{ "Event": { "analysis": "1", "date": "2026-07-23", "extends_uuid": "", "info": "[Threat Intel] Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days", "protected": false, "publish_timestamp": "1785577610", "published": true, "threat_level_id": "1", "timestamp": "1785577610", "uuid": "3486b70d-db27-45c6-a742-c5d9dc547f46", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#2d8ee7", "local": false, "name": "misp-galaxy:producer=\"Proofpoint\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#d3f567", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#9c8729", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": "" }, { "colour": "#3eb869", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"", "relationship_type": "" }, { "colour": "#0c8fe6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Email Collection - T1114.001\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#fe1ef0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#7628f7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#23cf0e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"", "relationship_type": "" }, { "colour": "#e0f4bc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Event Triggered Execution - T1546\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#0aebeb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": "" }, { "colour": "#7d37d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#d9210a", "local": false, "name": "misp-galaxy:target-information=\"Albania\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Greece\"", "relationship_type": "" }, { "colour": "#e4d611", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Moldova\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#150052", "local": false, "name": "rectifyq:sub-category=\"zero-day\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SpyPress\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT28\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "link", "uuid": "9d9ed15b-c69d-4e59-812e-ed67db42ba86", "value": "https://www.proofpoint.com/us/blog/threat-insight/ta458-roundpress-exploits" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "text", "uuid": "0088c1f1-e0f0-47ca-9faf-d272c1c56d31", "value": "TA458, a Russia-aligned espionage group likely linked to GRU, continues exploiting half-click cross-site scripting vulnerabilities in webmail platforms to steal sensitive email data. These exploits require no user interaction beyond opening the malicious email in webmail. The actor exploited multiple zero-days including SOGo (CVE-2026-8496), Zimbra (CVE-2025-27915), and mDaemon (CVE-2025-3929), alongside n-day Roundcube vulnerabilities. TA458 deploys SpyPress malware, an obfuscated JavaScript-based tool customized for each targeted mailserver, stealing credentials, contacts, and emails. The group primarily targets Ukrainian government entities and Eastern European military installations across Albania, Greece, Moldova, and T\u00fcrkiye, with occasional focus on chemical, telecommunications, and technology sectors. Recent variants include backdoor mechanisms for persistent access through reverse shells and webshells." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "text", "uuid": "f8004e6e-896f-49d2-911c-fdeab1a17af9", "value": "Name: Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days\nAuthor: AlienVault\nAdversary: TA458\nTags: [\"half-click vulnerability\", \"webmail exploits\", \"ta458\", \"cve-2026-8496\", \"cve-2023-43770\", \"cross-site scripting\", \"cve-2025-27915\", \"zero-day\", \"eastern europe targeting\", \"cve-2025-49113\", \"cve-2025-3929\", \"operation roundpress\", \"gru\", \"cve-2024-42009\", \"spypress\"]\nTgtd countries: [\"Albania\", \"Greece\", \"Moldova, Republic of\", \"Ukraine\"]\nMlwr families: [\"SpyPress\"]\nAttack_ids: [\"T1059.007\", \"T1543\", \"T1074.001\", \"T1114.001\", \"T1566.001\", \"T1005\", \"T1190\", \"T1555.003\", \"T1505.003\", \"T1059.001\", \"T1059.004\", \"T1027\", \"T1114.002\", \"T1546\", \"T1573\", \"T1203\", \"T1059.006\", \"T1189\", \"T1071.001\", \"T1105\"]\nIndustries: [\"Government\", \"Defense\", \"Chemical\", \"Telecommunications\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "threat-actor", "uuid": "f3720fc5-21e3-44a3-ad80-6bb8a469cf03", "value": "TA458" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "vulnerability", "uuid": "9f6c169f-a0ed-4231-bffd-a12d36e136e9", "value": "CVE-2023-43770" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "vulnerability", "uuid": "cc5c55f5-a3b2-4940-89e9-8cc2177a0ffe", "value": "CVE-2024-42009" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "vulnerability", "uuid": "911d7243-f2eb-48e0-8576-0923d92c84cf", "value": "CVE-2025-3929" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "vulnerability", "uuid": "7881083a-a177-4f11-b2df-cb6844598a23", "value": "CVE-2025-49113" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "vulnerability", "uuid": "dff5baba-9f95-4014-80a9-d6ea8c22ac59", "value": "CVE-2025-27915" }, { "category": "Network activity", "comment": "SpyPress C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785121455", "to_ids": true, "type": "domain", "uuid": "a40a38b3-485a-48fc-a2ae-e4537bd9a575", "value": "upgybj.store", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SpyPress C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785121477", "to_ids": true, "type": "domain", "uuid": "6799b720-74ca-476f-851a-d074048217bb", "value": "xsza.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "vulnerability", "uuid": "fd6e85ff-32e1-4933-b3e6-45b6465f0209", "value": "CVE-2026-8496" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862022", "to_ids": false, "type": "vulnerability", "uuid": "9ed1ab63-e88b-44db-93a1-7e4358c62671", "value": "CVE-2024-42900" }, { "category": "Network activity", "comment": "SpyPress C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785121499", "to_ids": true, "type": "domain", "uuid": "de29f9cf-fe6b-41b0-956c-3bd754aa9174", "value": "hgmydr.wiki", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SpyPress C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785121520", "to_ids": true, "type": "domain", "uuid": "2c8bc81f-427e-45f9-ae89-2c0b0b5f2a58", "value": "share-ya.space", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SpyPress C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785121541", "to_ids": true, "type": "domain", "uuid": "ced2122d-659b-4ed2-bf3a-1622dc7bab33", "value": "zxzaq.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SpyPress C&C", "deleted": false, "disable_correlation": false, "timestamp": "1785121563", "to_ids": true, "type": "domain", "uuid": "09a22c5c-c4cc-4832-838a-47ae9d1497ff", "value": "xwe.us", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-05-24T13:27:23+00:00", "last_seen": "2025-11-06T09:57:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121584", "uuid": "8ef79d58-b5b2-4191-8683-2e8b215f4d91", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2023-43770 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-24T13:27:23+00:00", "last_seen": "2025-11-06T09:57:17+00:00", "object_relation": "md5", "timestamp": "1785121584", "to_ids": true, "type": "md5", "uuid": "da7da4f4-bbe1-4d93-a2a7-c56b376da578", "value": "c9bb17ae1dc2f92131473c8b61fe0a79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2023-43770 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-24T13:27:23+00:00", "last_seen": "2025-11-06T09:57:17+00:00", "object_relation": "sha1", "timestamp": "1785118350", "to_ids": true, "type": "sha1", "uuid": "3b2a34e8-645f-41e8-8f9f-288de35ea05c", "value": "6ef845938f064de39f4bf6450119a0cdbb61378c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2023-43770 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-24T13:27:23+00:00", "last_seen": "2025-11-06T09:57:17+00:00", "object_relation": "sha256", "timestamp": "1785118350", "to_ids": true, "type": "sha256", "uuid": "ea086479-5a28-44ea-aa28-b696b9eb16eb", "value": "625e4c166c7a1d5a1becf56b27d4f76a2f95935cbd8d556c30a493263d10dbf8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-24T13:27:23+00:00", "last_seen": "2025-11-06T09:57:17+00:00", "object_relation": "text", "timestamp": "1785117959", "to_ids": false, "type": "text", "uuid": "954654b4-c46e-4536-9cdb-b31a228edc1e", "value": "Exploit-laden email (CVE-2023-43770 - Roundcube)\r\nType Description: Email\nMicrosoft: Trojan:JS/Obfuse!MSR\nClamAV: None\nVT Total Detection: 27/74\nFirst Seen In The Wild: 2024-05-24T15:27:41+00:00\nFirst Submission: 