{ "Event": { "analysis": "1", "date": "2026-07-23", "extends_uuid": "", "info": "[Threat Intel] Ongoing PLC Exploitation Against Critical U.S. Infrastructure", "protected": false, "publish_timestamp": "1785678550", "published": true, "threat_level_id": "1", "timestamp": "1785616354", "uuid": "51923445-855b-4306-a3df-8f2adcd59e67", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Trend Micro\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#790faf", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Direct Network Flood - T1498.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Stored Data Manipulation - T1565.001\"", "relationship_type": "" }, { "colour": "#50e94f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1584.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#4e866e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Traffic Signaling - T1205\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#921355", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify System Image - T1601\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#f07d7c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials - T1589.001\"", "relationship_type": "" }, { "colour": "#461ea9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Patch System Image - T1601.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Denial of Service - T1498\"", "relationship_type": "" }, { "colour": "#c615e8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scanning IP Blocks - T1595.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#1d998b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Downgrade System Image - T1601.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Accounts - T1078.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120044", "local": false, "name": "rectifyq:sub-category=\"intrusion-analysis\"", "relationship_type": "" }, { "colour": "#190061", "local": false, "name": "rectifyq:topic=\"ics-ot\"", "relationship_type": "" }, { "colour": "#d92121", "local": false, "name": "rectifyq:target=\"targeted\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Energy\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Water\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Industrial\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784948410", "to_ids": false, "type": "link", "uuid": "5f9123f8-c525-4575-b089-9966364fd18b", "value": "https://www.trendmicro.com/en_us/research/26/g/plc-exploitation.html" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784948410", "to_ids": false, "type": "text", "uuid": "c77b4d57-2ac8-4d33-80f5-b00a244f2af8", "value": "Multiple federal agencies have updated a joint advisory warning of active exploitation targeting programmable logic controllers (PLCs) in U.S. critical infrastructure. Attackers scan for internet-exposed industrial control systems and connect using legitimate engineering software with valid credentials, appearing as authorized technicians. Once inside, they alter controller logic and manipulate operator displays to hide anomalies. The campaign has expanded beyond Rockwell Automation to include Schneider Electric and Siemens equipment. Unlike a similar 2023 campaign that caused minimal disruption, this ongoing activity has resulted in confirmed operational disruption and financial losses. Targeted sectors include government facilities, water systems, and energy infrastructure. The exploitation leverages architectural weaknesses rather than software vulnerabilities, with attackers accessing systems through ports 22, 102, 502, 2222, and 44818." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784948410", "to_ids": false, "type": "text", "uuid": "a8024978-eca3-4b9a-831f-20ff1349670c", "value": "Name: Ongoing PLC Exploitation Against Critical U.S. Infrastructure\nAuthor: AlienVault\nAdversary: Cyber Av3ngers\nTags: [\"industrial control systems\", \"critical infrastructure\", \"water facilities\", \"malpdb\", \"ot security\", \"irgc-cec\", \"plc exploitation\", \"iocontrol\", \"hmi manipulation\", \"energy sector\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: [\"IOCONTROL\", \"MALPDB\"]\nAttack_ids: [\"T1498.001\", \"T1133\", \"T1565.001\", \"T1584.003\", \"T1190\", \"T1205\", \"T1112\", \"T1583.003\", \"T1562.001\", \"T1601\", \"T1078\", \"T1571\", \"T1589.001\", \"T1601.001\", \"T1070.004\", \"T1498\", \"T1595.001\", \"T1046\", \"T1601.002\", \"T1078.003\"]\nIndustries: [\"Government\", \"Energy\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1785598328", "to_ids": false, "type": "threat-actor", "uuid": "786292b5-60fe-48cf-a44c-2224b0257e91", "value": "Cyber Av3ngers", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Trend Micro\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS44066 accelerated it services & consulting gmbh", "deleted": false, "disable_correlation": false, "timestamp": "1785601205", "to_ids": true, "type": "ip-dst", "uuid": "75be3624-d7f5-4dab-9a61-9af43c7cf006", "value": "79.133.46.209", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "CyberAv3ngers C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785601226", "to_ids": true, "type": "domain", "uuid": "efdb73c9-1783-4dc3-a172-757805e4b21a", "value": "ocferda.