{
  "Event": {
    "analysis": "1",
    "date": "2026-07-20",
    "extends_uuid": "",
    "info": "[Threat Intel] HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels",
    "protected": false,
    "publish_timestamp": "1785033929",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785033928",
    "uuid": "4bb32559-5765-4d2c-bfc1-e426028df910",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Group-IB\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#bb2745",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#110e53",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#3eb869",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#56c932",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#a9f8b1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#23cf0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#57997c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bidirectional Communication - T1102.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0add7f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#26fab6",
        "local": false,
        "name": "misp-galaxy:target-information=\"Israel\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"LYCEUM\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"OilRig\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784631629",
        "to_ids": false,
        "type": "link",
        "uuid": "b11215d0-6670-455a-97db-6669ed67e4b9",
        "value": "https://www.group-ib.com/blog/hollowgraph-microsoft-365/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784631629",
        "to_ids": false,
        "type": "text",
        "uuid": "bbd77072-e5db-4bcd-875f-f712b63f06e9",
        "value": "A sophisticated espionage campaign has been identified leveraging malware that exploits Microsoft Graph API to transform compromised Microsoft 365 calendars into covert command-and-control infrastructure. The malware creates calendar events dated to 2050 with encrypted attachments to exfiltrate files and receive instructions. A secondary DNS tunneling channel using IPv6 AAAA records refreshes Microsoft Entra ID credentials for authentication. Communications are secured using hybrid RSA and AES-256-GCM encryption with separate key pairs for inbound and outbound channels. Twelve infected systems have been identified, primarily targeting Israeli entities, with only three actively communicating with attackers. The operation demonstrates high technical sophistication and disciplined targeting, suggesting a well-resourced adversary conducting focused espionage operations since at least June 2026."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784631629",
        "to_ids": false,
        "type": "text",
        "uuid": "deced967-7938-451a-9991-41aa685cedbf",
        "value": "Name: HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels\nAuthor: AlienVault\nAdversary: LYCEUM\nTags: [\"dns tunneling\", \"israeli targets\", \"iranian-nexus\", \"calendar c2\", \"hollowgraph\", \"microsoft graph api abuse\", \"cyber espionage\", \"cavern\"]\nTgtd countries: [\"Israel\"]\nMlwr families: [\"HOLLOWGRAPH\", \"Cavern\"]\nAttack_ids: [\"T1132.001\", \"T1071.004\", \"T1074.001\", \"T1573.001\", \"T1005\", \"T1140\", \"T1567\", \"T1055\", \"T1059\", \"T1083\", \"T1041\", \"T1027\", \"T1114.002\", \"T1102.002\", \"T1567.002\", \"T1071.001\", \"T1105\", \"T1078.004\", \"T1048.003\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784631629",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "b5601b31-3bcd-4a37-9fda-2c0e5e93d4f8",
        "value": "LYCEUM"
      },
      {
        "category": "Network activity",
        "comment": "attacker-controlled domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902274",
        "to_ids": true,
        "type": "domain",
        "uuid": "2fd3ca63-8a53-422d-a370-cc32374ecc55",
        "value": "cloudlanecdn.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 24/07/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899534",
        "to_ids": true,
        "type": "sha256",
        "uuid": "92213ce7-86fb-45b2-8569-ae53cbb1d3eb",
        "value": "1573e125197ec77d8e9930c611ba2802ee59e19629396b5e99b426b46c53bd25",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902296",
        "to_ids": true,
        "type": "hostname",
        "uuid": "e975b86e-ff4d-4686-9a4f-df9e00c2ed3a",
        "value": "p.cloudlanecdn.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784902318",
        "to_ids": true,
        "type": "hostname",
        "uuid": "28fc3ffc-3c98-4ea4-9c40-1f9b4ea07ea2",
        "value": "q.cloudlanecdn.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Compromised mailbox",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784891502",
        "to_ids": true,
        "type": "email-src",
        "uuid": "631debcb-a960-46b9-89fb-af82734aba4b",
        "value": "removed@removed.co.il"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2024-12-30T07:10:00+00:00",
        "last_seen": "2024-12-31T03:26:36+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784902341",
        "uuid": "b1a570a5-d062-427e-a57f-dc84e893158d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "md5",
            "timestamp": "1784902341",
            "to_ids": true,
            "type": "md5",
            "uuid": "c905d857-13a2-4a67-8299-7116a55cbadb",