2024-05-24T13:27:23+00:00\nLast Submission: 2025-11-06T09:57:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-24T13:27:23+00:00", "last_seen": "2025-11-06T09:57:17+00:00", "object_relation": "ssdeep", "timestamp": "1785117959", "to_ids": true, "type": "ssdeep", "uuid": "05710824-4797-448e-a6f4-a57d2258cc19", "value": "24576:PpQfKsdsbDANuBoCn+8qMk1EQ7tPiSP5nzbsyRaX+W0EZg4+pMgfO9oamX7SN:P270nqlPRHYXks5mX7e" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-24T13:27:23+00:00", "last_seen": "2025-11-06T09:57:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117959", "to_ids": false, "type": "size-in-bytes", "uuid": "cbda4813-fa09-475f-8b62-483e1ba42ff9", "value": "1896191" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-24T13:27:23+00:00", "last_seen": "2025-11-06T09:57:17+00:00", "object_relation": "filename", "timestamp": "1785117959", "to_ids": true, "type": "filename", "uuid": "8e5298dd-7715-466a-9b4c-eed49831b5d0", "value": "c9bb17ae1dc2f92131473c8b61fe0a79.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-01-15T10:28:32+00:00", "last_seen": "2025-01-15T10:28:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121605", "uuid": "68140b83-ecfc-4948-a446-9531fc4db3d1", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2024-42009 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-15T10:28:32+00:00", "last_seen": "2025-01-15T10:28:32+00:00", "object_relation": "md5", "timestamp": "1785121605", "to_ids": true, "type": "md5", "uuid": "af29f0f3-697b-42da-9294-eafc6c091563", "value": "5858e1855b573e7436cf8404eee6a6ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2024-42009 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-15T10:28:32+00:00", "last_seen": "2025-01-15T10:28:32+00:00", "object_relation": "sha1", "timestamp": "1785118351", "to_ids": true, "type": "sha1", "uuid": "b54cee01-bc02-4dc0-8c63-8d36b10ac19f", "value": "82351022c73a4dfb87bf08aad68a6ab18f9c9942", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2024-42009 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-15T10:28:32+00:00", "last_seen": "2025-01-15T10:28:32+00:00", "object_relation": "sha256", "timestamp": "1785118351", "to_ids": true, "type": "sha256", "uuid": "71a4c4d0-d6f5-4f60-a436-5bf482d73bf0", "value": "3a449148a0e3cac604fb93210dd7d91ccf48e06ed9aae064bc53a419a84ce9ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-15T10:28:32+00:00", "last_seen": "2025-01-15T10:28:32+00:00", "object_relation": "text", "timestamp": "1785117980", "to_ids": false, "type": "text", "uuid": "08f4bcc9-e470-4022-a716-20871889bc91", "value": "Exploit-laden email (CVE-2024-42009 - Roundcube)\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2026-03-27T11:58:02+00:00\nFirst Submission: 2025-01-15T10:28:32+00:00\nLast Submission: 2025-01-15T10:28:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-15T10:28:32+00:00", "last_seen": "2025-01-15T10:28:32+00:00", "object_relation": "ssdeep", "timestamp": "1785117980", "to_ids": true, "type": "ssdeep", "uuid": "dc427344-4fef-4dca-8d83-8f6e08c0add6", "value": "1536:ZZjLtsJCbjz9wE3IpQlco1UX4iZlkzA1ZMXg3rM+++UDgAdpUtLyyTdM07T6G:z5Qp9/lZI07mG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-15T10:28:32+00:00", "last_seen": "2025-01-15T10:28:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1785117980", "to_ids": false, "type": "size-in-bytes", "uuid": "777a27b2-a112-4cb5-8c7c-c1044b0db32a", "value": "73027" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-18T16:41:25+00:00", "last_seen": "2026-03-18T16:41:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121626", "uuid": "f90d2813-2029-4a8f-a535-30bc6b0097a3", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2024-42900 + CVE-2025-49113 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T16:41:25+00:00", "last_seen": "2026-03-18T16:41:25+00:00", "object_relation": "md5", "timestamp": "1785121626", "to_ids": true, "type": "md5", "uuid": "201b0766-2fad-492a-be13-50d2489250b5", "value": "0184a7ebfd46cdb356d43520d045522f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2024-42900 + CVE-2025-49113 