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "CyberAv3ngers C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785601247", "to_ids": true, "type": "domain", "uuid": "c251f83d-deef-4932-9115-6102291488d6", "value": "tylarion867mino.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "91 - C&C server", "deleted": false, "disable_correlation": false, "timestamp": "1785601268", "to_ids": true, "type": "hostname", "uuid": "25af2bb0-704c-4236-aebd-555e17432057", "value": "uuokhhfsdlk.tylarion867mino.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS15020 bandito networks inc", "deleted": false, "disable_correlation": false, "timestamp": "1785601290", "to_ids": true, "type": "ip-dst", "uuid": "e6fff178-c50f-457c-b26c-cf1acb5a8def", "value": "185.82.73.162", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS15020 bandito networks inc", "deleted": false, "disable_correlation": false, "timestamp": "1785601312", "to_ids": true, "type": "ip-dst", "uuid": "1d47524f-1110-4c35-9042-9543e24ebadf", "value": "185.82.73.164", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS15020 bandito networks inc", "deleted": false, "disable_correlation": false, "timestamp": "1785601333", "to_ids": true, "type": "ip-dst", "uuid": "4dd363ba-1a90-46e3-a936-0fa5d809f57e", "value": "185.82.73.171", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS14962 ncr corporation", "deleted": false, "disable_correlation": false, "timestamp": "1785601354", "to_ids": true, "type": "ip-dst", "uuid": "6fc096e0-2fbb-4f48-87ee-ab45e2030589", "value": "135.136.1.133", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS15020 bandito networks inc", "deleted": false, "disable_correlation": false, "timestamp": "1785601375", "to_ids": true, "type": "ip-dst", "uuid": "5da5a9b9-387d-4c93-97de-d4f00e676e00", "value": "185.82.73.165", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS15020 bandito networks inc", "deleted": false, "disable_correlation": false, "timestamp": "1785601397", "to_ids": true, "type": "ip-dst", "uuid": "ec6d4087-e679-437b-833c-73844cd10331", "value": "185.82.73.167", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS15020 bandito networks inc", "deleted": false, "disable_correlation": false, "timestamp": "1785601418", "to_ids": true, "type": "ip-dst", "uuid": "7413bc6b-5f57-4872-9a62-baae70d23616", "value": "185.82.73.168", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS15020 bandito networks inc", "deleted": false, "disable_correlation": false, "timestamp": "1785601439", "to_ids": true, "type": "ip-dst", "uuid": "cb44e839-9eba-4769-87de-924cfd73b865", "value": "185.82.73.170", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=JP ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1785601460", "to_ids": true, "type": "ip-dst", "uuid": "8ee2ec02-d2ba-44e6-9954-074a7e7d0c18", "value": "175.110.121.107", "Tag": [ { "colour": "#d4116f", "local": false, "name": "asn:asn=\"49981\"", "relationship_type": "" }, { "colour": "#ae528b", "local": false, "name": "asn:as-owner=\"WORLDSTREAM\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=JP ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1785601481", "to_ids": true, "type": "ip-dst", "uuid": "1863d28f-4ac1-4b40-9977-21743a34b284", "value": "175.110.121.39", "Tag": [ { "colour": "#d4116f", "local": false, "name": "asn:asn=\"49981\"", "relationship_type": "" }, { "colour": "#ae528b", "local": false, "name": "asn:as-owner=\"WORLDSTREAM\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=JP ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1785601503", "to_ids": true, "type": "ip-dst", "uuid": "511f1c7d-9fca-4b20-b0c3-2e2a354e4506", "value": "175.110.121.42", "Tag": [ { "colour": "#d4116f", "local": false, "name": "asn:asn=\"49981\"", "relationship_type": "" }, { "colour": "#ae528b", "local": false, "name": "asn:as-owner=\"WORLDSTREAM\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=NL ASN=AS15020 bandito networks inc", "deleted": false, "disable_correlation": false, "timestamp": "1785601525", "to_ids": true, "type": "ip-dst", "uuid": "9bab9620-5fae-4a7b-8b04-c8f73b3583fc", "value": "185.82.73.175", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=RO ASN=AS39798 mivocloud