{
  "Event": {
    "analysis": "1",
    "date": "2026-06-23",
    "extends_uuid": "",
    "info": "[Threat Intel] The #APT36 cluster can't stop, won't stop",
    "protected": false,
    "publish_timestamp": "1782454629",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1782454629",
    "uuid": "14cddf04-411b-4f74-9ff1-6c74a7837bd7",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Operation C-Major\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#50214f",
        "local": false,
        "name": "misp-galaxy:country=\"pakistan\"",
        "relationship_type": ""
      },
      {
        "colour": "#013748",
        "local": false,
        "name": "misp-galaxy:target-information=\"India\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782270016",
        "to_ids": false,
        "type": "link",
        "uuid": "0c1eeb58-5674-4a5e-991c-469936e89df5",
        "value": "https://x.com/GenThreatLabs/status/2068972067307811234",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782270016",
        "to_ids": false,
        "type": "text",
        "uuid": "f21beb5b-6652-4dda-b49e-3fea46c63baa",
        "value": "They just added #CVE-2026-21509 and #CVE-2026-21513 (borrowed from APT28) onto their delivery chain, pushing updated FIREPOWER via weaponized RTF and LNKs against ?? targets. Separately, fresh SheetCreep + a shiny new CrystalShell-Slack variant co-dropped on a Kashmir target, because one implant is never enough. The vibeware factory is running three shifts: Crystal, .NET and PowerShell."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782270016",
        "to_ids": false,
        "type": "text",
        "uuid": "331d1fe2-e3f8-477e-a5a7-f1fd735c3c3b",
        "value": "Name: The #APT36 cluster can't stop, won't stop\nAuthor: AlienVault\nAdversary: APT36\nTags: [\"apt36\", \"turkey\", \"firepower\", \"lnk\", \"rtf\", \"crystalshell\"]\nTgtd countries: [\"T\\u00fcrkiye\"]\nMlwr families: [\"SHEETCREEP\", \"CrystalShell\"]\nAttack_ids: []\nIndustries: [\"Government\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782360361",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "274d3302-e59a-4a50-a771-a2118daa42d9",
        "value": "APT36",
        "Tag": [
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:threat-actor=\"Operation C-Major\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "CVE-2026-21509 No sample in VT\r\nLast check:26/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782445634",
        "to_ids": true,
        "type": "sha256",
        "uuid": "6ba26496-aa98-45f2-a890-ca7d41963360",
        "value": "6df13b336f3daccc29a5f24bd5824f4ae9b4d7c45ee9c9adcd7a36679ee009c5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "CVE-2026-21513 No sample in VT\r\nLast check:26/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782445635",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4e1a24c3-c833-4d08-b4eb-adf89c7a73d6",
        "value": "558dd73f708d4ea7b33fec295ac201ee5c76ba293856d8835225538c11ff208e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "SheetCreep No sample in VT\r\nLast check:26/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782445636",
        "to_ids": true,
        "type": "sha256",
        "uuid": "35fb35f6-a997-4e16-a684-07e1fab2c047",
        "value": "3d74a0fb447590ba7c054e6e7c6d182d145651f588aa4de8bf0972461d9652f2",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782360381",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "5b2b90a8-efd6-4d0d-8fd4-432efb57d903",
        "value": "CVE-2026-21509"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782360381",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "110f948d-396e-4e18-b1fd-5e8ee6415623",
        "value": "CVE-2026-21513"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782447357",
        "uuid": "a353f697-e276-4879-8eb1-3afed74fa06e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "FIREPOWER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782447357",
            "to_ids": true,
            "type": "md5",
            "uuid": "ea2cae42-4836-4bbf-885a-e24f8736dc2f",
            "value": "596958bd9ef5fec6e66710de57ecd06d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "FIREPOWER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445631",
            "to_ids": true,
            "type": "sha1",
            "uuid": "38a48c35-a438-4906-ba83-a4be5fab6982",
            "value": "d14e2090e3328b1eec0e76c02d3182f5c892ce03",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "FIREPOWER",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445632",
            "to_ids": true,
            "type": "sha256",
            "uuid": "cf8e1bf6-4fa5-41af-b162-3014346d5d0d",
            "value": "9a93231038c7807c7c1376de1546cae94b6778106bb2ef115631da0991adbb91",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782445180",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "e7977def-7052-4b44-b182-59b0bfa66b6d",
            "value": "1536:2RWgwqEknG1J8sA1OvoesHg+jDGFOZ2C67MEGgvNjDLyzWkOsUyOxBzfY1p4aR:2UgINP8sAOoBHg+vG8t67jnNDL6AxBzG"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782445180",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e72332ed-b691-48a4-8e11-972d11717abb",
            "value": "94197"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782445180",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d2cfd439-6d1d-41d2-bf23-995fe26044b0",
            "value": "a9673b84e64ef02144ecacb94e9e8997"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782445180",
            "to_ids": false,
            "type": "text",
            "uuid": "adba8ab0-bff5-4d47-b860-c18fb23ce664",
            "value": "FIREPOWER\r\nType Description: Powershell\nMicrosoft: None\nVT Total Detection:20/61\nFirst Submission:2026-06-16T07:11:27.000000+00:00\nLast Submission:2026-06-16T07:11:27.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782447378",
        "uuid": "e9e3563e-4bfa-465d-982a-4582718c58dc",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "CrystalShell",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782447378",
            "to_ids": true,
            "type": "md5",
            "uuid": "0217b1be-9302-405f-926b-fad2cf074876",
            "value": "ea3a472c34f9f589c299b5d8f23933a1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "CrystalShell",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782445633",
            "to_ids": true,
            "type": "sha1",
            "uuid": "e0959602-8fb9-4645-86ea-114b8aeec4d4",
            "value": "b160ccef9d330655c61365cf4d11fd9d6c64297a",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "CrystalShell",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782445633",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c070a895-060a-47ed-9750-c502b7febf30",
            "value": "12335f9a1b7d3b84d2844b42f6f2ae03b70c2cc3d68e6c2dd468ee1ec6b2f3c1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782445202",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "a982ddd3-8f86-4365-9575-6548c384a267",
            "value": "49152:QuQOnZUQoaOW081SaPI1wz3ObdVeQ//8S77CZPRuLfj11Z3E:Qu9ZZoWlI183c7pviZPILbe"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782445202",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "007f7aa5-dbe0-4174-bedb-e2c133ca30d4",
            "value": "2548304"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782445202",
            "to_ids": true,
            "type": "vhash",
            "uuid": "e13df3ff-892a-4cc3-81c1-6b1b79d7ba4f",
            "value": "02604e0f7d151013z13z43z1hz15z17z"
          },
          {
            "category": "Other",
            "comment": "Checked: 26/06/2026\nLast-scan\t:  26/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782445202",
            "to_ids": false,
            "type": "text",
            "uuid": "c482a593-68d0-4d72-a9a1-681f1a3f5b30",
            "value": "CrystalShell\r\nType Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:23/71\nFirst Submission:2026-06-24T04:41:36.000000+00:00\nLast Submission:2026-06-24T04:41:36.000000+00:00"
          }
        ]
      }
    ]
  }
}