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T16:41:25+00:00", "last_seen": "2026-03-18T16:41:25+00:00", "object_relation": "sha1", "timestamp": "1785118352", "to_ids": true, "type": "sha1", "uuid": "4b0323d6-1b6f-4297-867a-3ec1b648996e", "value": "c9d31c58f1935befff830c47513bf8192f7992de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2024-42900 + CVE-2025-49113 - Roundcube)", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T16:41:25+00:00", "last_seen": "2026-03-18T16:41:25+00:00", "object_relation": "sha256", "timestamp": "1785118353", "to_ids": true, "type": "sha256", "uuid": "eabfffc8-c46e-493f-982a-9677b7882050", "value": "6b2c02bf82087a3ca5fb7ef8046554ff29ce85d52202bdcfae2b2653aede139a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T16:41:25+00:00", "last_seen": "2026-03-18T16:41:25+00:00", "object_relation": "text", "timestamp": "1785118002", "to_ids": false, "type": "text", "uuid": "0c1382b6-402d-4d5d-95f2-34b131de5fed", "value": "Exploit-laden email (CVE-2024-42900 + CVE-2025-49113 - Roundcube)\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Seen In The Wild: 2026-03-19T10:55:37+00:00\nFirst Submission: 2026-03-18T16:41:25+00:00\nLast Submission: 2026-03-18T16:41:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T16:41:25+00:00", "last_seen": "2026-03-18T16:41:25+00:00", "object_relation": "ssdeep", "timestamp": "1785118002", "to_ids": true, "type": "ssdeep", "uuid": "a9654117-d03e-4e39-ac8e-290c4107aba9", "value": "768:Wez6Rvqp28cceTGgm/P8yFsZDbbMYSHR9dfnv5VbXJSFrm6eu3h+Ev6m09uzRN+Q:WHRyplcPTGIy6RsR9tnv5Jws6jPJxRl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T16:41:25+00:00", "last_seen": "2026-03-18T16:41:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1785118002", "to_ids": false, "type": "size-in-bytes", "uuid": "0723a897-6873-4421-9182-6d427387f76a", "value": "53403" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-04-08T12:23:51+00:00", "last_seen": "2025-04-08T12:23:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121647", "uuid": "56cae8f9-3b4a-460c-a3da-373115fe9baf", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-3929 - mDaemon)", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-08T12:23:51+00:00", "last_seen": "2025-04-08T12:23:51+00:00", "object_relation": "md5", "timestamp": "1785121647", "to_ids": true, "type": "md5", "uuid": "2ec5d9fa-8879-410d-ade4-2c5af19d8a2f", "value": "9a6d807ce4b99efdf6b4c2cc4598e07f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-3929 - mDaemon)", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-08T12:23:51+00:00", "last_seen": "2025-04-08T12:23:51+00:00", "object_relation": "sha1", "timestamp": "1785118353", "to_ids": true, "type": "sha1", "uuid": "87d6ba6a-4dd9-485c-b802-9c23e2f48992", "value": "b0d1d9d29e4f528c0bcbb61b5da0f1067bd858d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-3929 - mDaemon)", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-08T12:23:51+00:00", "last_seen": "2025-04-08T12:23:51+00:00", "object_relation": "sha256", "timestamp": "1785118353", "to_ids": true, "type": "sha256", "uuid": "21d63434-fc4f-48a7-8055-135c9910c8c1", "value": "8b5a4dc237a4c89042176bc89864a4c357dcdd14fa544fe6496ccb6c31cd5b7f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-08T12:23:51+00:00", "last_seen": "2025-04-08T12:23:51+00:00", "object_relation": "text", "timestamp": "1785118024", "to_ids": false, "type": "text", "uuid": "267ef783-dbd7-4502-8580-1939372bd51c", "value": "Exploit-laden email (CVE-2025-3929 - mDaemon)\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-04-08T12:23:51+00:00\nLast Submission: 2025-04-08T12:23:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-08T12:23:51+00:00", "last_seen": "2025-04-08T12:23:51+00:00", "object_relation": "ssdeep", "timestamp": "1785118024", "to_ids": true, "type": "ssdeep", "uuid": "4cc012ed-94c8-436f-9707-50079218dcfc", "value": "1536:C8TImRoIQVziyUHk3Bdu66WEheOxSK8LIvEyC8HZgh:C8chijSBDCC8H4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-08T12:23:51+00:00", "last_seen": "2025-04-08T12:23:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1785118024", "to_ids": false, "type": "size-in-bytes", "uuid": "93066e3a-b7a7-44cb-b998-f0c3c5c7935b", "value": "55805" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-08T12:23:51+00:00", "last_seen": "2025-04-08T12:23:51+00:00", "object_relation": "filename", "timestamp": "1785118024", "to_ids": true, "type": "filename", "uuid": "915dc074-6613-4594-9a7b-c9c970306a52", "value": "Solera Capital Investment Partners.