.73.70.190",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "bash /dev/tcp reverse-shell callback (port 33375) seen in a FusionPBX exploitation log; community lead, not vendor-confirmed.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "87.229.64.49",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "ksmd cryptominer download server decoded from the campaign script; community lead.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "217.151.99.216",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "ksmd cryptominer download server decoded from the campaign script; community lead.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "chatgpt.logltech.store",
     "type": "domain",
     "confidence": "med",
     "recommended_action": "block",
     "description": "ksmd cryptominer download host; community lead.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "ai.apachenginx.ru",
     "type": "domain",
     "confidence": "med",
     "recommended_action": "block",
     "description": "ksmd cryptominer download host; community lead.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "shdesasdd.logltech.workers.dev",
     "type": "domain",
     "confidence": "med",
     "recommended_action": "block",
     "description": "ksmd download host on Cloudflare Workers; block this exact host only, never workers.dev.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "/var/tmp/.khp",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Script run every minute from the www-data crontab on compromised FusionPBX servers.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "/var/tmp/ksmd",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Cryptominer binary dropped by the campaign.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "/var/tmp/javab",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Miner and persistence file run by javab.service.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "javab.service",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "systemd unit used for miner persistence.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "/var/tmp/.rguard",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Campaign artefact left in /var/tmp.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    },
    {
     "value": "/var/tmp/.khp_ts",
     "type": "filename",
     "confidence": "med",
     "recommended_action": "alert",
     "description": "Timestamp artefact used by the .khp cron script.",
     "source_url": "https://zeropath.com/blog/cve-2026-116779-freeswitch-sip-message-api-command-injection",
     "source_label": "ZeroPath – FreeSWITCH CVE-2026-116779 SIP MESSAGE to API command injection",
     "source_name": "ZeroPath"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.kql",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.spl",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt_raw.spl",
      "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign/hunt.yaral",
     "download": "FreeSWITCH-CVE-2026-116779-Cryptominer-Campaign_hunt.yaral"
    }
   ]
  },
  {
   "id": "APT29-Mobile-Watering-Hole-Exploit-Chains",
   "folder": "threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains",
   "name": "APT29 Watering Holes Targeting iOS and Android with N-Day Exploits",
   "short": "APT29 mobile watering holes",
   "category": "APT / espionage",
   "published": "2026-11-04",
   "entry_date": "2026-11-10 13:43",
   "last_updated": "2026-11-10",
   "seq": 1,
   "headline": "Watering holes serving n-day exploit chains to iOS and Android visitors",
   "summary": "Sekoia TDR attributes, with moderate to high confidence, a large-scale watering-hole campaign against iOS and Android users to APT29 (Midnight Blizzard, Cozy Bear), the Russian foreign intelligence service's intrusion set. Visitors were reached through compromised legitimate websites, fake look-alike sites such as america250.holiday, and a supply-chain compromise of the Ukrainian Plerdy web analytics tracker, trojanised from 27 August to 3 September 2026. A fingerprinting script profiles each device, then delivery servers serve platform-specific n-day exploit chains, one linked to the DarkSword iOS exploit kit, that steal browser cookies or full device data on iOS and Chrome data and Wi-Fi passwords on Android, without persistence.",
   "caveat": null,
   "targets": {
    "countries": [
     {
      "code": "UA",
      "name": "Ukraine"
     },
     {
      "code": "US",
      "name": "United States"
     },
     {
      "code": "CZ",
      "name": "Czech Republic"
     },
     {
      "code": "BG",
      "name": "Bulgaria"
     }
    ],
    "regions": [
     "Europe"
    ],
    "sectors": [
     "Military and defence",
     "Energy",
     "Political organisations"
    ],
    "note": "Victims across Europe and the US with a focus on Ukraine; compromised or cloned sites in the US, Ukraine, the Czech Republic and Bulgaria.",
    "source": {
     "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "name": "Sekoia"
    }
   },
   "mitre": [
    {
     "id": "T1189",
     "name": "Drive-by Compromise",
     "url": "https://attack.mitre.org/techniques/T1189/"
    },
    {
     "id": "T1195.002",
     "name": "Compromise Software Supply Chain",
     "url": "https://attack.mitre.org/techniques/T1195/002/"
    },
    {
     "id": "T1592",
     "name": "Gather Victim Host Information",
     "url": "https://attack.mitre.org/techniques/T1592/"
    },
    {
     "id": "T1539",
     "name": "Steal Web Session Cookie",
     "url": "https://attack.mitre.org/techniques/T1539/"
    }
   ],
   "recommended_actions": [
    "Block the delivery, fingerprinting and exfiltration domains at DNS and web proxies.",
    "Keep iOS and Android devices fully patched; the chains use known (n-day) vulnerabilities.",
    "Look back in proxy logs for loads of a.plerdy.com between 27 August and 3 September 2026, but do not block the legitimate tracker.",
    "Reset sessions for webmail and cloud apps used on any device that reached these domains."
