{ "Event": { "analysis": "1", "date": "2026-07-23", "extends_uuid": "", "info": "[Threat Intel] Email threat landscape: Q2 2026 trends and insights", "protected": false, "publish_timestamp": "1785577608", "published": true, "threat_level_id": "3", "timestamp": "1785577607", "uuid": "2bf3879f-e68f-4c83-a351-69a3cd125c4d", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#96f4f6", "local": false, "name": "misp-galaxy:producer=\"Microsoft\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#77a4ec", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#e76389", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hide Artifacts - T1564\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#db2044", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1598.003\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#3d1dab", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Internal Spearphishing - T1534\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"", "relationship_type": "" }, { "colour": "#a0d02a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#a42e64", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"", "relationship_type": "" }, { "colour": "#5884a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"", "relationship_type": "" }, { "colour": "#c60dc9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing via Service - T1566.003\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#150050", "local": false, "name": "rectifyq:sub-category=\"report\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862018", "to_ids": false, "type": "link", "uuid": "63d36ac2-54e8-48a1-a468-d8ec89eb7f50", "value": "https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784862018", "to_ids": false, "type": "text", "uuid": "7ba8b601-cec7-4295-929d-672e82002566", "value": "During Q2 2026, Microsoft detected approximately 7.6 billion email-based phishing threats, with monthly volumes declining from 2.7 billion in April to 2.4 billion in June. The quarter was significantly shaped by the downstream effects of Microsoft's Digital Crimes Unit disruption of the Tycoon2FA phishing-as-a-service platform in March, resulting in a 92% decline in associated phishing volume. QR code phishing attacks peaked at 18.7 monthly attacks in March before declining 48% by June, while CAPTCHA-gated phishing fell 81% from its March high. Credential phishing remained the dominant objective, accounting for 94-96% of all payload-based attacks. Business email compromise activity returned to historical norms after an anomalous April surge. Microsoft Teams-based threats grew substantially, with weekly malicious call attempts reaching nearly ten times the mid-2025 baseline by quarter end." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784862018", "to_ids": false, "type": "text", "uuid": "2e2ea566-cd09-4f5a-bba4-430e7ea4ffdd", "value": "Name: Email threat landscape: Q2 2026 trends and insights\nAuthor: AlienVault\nAdversary: \nTags: [\"microsoft teams threats\", \"tycoon2fa\", \"qr code phishing\", \"credential theft\", \"business email compromise\", \"captcha-gated phishing\", \"vishing\", \"phishing-as-a-service\", \"adversary-in-the-middle\", \"social engineering\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1114\", \"T1036.005\", \"T1564\", \"T1204.002\", \"T1566.002\", \"T1598.003\", \"T1566.001\", \"T1036\", \"T1059\", \"T1204\", \"T1059.001\", \"T1534\", \"T1566\", \"T1027\", \"T1564.003\", \"T1598\", \"T1059.003\", \"T1213\", \"T1204.001\", \"T1566.003\"]\nIndustries: [\"Retail\", \"Technology\", \"Finance\", \"Healthcare\", \"Manufacturing\", \"Hospitality\", \"Aerospace\", \"Construction\", \"Energy\", \"Government\", \"Media\"]" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785121052", "to_ids": true, "type": "domain", "uuid": "222d361a-1b48-46c9-bd0c-78fe5c46d7a4", "value": "x2mails.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "File hash of campaign PDF attachment No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118347", "to_ids": true, "type": "sha256", "uuid": "ab8f74a0-cb39-4b1c-a432-221dce0dd011", "value": "11420d6d693bf8b19195e6b98fedd03b9bcbc770b6988bc64cb788bfabe1a49d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Domain hosting malicious campaign content", "deleted": false, "disable_correlation": false, "timestamp": "1785121074", "to_ids": true, "type": "domain", "uuid": "261da777-9402-46a7-9b2d-6445dd552c41", "value": "acceptable-use-policy-calendly.de", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Domain hosting sender email address", "deleted": false, "disable_correlation": false, "timestamp": "1785121095", "to_ids": true, "type": "domain", "uuid": "8ce21c79-96d3-4a8e-b262-e1b22fbb65ec", "value": "cocinternal.