srl", "deleted": false, "disable_correlation": false, "timestamp": "1785601545", "to_ids": true, "type": "ip-dst", "uuid": "0547cac5-8dd6-450b-8014-4d147a8927f4", "value": "185.225.17.225", "Tag": [ { "colour": "#946f44", "local": false, "name": "asn:asn=\"39798\"", "relationship_type": "" }, { "colour": "#dc48b6", "local": false, "name": "asn:as-owner=\"MIVOCLOUD\"", "relationship_type": "" }, { "colour": "#9ca493", "local": false, "name": "asn:as-country=\"MD\"", "relationship_type": "" }, { "colour": "#4f4d08", "local": false, "name": "misp-galaxy:country=\"moldova\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=FR ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1785601566", "to_ids": true, "type": "ip-dst", "uuid": "0c650154-f885-43c0-8659-75afa0391fb4", "value": "141.11.164.153", "Tag": [ { "colour": "#15dbfe", "local": false, "name": "asn:asn=\"212238\"", "relationship_type": "" }, { "colour": "#1f1556", "local": false, "name": "asn:as-owner=\"CDNEXT\"", "relationship_type": "" }, { "colour": "#e1449b", "local": false, "name": "asn:as-country=\"GB\"", "relationship_type": "" }, { "colour": "#b7c1b9", "local": false, "name": "misp-galaxy:country=\"united kingdom\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS133847 anpple tech enterprise", "deleted": false, "disable_correlation": false, "timestamp": "1785601588", "to_ids": true, "type": "ip-dst", "uuid": "db60dca0-6934-4f33-a6b1-a9ffc513e11f", "value": "192.142.54.79", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS44066 accelerated it services & consulting gmbh", "deleted": false, "disable_correlation": false, "timestamp": "1785601609", "to_ids": true, "type": "ip-dst", "uuid": "45524857-46d8-480a-8171-06c5950eb6fa", "value": "84.200.205.165", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=BG ASN=AS41870 s3 company ltd", "deleted": false, "disable_correlation": false, "timestamp": "1785601630", "to_ids": true, "type": "ip-dst", "uuid": "6691b6d5-b91e-4ba6-9fe3-cada00225a82", "value": "88.80.150.199", "Tag": [ { "colour": "#540781", "local": false, "name": "asn:asn=\"44901\"", "relationship_type": "" }, { "colour": "#b074f4", "local": false, "name": "asn:as-owner=\"BELCLOUD Premium IP transit network\"", "relationship_type": "" }, { "colour": "#059db5", "local": false, "name": "asn:as-country=\"BG\"", "relationship_type": "" }, { "colour": "#390b5f", "local": false, "name": "misp-galaxy:country=\"bulgaria\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=BG ASN=AS41870 s3 company ltd", "deleted": false, "disable_correlation": false, "timestamp": "1785601651", "to_ids": true, "type": "ip-dst", "uuid": "9b877806-4da3-48fd-ac32-7446b482d304", "value": "88.80.150.200", "Tag": [ { "colour": "#540781", "local": false, "name": "asn:asn=\"44901\"", "relationship_type": "" }, { "colour": "#b074f4", "local": false, "name": "asn:as-owner=\"BELCLOUD Premium IP transit network\"", "relationship_type": "" }, { "colour": "#059db5", "local": false, "name": "asn:as-country=\"BG\"", "relationship_type": "" }, { "colour": "#390b5f", "local": false, "name": "misp-galaxy:country=\"bulgaria\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=BG ASN=AS41870 s3 company ltd", "deleted": false, "disable_correlation": false, "timestamp": "1785601672", "to_ids": true, "type": "ip-dst", "uuid": "65fb5654-dd1f-40c7-ba49-cdadcb96566e", "value": "88.80.150.202", "Tag": [ { "colour": "#540781", "local": false, "name": "asn:asn=\"44901\"", "relationship_type": "" }, { "colour": "#b074f4", "local": false, "name": "asn:as-owner=\"BELCLOUD Premium IP transit network\"", "relationship_type": "" }, { "colour": "#059db5", "local": false, "name": "asn:as-country=\"BG\"", "relationship_type": "" }, { "colour": "#390b5f", "local": false, "name": "misp-galaxy:country=\"bulgaria\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "38 - Computers/Internet", "deleted": false, "disable_correlation": false, "timestamp": "1785601693", "to_ids": true, "type": "ip-dst", "uuid": "62b7c510-52cb-475d-b8e3-886b963484e5", "value": "175.110.121.41", "Tag": [ { "colour": "#d4116f", "local": false, "name": "asn:asn=\"49981\"", "relationship_type": "" }, { "colour": "#ae528b", "local": false, "name": "asn:as-owner=\"WORLDSTREAM\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785601714", "uuid": "68963979-62cd-4ed3-b625-952403c51523", "Attribute": [ { "category": "Payload