{ "Event": { "analysis": "1", "date": "2026-07-14", "extends_uuid": "", "info": "[Threat Intel] Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries", "protected": false, "publish_timestamp": "1784560883", "published": true, "threat_level_id": "3", "timestamp": "1784560883", "uuid": "02986fc4-1ed3-4455-b3ec-06becada43d5", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#cf6788", "local": false, "name": "misp-galaxy:producer=\"Hunt.io\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#fb3bcd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Host Information - T1592\"", "relationship_type": "" }, { "colour": "#7773ac", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#65d24c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Identity Information - T1589\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"", "relationship_type": "" }, { "colour": "#fe1ef0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#f95f85", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"", "relationship_type": "" }, { "colour": "#2da3e8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Gather Victim Network Information - T1590\"", "relationship_type": "" }, { "colour": "#70b0b5", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#a42e64", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#86e845", "local": false, "name": "misp-galaxy:target-information=\"Afghanistan\"", "relationship_type": "" }, { "colour": "#2613b0", "local": false, "name": "misp-galaxy:target-information=\"Taiwan\"", "relationship_type": "" }, { "colour": "#33360c", "local": false, "name": "misp-galaxy:target-information=\"Thailand\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#18005c", "local": false, "name": "rectifyq:topic=\"ai\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Rshell\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Vshell\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Linux\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"WordPress\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784170881", "to_ids": false, "type": "link", "uuid": "a16b0dc9-2bf2-467b-9579-4fee878bf4af", "value": "https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784170882", "to_ids": false, "type": "text", "uuid": "077f2b65-9fdc-4dcf-aeeb-d3fea06095f6", "value": "In June 2026, infrastructure pivoting from TencShell C2 nodes revealed an active intrusion campaign utilizing AI language models for attack automation. Thirteen Hong Kong-based servers across four ASNs exposed an open directory containing victim source code, custom exploits, operational logs, and cloned login pages with notes in Simplified Chinese. The operation employed Claude Code for execution and DeepSeek-v4-pro for attack logic, targeting government systems in Afghanistan, Thailand, and Taiwan, along with reconnaissance against U.S. government portals. The campaign also pursued financial services firms across Europe, Australia, and Asia. Attackers deployed TencShell implants, webshells, and custom exploits including SQL injection and Laravel deserialization attacks, successfully compromising administrative systems and exfiltrating sensitive data including citizen complaints and government employee information." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784170882", "to_ids": false, "type": "text", "uuid": "18656f37-2ec1-406b-bb72-4c2e4836b172", "value": "Name: Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries\nAuthor: AlienVault\nAdversary: \nTags: [\"phishing\", \"vshell\", \"gshell\", \"llm-powered attacks\", \"deepseek\", \"webshell\", \"claude code\", \"tencshell\", \"supply chain targeting\"]\nTgtd countries: [\"United States of America\", \"Afghanistan\", \"Taiwan\", \"Thailand\"]\nMlwr families: [\"TencShell\", \"HSEWH-Ur\", \"Vshell\", \"Gshell\"]\nAttack_ids: [\"T1592\", \"T1133\", \"T1566.002\", \"T1005\", \"T1190\", \"T1555\", \"T1219\", \"T1589\", \"T1595.002\", \"T1505.003\", \"T1059\", \"T1552.001\", \"T1590\", \"T1110\", \"T1078\", \"T1027\", \"T1573\", \"T1213\", \"T1189\", \"T1071.001\"]\nIndustries: [\"Government\", \"Finance\", \"Telecommunications\", \"Chemical\", \"Manufacturing\", \"Semiconductor\"]" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784557955", "to_ids": true, "type": "ip-dst", "uuid": "09950a30-517f-48ff-977a-4433592b6f35", "value": "112.213.124.159", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784557976", "to_ids": true, "type": "ip-dst", "uuid": "b128189e-6edb-47f5-ac34-d49aea70d5be", "value": "134.122.200.153", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784557997", "to_ids": true, "type": "ip-dst", "uuid": "a89ac072-14fd-41a8-90b1-06549591cf3b", "value": "134.122.200.154", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558019", "to_ids": true, "type": "ip-dst", "uuid": "42bb495c-f3a7-427f-bd5e-43280fb54303", "value": "134.122.200.155", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558041", "to_ids": true, "type": "ip-dst", "uuid": "fffe88ef-3a6a-4c0b-82de-9e0a989fffc0", "value": "192.229.115.229", "Tag": [ { "colour": "#43d708", "local": false, "name": "asn:asn=\"138995\"", "relationship_type": "" }, { "colour": "#2bdb30", "local": false, "name": "asn:as-owner=\"ANTBOX1-AS-AP Antbox Networks Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558062", "to_ids": true, "type": "ip-dst", "uuid": "6ef22dd3-b082-4181-aed0-4b369ee92ce2", "value": "45.64.52.242", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558083", "to_ids": true, "type": "ip-dst", "uuid": "19038eab-dbb6-424e-ae42-048fc78e4b46", "value": "192.238.134.166", "Tag": [ { "colour": "#43d708", "local": false, "name": "asn:asn=\"138995\"", "relationship_type": "" }, { "colour": "#2bdb30", "local": false, "name": "asn:as-owner=\"ANTBOX1-AS-AP Antbox Networks Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558104", "to_ids": true, "type": "ip-dst", "uuid": "3d2b2372-88c5-4b59-807c-b431f5fb7b30", "value": "112.213.124.132", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558126", "to_ids": true, "type": "ip-dst", "uuid": "15c5b89f-dd99-40ac-9c87-87ae19c64935", "value": "112.213.124.163", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557272", "to_ids": true, "type": "sha256", "uuid": "dc80f2b6-bf3d-4df2-9645-f6e514b95281", "value": "03f26cbfa3ca15fcb43f512aa4041732beeec267f9d1dc74a11f7b0bb32e86bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557273", "to_ids": true, "type": "sha256", "uuid": "d85eaabe-e50f-41a0-b43c-1f8d24a1f1c1", "value": "2954639be599f23c2229a9743aba09a1d9d11bf2becc62bf353384437db37dee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557274", "to_ids": true, "type": "sha256", "uuid": "6ce706cf-d00a-4568-af48-144dbbed50e2", "value": "64107e3e0a333f685d1be6386426223a030c4126ac7c295aa7b1d54c508bbace", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557275", "to_ids": true, "type": "sha256", "uuid": "da844704-58ad-45d4-a240-24ad2ed6d9dc", "value": "ad1a0b3e22a10a2bd680b773b178a0d3824cfcbdf3551016f3d052a0b823079f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558147", "to_ids": true, "type": "ip-dst", "uuid": "2b26c533-8549-4658-a1a5-0566a91a8f56", "value": "134.122.200.114", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558169", "to_ids": true, "type": "ip-dst", "uuid": "268754fb-2639-4e01-bc43-1e95c5ae5ecb", "value": "134.122.200.115", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558190", "to_ids": true, "type": "ip-dst", "uuid": "c962124d-6f05-4aca-8b1c-71d6269d4f37", "value": "134.122.200.116", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558211", "to_ids": true, "type": "ip-dst", "uuid": "9d97fce1-9053-40ee-8f97-14dedcd80302", "value": "192.163.167.10", "Tag": [ { "colour": "#43d708", "local": false, "name": "asn:asn=\"138995\"", "relationship_type": "" }, { "colour": "#2bdb30", "local": false, "name": "asn:as-owner=\"ANTBOX1-AS-AP Antbox Networks Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558232", "to_ids": true, "type": "ip-dst", "uuid": "c622b4cc-68a9-494e-a4f2-89bfee70c0b9", "value": "192.163.167.5", "Tag": [ { "colour": "#43d708", "local": false, "name": "asn:asn=\"138995\"", "relationship_type": "" }, { "colour": "#2bdb30", "local": false, "name": "asn:as-owner=\"ANTBOX1-AS-AP Antbox Networks Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558254", "to_ids": true, "type": "ip-dst", "uuid": "4d874a1d-c8e7-43aa-ac5c-61aa1b72a7a3", "value": "192.163.167.6", "Tag": [ { "colour": "#43d708", "local": false, "name": "asn:asn=\"138995\"", "relationship_type": "" }, { "colour": "#2bdb30", "local": false, "name": "asn:as-owner=\"ANTBOX1-AS-AP Antbox Networks Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558275", "to_ids": true, "type": "ip-dst", "uuid": "38268026-278d-4d4f-ac96-d2819fbca17c", "value": "192.163.167.7", "Tag": [ { "colour": "#43d708", "local": false, "name": "asn:asn=\"138995\"", "relationship_type": "" }, { "colour": "#2bdb30", "local": false, "name": "asn:as-owner=\"ANTBOX1-AS-AP Antbox Networks Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558296", "to_ids": true, "type": "ip-dst", "uuid": "6366f79c-cadf-4c9d-b717-63019aeaabaa", "value": "192.229.115.230", "Tag": [ { "colour": "#43d708", "local": false, "name": "asn:asn=\"138995\"", "relationship_type": "" }, { "colour": "#2bdb30", "local": false, "name": "asn:as-owner=\"ANTBOX1-AS-AP Antbox Networks Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558317", "to_ids": true, "type": "ip-dst", "uuid": "3d89cf6c-e5f4-484e-a9c3-f6071f295e1e", "value": "38.55.105.143", "Tag": [ { "colour": "#3d89aa", "local": false, "name": "asn:asn=\"967\"", "relationship_type": "" }, { "colour": "#006427", "local": false, "name": "asn:as-owner=\"VMISS-\"", "relationship_type": "" }, { "colour": "#1273fb", "local": false, "name": "asn:as-country=\"CA\"", "relationship_type": "" }, { "colour": "#813aa0", "local": false, "name": "misp-galaxy:country=\"canada\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558339", "to_ids": true, "type": "ip-dst", "uuid": "30b9905a-1be4-4faa-ac55-0439918e3393", "value": "45.64.52.245", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558360", "to_ids": true, "type": "ip-dst", "uuid": "eb7403c2-d42f-48de-a8db-6397366363f9", "value": "45.64.52.246", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784558381", "uuid": "83ba4c7d-88d6-459c-8c78-fca12315a79c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "object_relation": "md5", "timestamp": "1784558381", "to_ids": true, "type": "md5", "uuid": "4cd338bf-a380-4722-b380-7d748ff730b6", "value": "4da236de055bfaf08ee21fb6b88442b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "object_relation": "sha1", "timestamp": "1784557270", "to_ids": true, "type": "sha1", "uuid": "fa9ab455-739b-46ba-a3b8-238c423f4dc7", "value": "1cac633d290a876fc1ead63c58de48575b67b1fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "object_relation": "sha256", "timestamp": "1784557270", "to_ids": true, "type": "sha256", "uuid": "b35f0b71-d5a6-4be5-a09f-909096490cda", "value": "90b7b2c6f3d05234dc55678243039d7e51f0d54190239e5234a0005533337dc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "object_relation": "text", "timestamp": "1784553806", "to_ids": false, "type": "text", "uuid": "d589519b-02b0-454b-a119-3ada06274e71", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 27/74\nFirst Seen In The Wild: 2026-06-12T01:56:59+00:00\nFirst Submission: 2026-06-11T23:56:37+00:00\nLast Submission: 2026-06-26T22:40:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "object_relation": "ssdeep", "timestamp": "1784553806", "to_ids": true, "type": "ssdeep", "uuid": "07259f98-97e8-4671-abc9-b20817f274e8", "value": "49152:Vgq/9gsgUC+t0Ty/NGL2LaSN7glgNqhjn2d+YXO2TcaU+0Yvmqwx1alPnMhHF:VHVle+1GK6l3+PfMJF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1784553806", "to_ids": false, "type": "size-in-bytes", "uuid": "1599dd8b-79b0-4d72-80ed-c8a3704ff5f0", "value": "7208960" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "object_relation": "vhash", "timestamp": "1784553806", "to_ids": true, "type": "vhash", "uuid": "bab0f302-b691-4b28-9696-b67f8efecda6", "value": "94bda63747773de25738ab8e2e33851f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T23:56:37+00:00", "last_seen": "2026-06-26T22:40:33+00:00", "object_relation": "filename", "timestamp": "1784553806", "to_ids": true, "type": "filename", "uuid": "eee1d035-c963-4256-a678-3477796f78bd", "value": "90b7b2c6f3d05234dc55678243039d7e51f0d54190239e5234a0005533337dc8.elf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784558402", "uuid": "44d30f19-8f4f-47aa-bcb0-7c7e9bbfb60d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "object_relation": "md5", "timestamp": "1784558402", "to_ids": true, "type": "md5", "uuid": "d83200cb-4ec3-40cf-935f-5b4fc60fbfe1", "value": "050b84a0d6105a98f443f0165368cc1c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "object_relation": "sha1", "timestamp": "1784557271", "to_ids": true, "type": "sha1", "uuid": "1e0123fa-57e8-4f11-985a-da4a3d28dc87", "value": "66049dd42a29dde7481d5ca2951efec27214ce15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "object_relation": "sha256", "timestamp": "1784557271", "to_ids": true, "type": "sha256", "uuid": "57d8fae8-3fce-47b8-998d-8fbe0b1f51b4", "value": "643de2a1cf9148b896efecf560c9476fa56118ec477c4e15eb5c2da4b318061f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "object_relation": "text", "timestamp": "1784553828", "to_ids": false, "type": "text", "uuid": "b767322d-9ffa-4039-883c-c036f061d947", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 21/74\nFirst Submission: 2026-06-25T23:00:25+00:00\nLast Submission: 2026-06-26T22:41:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "object_relation": "ssdeep", "timestamp": "1784553828", "to_ids": true, "type": "ssdeep", "uuid": "f746f7fb-f7ac-4588-9adf-57ed2740e91d", "value": "98304:Pv0fpt9m4NQ/ril/jc2hGVw48QyvfMCiG:6RH/pQIfMCiG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "object_relation": "size-in-bytes", "timestamp": "1784553828", "to_ids": false, "type": "size-in-bytes", "uuid": "e4ff9138-bff0-47d5-8f2c-c6835d84c8b7", "value": "7131136" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "object_relation": "vhash", "timestamp": "1784553828", "to_ids": true, "type": "vhash", "uuid": "2bebe92c-8133-4216-a281-5d9b24f1bf2e", "value": "c9cb406017b455c727b936767e0c8bf7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T23:00:25+00:00", "last_seen": "2026-06-26T22:41:10+00:00", "object_relation": "filename", "timestamp": "1784553828", "to_ids": true, "type": "filename", "uuid": "fb1f4175-b849-42cb-8fcc-cd2e6f03c5a5", "value": "n2ew6ke4p.exe" } ] } ] } }