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Domain hosting malicious campaign content", "deleted": false, "disable_correlation": false, "timestamp": "1785121116", "to_ids": true, "type": "domain", "uuid": "e145d847-f0d3-4e4b-831f-e0c198e9cee7", "value": "compliance-protectionoutlook.de", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785121137", "to_ids": true, "type": "hostname", "uuid": "52903a2f-4767-40cd-9725-20f0f6eaf0eb", "value": "na.businesshellosign.de", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Domain hosting sender email address", "deleted": false, "disable_correlation": false, "timestamp": "1785121158", "to_ids": true, "type": "domain", "uuid": "8652d727-dd02-4a40-8176-8298508fc9f9", "value": "gadellinet.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Domain hosting sender email address", "deleted": false, "disable_correlation": false, "timestamp": "1785121179", "to_ids": true, "type": "domain", "uuid": "27b2d584-1764-4693-981a-f760eff15c66", "value": "harteprn.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Stage 2 BAT dropper download URL", "deleted": false, "disable_correlation": false, "timestamp": "1785121200", "to_ids": true, "type": "url", "uuid": "09d9a6c8-f10c-4540-81cb-12a8a8da1a31", "value": "https://t90141296286.p.clickup-attachments.com/t90141296286/fb39c3a9-3161-40ad-847b-0683e0409d6f/Financial_report.bat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785121221", "to_ids": true, "type": "domain", "uuid": "c9270a5e-3206-4fa6-9c1d-12a566bd075d", "value": "9i6pokerdepot.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785121242", "to_ids": true, "type": "domain", "uuid": "7f857ade-79f6-407d-9f38-b7f73323a7f2", "value": "ecajovna.sk", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785121263", "to_ids": true, "type": "domain", "uuid": "8d0527a9-f4d2-46a0-94e0-7b82a390caf2", "value": "ilyff.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785121284", "to_ids": true, "type": "domain", "uuid": "6da05c0b-76df-48d5-b7a0-74d34d58a251", "value": "j-gmails.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785121305", "to_ids": true, "type": "domain", "uuid": "3188a58a-e619-466c-ac8e-c69b49d89c28", "value": "cocinternal.cm", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ClickUp attachment subdomain hosting the stage 2 BAT dropper", "deleted": false, "disable_correlation": false, "timestamp": "1785121326", "to_ids": true, "type": "hostname", "uuid": "41f8c1db-d630-4433-a6b0-cbb009362704", "value": "t90141296286.p.clickup-attachments.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Final installer payload download URL", "deleted": false, "disable_correlation": false, "timestamp": "1785121348", "to_ids": true, "type": "url", "uuid": "b3d6857c-5c9f-4114-a18b-813be88409bb", "value": "https://pixeldrain.com/api/file/3v92oJiL", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...n the application. That destination was a path on clickup-attachments[.]com, ClickUp\u2019s public attachment host, and served a W...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785121369", "to_ids": true, "type": "domain", "uuid": "b39e4a77-8245-47dc-98ab-999c7708d3e2", "value": "clickup-attachments.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...PowerShell command that pulled installer.exe from pixeldrain[.]com, saved it under the user\u2019s Temp directory, ran it...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785121390", "to_ids": true, "type": "domain", "uuid": "fdf92238-bfd4-4fea-a208-0bdc75430c8f", "value": "pixeldrain.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "0601500a-3ff6-4aef-92dc-11b376fd8663", "value": "customer.service@9i6pokerdepot.com" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "0259e0e9-cd75-4378-afa4-78063a068440", "value": "contact@ecajovna.sk" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "b2fc277c-29ca-4eff-be6d-16bb5903df1f", "value": "mail@ilyff.com" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "e28be5a5-13fd-4603-87d6-2836e4f021cc", "value": "me@j-gmails.com" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "0a358b59-040c-4ea4-84ba-44d812f57bc4", "value": "me@x2mails.com" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "27ec01e6-1263-42a2-9e1d-f6fa4845c7c3", "value": "cocpostmaster@cocinternal.cm" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "43e336f6-7187-49ab-a4db-8d6a3ca04888", "value": "nationaladmin@gadellinet.com" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "5519eeca-4ddb-452e-8372-c89afda6488c", "value": "nationalintegrity@harteprn.com" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "83fc255e-8253-416c-b006-c5dcc65ca06e", "value": "m365premiumcommunications@cocinternal.com" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785115698", "to_ids": true, "type": "email-src", "uuid": "369db08b-5364-4d40-9d47-3dc74baf8cd0", "value": "documentviewer@na.businesshellosign.de" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121411", "uuid": "7cf87e74-28be-4220-ac1e-fe47158fc702", "Attribute": [ { "category": "Payload delivery", "comment": "File hash of campaign PDF attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "md5", "timestamp": "1785121411", "to_ids": true, "type": "md5", "uuid": "0dd72cc5-d298-4944-b922-17e664f62565", "value": "467f4c566f8a49fa9bc5d36f50f89568", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "File hash of campaign PDF attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "sha1", "timestamp": "1785118345", "to_ids": true, "type": "sha1", "uuid": "507a18cc-c87f-4753-8159-3338d7e461b7", "value": "7d509d135292020a317b0f7a2f444b665396e891", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "File hash of campaign PDF attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "sha256", "timestamp": "1785118345", "to_ids": true, "type": "sha256", "uuid": "aa1edeff-4acb-49d3-8957-52cae0ce765d", "value": "5db1ecbbb2c90c51d81bda138d4300b90ea5eb2885cce1bd921d692214aecbc6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "text", "timestamp": "1785117913", "to_ids": false, "type": "text", "uuid": "52a28eb1-a238-43d2-a06f-13dca090abab", "value": "File hash of campaign PDF attachment\r\nType Description: PDF\nMicrosoft: Trojan:PDF/Phish.DSK!MTB\nClamAV: None\nVT Total Detection: 28/74\nFirst Seen In The Wild: 2026-05-04T17:00:50+00:00\nFirst Submission: 2026-04-14T12:34:50+00:00\nLast Submission: 2026-04-16T15:46:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "creation-time", "timestamp": "1785117914", "to_ids": false, "type": "datetime", "uuid": "74d4515d-248c-4e56-97b1-41e9d88b1057", "value": "2026-04-13T21:19:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "ssdeep", "timestamp": "1785117913", "to_ids": true, "type": "ssdeep", "uuid": "fcd40ab0-fa21-4a63-8145-1adb157e8a0c", "value": "49152:YP0QSMuTELv3DZy9jNqjRyyisWyTZXHp+7XtYfpgBtOGoD:YZSMFfDE9jNqjRybsjTZXIjU2eGoD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117913", "to_ids": false, "type": "size-in-bytes", "uuid": "f8aa641b-415e-471c-b3be-70049e4e2fb8", "value": "1874494" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "vhash", "timestamp": "1785117913", "to_ids": true, "type": "vhash", "uuid": "a9403fe5-0106-4740-9bfd-1eb6a42b9e32", "value": "9ca929e9a50f56ffa5a666f4120526019" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-14T12:34:50+00:00", "last_seen": "2026-04-16T15:46:06+00:00", "object_relation": "filename", "timestamp": "1785117913", "to_ids": true, "type": "filename", "uuid": "b5b1c781-9b16-4dca-a594-ac64c7e80d2d", "value": "Awareness Case Log File - Tuesday 14th, April 2026.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121432", "uuid": "08e9bcbf-f371-40c8-be6d-2d82eaaebc95", "Attribute": [ { "category": "Payload delivery", "comment": "File hash of campaign PDF attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "md5", "timestamp": "1785121432", "to_ids": true, "type": "md5", "uuid": "2a9e68d0-20dd-4243-a049-cca5ccffccb8", "value": "99ce8ecb93b9a43c5697bfa9cbd13b7b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "File hash of campaign PDF attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "sha1", "timestamp": "1785118347", "to_ids": true, "type": "sha1", "uuid": "3f9244be-f9ba-42df-93c6-fcc972bf8383", "value": "f5d0ee4f6eb348d10ccaa4f24cae392782b9bfa3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "File hash of campaign PDF attachment", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "sha256", "timestamp": "1785118347", "to_ids": true, "type": "sha256", "uuid": "32050cf8-4e87-44b1-934e-87169b15f76c", "value": "b5a3346082ac566b4494e6175f1cd9873b64abe6c902db49bd4e8088876c9ead", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "text", "timestamp": "1785117935", "to_ids": false, "type": "text", "uuid": "f2eb9deb-7dcd-447c-aebb-91794ef49206", "value": "File hash of campaign PDF attachment\r\nType Description: PDF\nMicrosoft: Trojan:PDF/Phish.DSK!MTB\nClamAV: None\nVT Total Detection: 26/74\nFirst Seen In The Wild: 2026-05-04T17:00:51+00:00\nFirst Submission: 2026-04-15T17:26:49+00:00\nLast Submission: 2026-04-15T19:25:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "creation-time", "timestamp": "1785117935", "to_ids": false, "type": "datetime", "uuid": "0d26d3a7-fd1e-4125-8fb4-b2f8d5458721", "value": "2026-04-13T21:19:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "ssdeep", "timestamp": "1785117935", "to_ids": true, "type": "ssdeep", "uuid": "0a5e5ad6-e553-40fe-846c-0eeae2911736", "value": "49152:xP0QSMuTELv3DZy9jNqjRyyisWyTZXHp+7XtYfpgBtOGoss:xZSMFfDE9jNqjRybsjTZXIjU2eGoss" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117935", "to_ids": false, "type": "size-in-bytes", "uuid": "1f7ed63b-11c5-4540-8976-f93998e0d40c", "value": "1897864" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "vhash", "timestamp": "1785117935", "to_ids": true, "type": "vhash", "uuid": "eee0b799-a2b4-444b-8e68-589515de60ad", "value": "925100e470fe03ede4a0c049fcaad2a19" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T17:26:49+00:00", "last_seen": "2026-04-15T19:25:06+00:00", "object_relation": "filename", "timestamp": "1785117935", "to_ids": true, "type": "filename", "uuid": "28392641-69c0-44ed-8847-8ca1a983d77f", "value": "Awareness Case Log File - Wednesday 15th, April 2026.pdf" } ] } ] } }