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-01-29T08:28:19+00:00", "last_seen": "2025-01-29T08:28:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121668", "uuid": "ab2a72fe-cd6b-4630-82e0-eb3ce587df98", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-27915 - Zimbra)", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-29T08:28:19+00:00", "last_seen": "2025-01-29T08:28:19+00:00", "object_relation": "md5", "timestamp": "1785121668", "to_ids": true, "type": "md5", "uuid": "ebcb8ad7-9ac2-4e46-af7d-2c60f9aa4c07", "value": "e97044f1823ec55c7e225563646c57bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-27915 - Zimbra)", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-29T08:28:19+00:00", "last_seen": "2025-01-29T08:28:19+00:00", "object_relation": "sha1", "timestamp": "1785118355", "to_ids": true, "type": "sha1", "uuid": "3e27f2d1-7443-4e73-acee-156364b50c10", "value": "a9bc987d152dd123deb97c5b096c7957f0d735fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-27915 - Zimbra)", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-29T08:28:19+00:00", "last_seen": "2025-01-29T08:28:19+00:00", "object_relation": "sha256", "timestamp": "1785118355", "to_ids": true, "type": "sha256", "uuid": "2f9af37e-230f-407e-a481-64f0cfa09f8b", "value": "a0c80cab70d6672b01710a70f93311fc1c1db2fbbf9cd6daa543c34b87e3444a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-29T08:28:19+00:00", "last_seen": "2025-01-29T08:28:19+00:00", "object_relation": "text", "timestamp": "1785118046", "to_ids": false, "type": "text", "uuid": "f604ee11-6938-4dd5-9fcd-64210464cc71", "value": "Exploit-laden email (CVE-2025-27915 - Zimbra)\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2025-01-29T08:28:19+00:00\nLast Submission: 2025-01-29T08:28:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-01-29T08:28:19+00:00", "last_seen": "2025-01-29T08:28:19+00:00", "object_relation": "ssdeep", "timestamp": "1785118046", "to_ids": true, "type": "ssdeep", "uuid": "5480464c-f612-4532-b03d-92adc2428fdc", "value": "1536:pTLGvLXW9pFpaZL9jhS8r1XLWFNNsg22AN0eDiV:Cv7qNV27tDiV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-29T08:28:19+00:00", "last_seen": "2025-01-29T08:28:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1785118046", "to_ids": false, "type": "size-in-bytes", "uuid": "71d27a2f-025a-41f9-bf13-e1727963b97c", "value": "98667" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-01-29T08:28:19+00:00", "last_seen": "2025-01-29T08:28:19+00:00", "object_relation": "filename", "timestamp": "1785118046", "to_ids": true, "type": "filename", "uuid": "47c61ee0-2a1d-4e2f-9720-56a21ca64a9b", "value": "1737449016-0726991d750e6e0001-plvPPt.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-25T17:29:31+00:00", "last_seen": "2026-04-27T10:44:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121689", "uuid": "8d549c4a-d630-4dd9-a91f-9f664e36cb38", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2026- 8496, SOGo)", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-25T17:29:31+00:00", "last_seen": "2026-04-27T10:44:48+00:00", "object_relation": "md5", "timestamp": "1785121689", "to_ids": true, "type": "md5", "uuid": "aff45829-a1c6-4cf9-8664-605a5476489f", "value": "966c71db91ba9cf8012e62a2329c9117", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2026- 8496, SOGo)", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-25T17:29:31+00:00", "last_seen": "2026-04-27T10:44:48+00:00", "object_relation": "sha1", "timestamp": "1785118356", "to_ids": true, "type": "sha1", "uuid": "97fdde96-0fe2-495d-9e4a-75b37a28d378", "value": "ed17503f81a2ba816cb68ff9ce7d2732e807a4e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2026- 8496, SOGo)", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-25T17:29:31+00:00", "last_seen": "2026-04-27T10:44:48+00:00", "object_relation": "sha256", "timestamp": "1785118356", "to_ids": true, "type": "sha256", "uuid": "71911567-5870-452a-be3c-9e44c4c3d530", "value": "e27d1bf82249002a66395c89dbda6ec5d8df012a84b79d36fffbbf7808d28878", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-25T17:29:31+00:00", "last_seen": "2026-04-27T10:44:48+00:00", "object_relation": "text", "timestamp": "1785118067", "to_ids": false, "type": "text", "uuid": "cb9faa4b-7911-4c8d-99aa-27ca0b32b847", "value": "Exploit-laden