            "value": "7bd6cac7e8e73e80e4e6b7b8c1681056",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899529",
            "to_ids": true,
            "type": "sha1",
            "uuid": "dd2b805b-33a7-43bf-9a88-f2e105b144ca",
            "value": "31b0b706791f8cbefe302d676c4617182009df64",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899529",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a6a31b25-d2b7-4f09-91c6-c71bd5f1a146",
            "value": "315bdba98c6fe863d39f6afccc727e17d5aea63bf21259444fa988cae56d61c1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "text",
            "timestamp": "1784898773",
            "to_ids": false,
            "type": "text",
            "uuid": "38ce915e-1c8d-47c8-aac0-13c388c2c245",
            "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Vigorf.A\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2024-12-30T09:21:09+00:00\nFirst Submission: 2024-12-30T07:10:00+00:00\nLast Submission: 2024-12-31T03:26:36+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784898773",
            "to_ids": false,
            "type": "datetime",
            "uuid": "6c58837c-c836-4c73-bb26-0f2984d571bb",
            "value": "2020-06-25T10:38:26+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784898773",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "345fdcf2-3354-4282-b7cc-689fe7ef24fd",
            "value": "393216:GjhTr+VHrivusueQy3bBQz19WF0eDJmpNf/XILgJFXz28iLRO2e9M:GjklrivusueQy3bQ1aLDJEPigJ5ydaM"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784898773",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "88bd4985-ab7f-4d44-bba6-1a6a1586b582",
            "value": "16619009"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "vhash",
            "timestamp": "1784898773",
            "to_ids": true,
            "type": "vhash",
            "uuid": "fd94fd4f-459e-4929-8416-4692b20b2ae6",
            "value": "017076655d155d15155az9-z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2024-12-30T07:10:00+00:00",
            "last_seen": "2024-12-31T03:26:36+00:00",
            "object_relation": "filename",
            "timestamp": "1784898773",
            "to_ids": true,
            "type": "filename",
            "uuid": "563b8af0-9cea-4c19-8a7f-98d675d54d53",
            "value": "2024-12-31_7bd6cac7e8e73e80e4e6b7b8c1681056_ryuk"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-06-07T13:31:55+00:00",
        "last_seen": "2026-06-07T13:31:55+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784902363",
        "uuid": "2ea8b1d5-ac78-4e0a-a715-4311bb606ebf",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "md5",
            "timestamp": "1784902363",
            "to_ids": true,
            "type": "md5",
            "uuid": "b09bc107-e914-4234-82c3-973be40fdcb5",
            "value": "caf021dda726b8ba049c2aa395e505a1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899530",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8f95626f-fee0-4ec1-bde0-e5bf83853b92",
            "value": "83ed3f17a83b083246f90011d33861cdb5734ab3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899530",
            "to_ids": true,
            "type": "sha256",
            "uuid": "91cd8d44-8e51-4dd9-9c30-49a8bed82360",
            "value": "75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "text",
            "timestamp": "1784898817",
            "to_ids": false,
            "type": "text",
            "uuid": "1b59e2ca-45b2-45bf-8a34-bffe57d3beb3",
            "value": "Type Description: Win32 DLL\nOriginal name: AzureCommunication.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 36/74\nFirst Seen In The Wild: 2026-06-07T15:32:18+00:00\nFirst Submission: 2026-06-07T13:31:55+00:00\nLast Submission: 2026-06-07T13:31:55+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784898817",
            "to_ids": false,
            "type": "datetime",
            "uuid": "56c18ea9-91b7-4aa1-a67e-7e98e93bbc20",
            "value": "2026-05-19T14:39:38+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784898817",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "db61da5e-51d7-4ec2-8c02-a8428afacf0e",
            "value": "98304:aU60WM8VPosc9STE8UUx6lzEASp0kRYRGNs1aNkssW2:aU6c8poseaErEAgyRGyaNtO"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784898817",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "34119fec-a473-4a3d-99b0-f735c07fbaa5",
            "value": "12705792"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "vhash",
            "timestamp": "1784898817",
            "to_ids": true,
            "type": "vhash",
            "uuid": "bea20565-bb6a-48b7-96cc-6b96ffc62b3b",
            "value": "117066656d1565155122z1c2z9c7z7kz1a5z28"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-06-07T13:31:55+00:00",
            "last_seen": "2026-06-07T13:31:55+00:00",
            "object_relation": "filename",
            "timestamp": "1784898817",
            "to_ids": true,
            "type": "filename",
            "uuid": "e1264c03-7b4d-4a33-9417-2034d0b57642",
            "value": "AzureCommunication.dll"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-02T09:44:40+00:00",
        "last_seen": "2026-07-02T09:44:40+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784902385",
        "uuid": "d794ba92-c1a1-41a8-9f80-9b13158f74ce",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "md5",