delivery", "comment": "Trojan.Win64.MALPDB.A", "deleted": false, "disable_correlation": false, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "md5", "timestamp": "1785601714", "to_ids": true, "type": "md5", "uuid": "ba034eb0-6f72-4a32-9b01-fe92c5041614", "value": "838f055690a2a3617be42b8101c27d49", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojan.Win64.MALPDB.A", "deleted": false, "disable_correlation": false, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "sha1", "timestamp": "1785600918", "to_ids": true, "type": "sha1", "uuid": "c6533d7b-46fa-419d-9f8a-cc9ec8428584", "value": "95bd07b4400095acdafce05888da27228d7d07ca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojan.Win64.MALPDB.A", "deleted": false, "disable_correlation": false, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "sha256", "timestamp": "1785600918", "to_ids": true, "type": "sha256", "uuid": "e7e3af4e-2f86-4740-a2b1-8a994f3385c9", "value": "69296ca3575d9bc04ce0250d734d1a83c1348f5b6da756944933af0578bd41d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "text", "timestamp": "1785600039", "to_ids": false, "type": "text", "uuid": "f4d2d013-0fb6-4ec9-ad7c-d3019c4e6af6", "value": "Trojan.Win64.MALPDB.A\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/Tnega!MSR\nClamAV: Win.Exploit.AsRockDriver-9944337-1\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2022-02-15T02:25:20+00:00\nFirst Submission: 2022-03-28T16:56:07+00:00\nLast Submission: 2026-02-27T01:04:34+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "creation-time", "timestamp": "1785600039", "to_ids": false, "type": "datetime", "uuid": "ee460b26-59b0-40d8-b9ea-ca0c573b7ee8", "value": "2019-05-30T13:24:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "ssdeep", "timestamp": "1785600039", "to_ids": true, "type": "ssdeep", "uuid": "719136f4-7496-43c5-853a-b19b42c0f4f1", "value": "6144:HG7pXZ07Hxn+X9vR3iXh+LxJNCbxS0CUvPupYoW8d3qdCx77pGuPmHKN:6pXZoRn+n3iXh+hR5qdCx77VPmHM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600039", "to_ids": false, "type": "size-in-bytes", "uuid": "25ea03c7-5141-421d-8cf2-22c9c730f58f", "value": "445440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "vhash", "timestamp": "1785600039", "to_ids": true, "type": "vhash", "uuid": "5df59c8e-0abc-4982-aeff-07e4220c2f2d", "value": "045066551d6555555088z56!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2022-03-28T16:56:07+00:00", "last_seen": "2026-02-27T01:04:34+00:00", "object_relation": "filename", "timestamp": "1785600039", "to_ids": true, "type": "filename", "uuid": "7235179f-4c54-4f21-b4e9-cf7d12f16068", "value": "LazyCargo" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785601735", "uuid": "7740486f-1dd6-4efa-956e-50dc42b45127", "Attribute": [ { "category": "Payload delivery", "comment": "Backdoor.Linux.IOCONTROL.CIGBCBF", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "object_relation": "md5", "timestamp": "1785601735", "to_ids": true, "type": "md5", "uuid": "0eab00bf-184c-4cea-b561-317b76646070", "value": "c92e2655d115368f92e7b7de5803b7bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Backdoor.Linux.IOCONTROL.CIGBCBF", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "object_relation": "sha1", "timestamp": "1785600919", "to_ids": true, "type": "sha1", "uuid": "474b13f1-fcd6-4378-a1e4-325a56db7b96", "value": "366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Backdoor.Linux.IOCONTROL.CIGBCBF", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "object_relation": "sha256", "timestamp": "1785600919", "to_ids": true, "type": "sha256", "uuid": "9209c7bb-253b-45be-8ac4-98d585a4aa94", "value": "1b39f9b2b96a6586c4a11ab2fdbff8fdf16ba5a0ac7603149023d73f33b84498", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 27/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "object_relation": "text", "timestamp": "1785600061", "to_ids": false, "type": "text", "uuid": "5f2bac95-b7cc-44e5-9181-e0b20b867d5d", "value": "Backdoor.Linux.IOCONTROL.CIGBCBF\r\nType Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 32/74\nFirst Seen In The Wild: 2024-12-10T19:58:02+00:00\nFirst Submission: 2024-01-17T14:33:07+00:00\nLast Submission: 2026-02-28T06:55:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "object_relation": "ssdeep", "timestamp": "1785600061", "to_ids": true, "type": "ssdeep", "uuid": "cd2cb652-8b98-4b25-8704-2c3097291644", "value": "384:PTlCwsCROIIuZkdKIf5C+UCOP32ZU4UKa:4wsCR010C832ZHUKa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600062", "to_ids": false, "type": "size-in-bytes", "uuid": "ae98c68c-01b9-44c3-a378-c60c03d8bdc7", "value": "16208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "object_relation": "vhash", "timestamp": "1785600062", "to_ids": true, "type": "vhash", "uuid": "154f7979-db72-4348-9922-53b7d7c8bd84", "value": "11514985d20f0caa4891de35605a94af" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-17T14:33:07+00:00", "last_seen": "2026-02-28T06:55:03+00:00", "object_relation": "filename", "timestamp": "1785600062", "to_ids": true, "type": "filename", "uuid": "0186ffcf-c16a-4d56-b272-681a1790a9d0", "value": "c92e2655d115368f92e7b7de5803b7bc___679136bd-a11b-4be5-9479-afbbddcf1aab.elf" } ] } ] } }