email (CVE-2026- 8496, SOGo)\r\nType Description: Email\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Seen In The Wild: 2026-04-25T19:30:10+00:00\nFirst Submission: 2026-04-25T17:29:31+00:00\nLast Submission: 2026-04-27T10:44:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-25T17:29:31+00:00", "last_seen": "2026-04-27T10:44:48+00:00", "object_relation": "ssdeep", "timestamp": "1785118067", "to_ids": true, "type": "ssdeep", "uuid": "0211b966-045f-4786-b42f-3131f109c5ec", "value": "24576:lKAxRuYibppq/UHXyPmXvyNbBcDuFzVTw/njW++vn/KSU0cMGEMau3SA46LwNpOy:jAvpyPmXVgVujdR33V4/l4yHv80Sd9c" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-25T17:29:31+00:00", "last_seen": "2026-04-27T10:44:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1785118067", "to_ids": false, "type": "size-in-bytes", "uuid": "81157a01-8bb7-4dcc-9432-0125d8264df8", "value": "3153193" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-25T17:29:31+00:00", "last_seen": "2026-04-27T10:44:48+00:00", "object_relation": "filename", "timestamp": "1785118067", "to_ids": true, "type": "filename", "uuid": "b7ce2212-9a8f-4aa5-bb46-30095278e139", "value": "703 - \u0410\u043d\u0430\u043b\u0456\u0437 \u0442\u0430 \u043e\u043f\u0442\u0438\u043c\u0456\u0437\u0430\u0446\u0456\u044f.. - 2026-03-16 16_08_40 +0200.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-07-18T23:13:45+00:00", "last_seen": "2025-07-18T23:13:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785121710", "uuid": "db136f13-ed31-4f28-bb92-53537c37714e", "Attribute": [ { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-27915 - Zimbra)", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-18T23:13:45+00:00", "last_seen": "2025-07-18T23:13:45+00:00", "object_relation": "md5", "timestamp": "1785121710", "to_ids": true, "type": "md5", "uuid": "80e66ded-1156-49e8-a0e3-ba4287d5c888", "value": "8437b26697ad9eda3d19ab1eb0b13243", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-27915 - Zimbra)", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-18T23:13:45+00:00", "last_seen": "2025-07-18T23:13:45+00:00", "object_relation": "sha1", "timestamp": "1785118356", "to_ids": true, "type": "sha1", "uuid": "a6329a59-d583-48ab-9e00-cbdd1daec472", "value": "f408ec215fef522f75911d547f380eb2e714675a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Exploit-laden email (CVE-2025-27915 - Zimbra)", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-18T23:13:45+00:00", "last_seen": "2025-07-18T23:13:45+00:00", "object_relation": "sha256", "timestamp": "1785118356", "to_ids": true, "type": "sha256", "uuid": "26b052f0-4024-406c-9ef8-113837a92887", "value": "fb8ec4dbed14c0a91361abd82ebe9fb083615c3dbb15348f57317af7cc41dd34", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-18T23:13:45+00:00", "last_seen": "2025-07-18T23:13:45+00:00", "object_relation": "text", "timestamp": "1785118089", "to_ids": false, "type": "text", "uuid": "4fc39bfa-2b7a-4a74-801f-f608c9744400", "value": "Exploit-laden email (CVE-2025-27915 - Zimbra)\r\nType Description: Email\nMicrosoft: Trojan:Win32/Alevaul!rfn\nClamAV: None\nVT Total Detection: 16/74\nFirst Submission: 2025-07-18T23:13:45+00:00\nLast Submission: 2025-07-18T23:13:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-18T23:13:45+00:00", "last_seen": "2025-07-18T23:13:45+00:00", "object_relation": "ssdeep", "timestamp": "1785118089", "to_ids": true, "type": "ssdeep", "uuid": "5347d673-cc27-455d-bf3a-6bc818757535", "value": "3072:7eBZDN51I87XTTZHeLntSGftUKh9vyptVlbfIPk0eWr/Y+:7e/1IMXTGdtIN+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-18T23:13:45+00:00", "last_seen": "2025-07-18T23:13:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1785118089", "to_ids": false, "type": "size-in-bytes", "uuid": "68f2f42a-6352-4a53-b3fa-0183b5328293", "value": "150172" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-18T23:13:45+00:00", "last_seen": "2025-07-18T23:13:45+00:00", "object_relation": "filename", "timestamp": "1785118089", "to_ids": true, "type": "filename", "uuid": "d51d033f-a22f-447a-b52f-70aec4b58a28", "value": "militarycooperation.eml" } ] } ] } }