            "timestamp": "1784902385",
            "to_ids": true,
            "type": "md5",
            "uuid": "5f926b7d-b00c-4496-b3e9-6858fc9eacb1",
            "value": "c092b02fbc0fdf7ee9608dd016673806",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899531",
            "to_ids": true,
            "type": "sha1",
            "uuid": "a24ad57b-30cc-4d59-9cc9-b0cc189efee0",
            "value": "beb57441b81e56d1d7ba72acd841f2ffe171a325",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899531",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e96e378a-05ef-4559-a1f5-9ce840a37538",
            "value": "b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "text",
            "timestamp": "1784898838",
            "to_ids": false,
            "type": "text",
            "uuid": "54270e39-96bf-4d2e-a0db-7c84f721c15a",
            "value": "Type Description: Win32 DLL\nOriginal name: NewProject.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 35/74\nFirst Seen In The Wild: 2026-07-02T12:27:48+00:00\nFirst Submission: 2026-07-02T09:44:40+00:00\nLast Submission: 2026-07-02T09:44:40+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784898839",
            "to_ids": false,
            "type": "datetime",
            "uuid": "80948707-4dac-4bed-8554-80353426d117",
            "value": "2026-07-02T09:43:02+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784898838",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "f2e4f291-8359-4ee5-87e5-a862f96f8a23",
            "value": "98304:pFO48YE0tGa5SI8mXiAyJOHL83bGTI+GYJO8K:pFO4vUa5Sjsi883KI+GcO8K"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784898838",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e9817d2b-5dde-48a0-a9bb-d355c2b10f47",
            "value": "12705792"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "vhash",
            "timestamp": "1784898838",
            "to_ids": true,
            "type": "vhash",
            "uuid": "50cd2d63-58ac-4388-974e-31937d0add76",
            "value": "117066656d1565155122z1c2z9c7z7kz1a5z28"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-02T09:44:40+00:00",
            "last_seen": "2026-07-02T09:44:40+00:00",
            "object_relation": "filename",
            "timestamp": "1784898838",
            "to_ids": true,
            "type": "filename",
            "uuid": "74c4561e-db04-4628-b893-b5191287588a",
            "value": "NewProject.dll"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-02T09:34:27+00:00",
        "last_seen": "2026-07-02T09:34:27+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784902407",
        "uuid": "653b4496-6796-4046-a3d4-deda2278bd3f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "md5",
            "timestamp": "1784902407",
            "to_ids": true,
            "type": "md5",
            "uuid": "0583f364-dddd-44d0-9b1e-16d752b2608b",
            "value": "29b2b8c5d99f05bfcdd0d8d976eb5678",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "sha1",
            "timestamp": "1784899532",
            "to_ids": true,
            "type": "sha1",
            "uuid": "bbae796b-911d-42cf-ba0b-136f78d380ac",
            "value": "66c8a4d782ec9e19d67f426376e0ebb5af868590",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "sha256",
            "timestamp": "1784899533",
            "to_ids": true,
            "type": "sha256",
            "uuid": "64ae7864-a46b-4bf3-8eb3-311eac82e644",
            "value": "f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "text",
            "timestamp": "1784898860",
            "to_ids": false,
            "type": "text",
            "uuid": "8b1b8829-8c26-4e73-a300-4c5a0f01c209",
            "value": "Type Description: Win32 DLL\nOriginal name: AzureCommunication.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 37/74\nFirst Seen In The Wild: 2026-07-02T11:34:54+00:00\nFirst Submission: 2026-07-02T09:34:27+00:00\nLast Submission: 2026-07-02T09:34:27+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "creation-time",
            "timestamp": "1784898860",
            "to_ids": false,
            "type": "datetime",
            "uuid": "08c467f3-5ed4-4fb6-9a01-df0fd9273663",
            "value": "2026-05-27T09:40:24+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784898860",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "cb4e34ba-3ff8-420a-9a83-1a8c7b3342d9",
            "value": "98304:ZUS8xp6ZuLjXmD/Wgl706m5RASp0kRYRGBs1askssW:ZUSE6ILj2jWxRAgyRGWast"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784898860",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "d138a55e-e68e-4abf-955d-cc906b7d5433",
            "value": "12705792"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "vhash",
            "timestamp": "1784898860",
            "to_ids": true,
            "type": "vhash",
            "uuid": "fc21aa3d-9d2e-4c9b-9f65-00a93a8fae89",
            "value": "117066656d1565155122z1c2z9c7z7kz1a5z28"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-02T09:34:27+00:00",
            "last_seen": "2026-07-02T09:34:27+00:00",
            "object_relation": "filename",
            "timestamp": "1784898860",
            "to_ids": true,
            "type": "filename",
            "uuid": "5d864217-b945-4bf3-84bb-119da80b044c",
            "value": "AzureCommunication.dll"
          }
        ]
      }
    ]
  }
}