   ],
   "sources": [
    {
     "url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "name": "Sekoia"
    }
   ],
   "indicator_count": 27,
   "block_now_count": 22,
   "hunt_count": 5,
   "hunt_counts": {
    "block": 3,
    "alert": 1,
    "monitor": 1
   },
   "indicator_counts": {
    "domain": 10,
    "sha256": 9,
    "url": 4,
    "ipv4": 3,
    "filename": 1
   },
   "ioas": [],
   "ioa_count": 0,
   "ioa_note": null,
   "files": [
    {
     "name": "block_now.txt",
     "label": "Block list",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/block_now.txt",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_block_now.txt"
    },
    {
     "name": "defender_xdr_indicators.csv",
     "label": "Defender XDR import",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/defender_xdr_indicators.csv",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_defender_xdr_indicators.csv"
    },
    {
     "name": "hunt.kql",
     "label": "Hunting query (KQL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.kql",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.kql"
    },
    {
     "name": "hunt.spl",
     "label": "Hunting query (SPL)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.spl",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.spl"
    },
    {
     "name": "hunt_raw.spl",
     "label": "Hunting query (SPL, raw events)",
     "note": "hunt_raw.spl, for data not mapped to CIM",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt_raw.spl",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt_raw.spl"
    },
    {
     "name": "hunt.yaral",
     "label": "Hunting query (YARA-L 2.0)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.yaral",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.yaral"
    },
    {
     "name": "iocs.csv",
     "label": "All indicators (CSV)",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/iocs.csv",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_iocs.csv"
    }
   ],
   "repo_url": "https://github.com/daniyyell-dev/rapid-threat-intel/tree/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains",
   "indicators": [
    {
     "value": "theowo.club",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Fake adversary-in-the-middle site (created 18 Jun 2026) that delivers the exploit chain via static.flux-telemetry.com.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "america250.holiday",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Fake America250 adversary-in-the-middle site (created 19 May 2026) that delivers via adsprism-stat.com.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "adsprism-stat.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Malicious delivery domain used by the fake America250 site.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "static.flux-telemetry.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery host serving the device fingerprinting script.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "edge-ord.clouds-stacks.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery load balancer and redirector.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "ad.starx-net.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Exfiltration host receiving stolen data on port 8881 (/telemetry/v12).",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "ads-it-assets.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Delivery server reached via the clouds-stacks redirect.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "cdn.adv-static.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Exploit delivery server.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "wpvortex-mod.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Exploit delivery server.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "assets-int.com",
     "type": "domain",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Exploit delivery server.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "https://ad.starx-net.com:8881/telemetry/v12",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Exfiltration endpoint that receives stolen cookies and device data.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "https://static.flux-telemetry.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "UltimateFingerprinter script that profiles the visitor's browser and device before exploit delivery.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "https://edge-ord.clouds-stacks.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js",
     "type": "url",
     "confidence": "high",
     "recommended_action": "block",
     "description": "Fingerprinting script URL injected through the compromised Plerdy tracker.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "5b4c8fea5cbcee273e8d830f52-temfp.js",
     "type": "filename",
     "confidence": "high",
     "recommended_action": "alert",
     "description": "File name of the fingerprinting script.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "https://a.plerdy.com/public/js/click/main.js",
     "type": "url",
     "confidence": "med",
     "recommended_action": "monitor",
     "description": "Legitimate Plerdy analytics tracker that was trojanised from 27 Aug to 3 Sep 2026 only; do not block, look back for loads in that window.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "109.104.106.107",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "IP that static.flux-telemetry.com resolved to (Shock Hosting AS395092); VPS that may be reassigned.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "95.133.231.28",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "IP that edge-ord.clouds-stacks.com resolved to (servinga AS219399); VPS that may be reassigned.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "195.58.140.105",
     "type": "ipv4",
     "confidence": "med",
     "recommended_action": "block",
     "description": "IP of the ad.starx-net.com exfiltration host (Shock Hosting AS395092); VPS that may be reassigned.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of exploit-chain stage Class-A-Stage1; mostly relevant to Defender for iOS/Android and web proxies.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of exploit-chain stage Class-A-Stage2; mostly relevant to Defender for iOS/Android and web proxies.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of exploit-chain stage Class-B-Stage1; mostly relevant to Defender for iOS/Android and web proxies.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of exploit-chain stage Class-B-Stage2; mostly relevant to Defender for iOS/Android and web proxies.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of exploit-chain stage Class-B-Stage3; mostly relevant to Defender for iOS/Android and web proxies.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of exploit-chain stage Class-C-Stage1-JS; mostly relevant to Defender for iOS/Android and web proxies.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of exploit-chain stage Class-C-Stage2-JS; mostly relevant to Defender for iOS/Android and web proxies.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of exploit-chain stage Class-C-Stage2 CVE-2025-27038; mostly relevant to Defender for iOS/Android and web proxies.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    },
    {
     "value": "387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c",
     "type": "sha256",
     "confidence": "high",
     "recommended_action": "block",
     "description": "SHA256 of AndroSnitch, the Android payload that steals Chrome data and Wi-Fi passwords.",
     "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
     "source_label": "Sekoia TDR – Poisoned Source: APT29 watering holes target mobile devices with n-day exploits",
     "source_name": "Sekoia"
    }
   ],
   "queries": [
    {
     "platform": "Defender XDR",
     "language": "KQL",
     "name": "hunt.kql",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.kql",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.kql"
    },
    {
     "platform": "Splunk",
     "language": "SPL",
     "name": "hunt.spl",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.spl",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.spl",
     "alt": {
      "label": "No CIM? Raw-search version",
      "name": "hunt_raw.spl",
      "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt_raw.spl",
      "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt_raw.spl"
     }
    },
    {
     "platform": "Google SecOps",
     "language": "YARA-L 2.0",
     "name": "hunt.yaral",
     "url": "https://raw.githubusercontent.com/daniyyell-dev/rapid-threat-intel/main/threats/2026-11_November-2026/2026-11-10/APT29-Mobile-Watering-Hole-Exploit-Chains/hunt.yaral",
     "download": "APT29-Mobile-Watering-Hole-Exploit-Chains_hunt.yaral"
    }
   ]
  }
 ]
}